Endpoint Protection

http://www.symantec.com/business/support/index?page=content&id=TECH163030

This was a known issue for 12.1 and I was told it was going to be fixed in RU1. Looking through the release notes and fixes for RU1, I do not see it as being fixed in this version and machines that were rebooting after upgrading from 11 to 12.1(which forced me to downgrade them back to 11) are still rebooting after  installing 12.1 RU1.

Can anyone tell me if this is supposed to be fixed in RU1?

PFA the Fix notes.

Attachment(s)

Fix Notes for SEP 12 1 RU1_0.docx   38 KB 1 version

The defect says its fixed and verified, so it should be working.

What is your workflow to reproduce the problem?

I have several virtual machines that have been cloned from a vmware image that had Windows 7 and SEP 11 installed. They had been running fine for months with SEP 11, then the 12.1 version came out, so I installed that and they began rebooting shortly after logon (30 seconds). Then I uninstalled SEP 12.1 and put 11 back on after I saw there was a known issue with tamper protection causing reboots and was told to wait until RU1 to fix it.

Today, I installed 12.1 RU1 onto some of those same machines again and had the same problem of rebooting shortly after logon. Also, I want to mention that they are hard reboots as if I reset the virtual machine.

The only "fix" I have seen for this problem is disabling tamper protection when cloning the machine. Obviously I cannot do this because they have been in production and working fine with SEP 11 for at least a few months now.

EDIT: I haven't tried upgrading any of my cloned 2008 servers because it has been so unreliable on Win7, so I can't comment on that aspect

began rebooting shortly after logon (30 seconds)

Can you go to 1 problem machine start run msconfig - boot tab and change the value from 30 seconds to higher note this is only for tesing purposes .

And yes you are correct tamper protection will stop this issue as boot files for OS are getting tampered ,can you please upload the event log too .

I booted into safe mode, changed the value to 300, and reboooted and it did not make a difference. Still reboots. Below is the warning Windows displays after logging in.

Do you mean the Windows event viewer? The only log in there is that "the system has rebooted without cleanly shutting down first. This error could be caused if the system stopped responding, crashed, or lost power"

If you mean the SEP Event log, what is the best way to get that through safe mode since I cannot boot normally long enough to retrieve it?

Same error message and reboots automatically