Endpoint Protection

 View Only
Back to discussions
Expand all | Collapse all

After Installing MR4MP1 Conection to Exchange 2003 and DC is blocked stil same with MR4MP1a

Migration User

Migration UserMar 27, 2009 05:12 AM

  • 1.  After Installing MR4MP1 Conection to Exchange 2003 and DC is blocked stil same with MR4MP1a

    Posted Mar 06, 2009 02:46 PM

     

    Hello I have big problems since installation of MR4MP1 and these problems are not gone even after Installing MR4MP1a.
    I have two servers
    1. Windows server 2003 with Exchange 2003 and SEP management server and SEP antivirus with network protection
    2. Windows Server 2003 Domain Controller with SEP antivirus with network protection
    After install at first glance writhing was OK but after some time big problems begun. On Exchange machine there were many errors logged to event log with errors from exchange system attendant were is stated that it cannot connect to DC and there is no DC available. After this Store MDB is generating exceptions and shuts down with critical errors after which Windows is asking to send error report to Microsoft. There were also Data Execution Prevention Warnings and I have to enable manually DEP for Microsoft MDB. There are also problems when accessing OWA from client computers. The problem is that in owa on new messages body of message are not visible. (Attachment is visible). After accessing OWA exchange crashes with errors and Server is Unresponsive for a while. Server Restart Helps for some time but after writhing is messed up again.
    I have read for MR4MP1 that I must remove Firewall but when I choose SEP 11 one of the reasons was Firewall.
    But I have noted new version and hope that this will help. I have installed MR4MP1 but without any changes for my case.
    I have even tried completely uninstalling SEP and installing it again without any success.
    I was using SEP 11 SP3 and everything was OK but Now I can’t find MR3 Installation on my CD pleas Help my where I can get MR3 download link. (Because even in MR4 there is a glitch Auto protect is working all day long with very high activity).
    P.S I have tried many thing even Clean Wipe tool so I am gone to reinstall whole server and maybe some mentioned problems are not related to SEP 11 MR4MP1 or MP1a but this problems begun after installing MR4MP1.
     


  • 2.  RE: After Installing MR4MP1 Conection to Exchange 2003 and DC is blocked stil same with MR4MP1a

    Posted Mar 06, 2009 03:02 PM

    Only Antivirus and Antispyware is supported on servers.  I saw a post from Paul M the other day saying one more part of the SEP client was supported on servers but I can't remember what it was.  Try installing AV and AS only and see if that clears up your problem.



  • 3.  RE: After Installing MR4MP1 Conection to Exchange 2003 and DC is blocked stil same with MR4MP1a

    Posted Mar 06, 2009 03:52 PM

    Network Threat Protection is Supported on SEP 11 on servers were  another firewall is not installed.

    On servers are not supported Proactive Threat Protection and antivirus for e-mail and Outlook Scanner.

    I have red tis in Administrator Guade of Sep 11

     



  • 4.  RE: After Installing MR4MP1 Conection to Exchange 2003 and DC is blocked stil same with MR4MP1a

    Posted Mar 06, 2009 04:25 PM

    Try withdrawing the firewall policy for that server to see if it clears up.  If it does, you will have to add rules to allow certain types of traffic when you enable the policy.  I came across a post from Paul M saying that NTP will work on domain controllers, but you need to tweak the rules (didn't say what exactly).



  • 5.  RE: After Installing MR4MP1 Conection to Exchange 2003 and DC is blocked stil same with MR4MP1a

    Posted Mar 06, 2009 06:02 PM

    You used to have to tweak the rules for servers and DC's but the out of the box rules now should allow all communications anyway, so there shouldn't be an issue...  

    Out of interest, have you tried it without Network Threat Protection, to eliminate that possibility?  We have plenty of customers running everything on servers without any issues.



  • 6.  RE: After Installing MR4MP1 Conection to Exchange 2003 and DC is blocked stil same with MR4MP1a

    Posted Mar 09, 2009 04:47 AM

     I am wondering if new IPS engine Krypton is causing problems. <o p=""></o>

    Because I have enabled all traffic between DC and Exchange server 2003 in rules section. (I have added rule to allow all traffic between DC and exchange server 2003 ). Even with MR3 there was logs in network treat protection that stated that IPv6 over IPv4 teredo packets blocked from Exchange 2003 server to DC server. This was strange because I am not using IPv6 protocol but everything was working ok so it was no big issue for me.<o p=""></o>

    I am using GFI mail Essentials and GFI mail Security for exchange server 2003  maybe it is the issue but if it the cause for this problems it should be corrected from your side because it is a great products for exchange 2003.<o p=""></o>

    Another thing I am suspicions of causing problems is that I have updated my exchange server 2003 with latest Microsoft patch related to some critical vulneribites (I don’t remember KB number)<o p=""></o>

    Alsso if accessing mailbox from OWA (Outlook Web Access) it crashes Exchange Server 2003 and makes server were exchange is running temporarily unresponsive.<o p=""></o>

    P.S if this problem is not related to Krypton blocking communications between DC and exchange Servers maybe someone can provide me with link to download SEP11MR3<o p=""></o>

     



  • 7.  RE: After Installing MR4MP1 Conection to Exchange 2003 and DC is blocked stil same with MR4MP1a

    Posted Mar 13, 2009 04:55 AM

     

    I have tried without NTP and it seems that exchange was working (with Outlook) but after accessing Exchange with Outlook Web Access (OWA) Exchange Server crashes down. I am accessing it from client workstation so don’t tell me to uninstall NTP also from Client commuters.<o p=""></o>

    <o p=""></o>



  • 8.  RE: After Installing MR4MP1 Conection to Exchange 2003 and DC is blocked stil same with MR4MP1a

    Posted Mar 13, 2009 09:58 AM

    We are still having issues with some of our users and network applications, even with the MP1a build.  I have even resorted to using cleanwipe, and a handful of clients are still having issues.  One PC in our IT department is having issues even when rolling back to the original MR4 build.

    I cannot seem to isolate anything unique about the machines still having issues, but it clearly is SEP related, since disabling/removing NTP fixes the issue in all cases.



  • 9.  RE: After Installing MR4MP1 Conection to Exchange 2003 and DC is blocked stil same with MR4MP1a

    Posted Mar 13, 2009 12:31 PM

    Were there any issues with connecting to Exchange prior to MR4 MP1?  We are currently at MR4 and not planning on upgrading anytime soon with the issues everyone else is having with MP1, MP1a, etc.  Our Exchange server is the last machine that needs to be upgraded from SAV 10.1.  I was planning on installing a package that contained the Antivirus and Antispyware as well as Network Threat Protection so I could do Application and Device Control log policies on it.  I take it that I should not be installing TrueScan Proactive Threat Scan or any of the E-mail Protection in the package.  Any advice with regard to best practices/procedures would be greatly appreciated.  I don't want to be picking up the pieces of a busted Exchange server after installing the SEP client on it.

    Thanks.



  • 10.  RE: After Installing MR4MP1 Conection to Exchange 2003 and DC is blocked stil same with MR4MP1a

    Posted Mar 17, 2009 02:42 AM

    From the Symantec_Endpoint_Protection_11.0.4000_MR4_AllWin_EN_CD1 Readme.txt file:

    ------------------------------------------------------------------------------------
    BEST PRACTICE: Do not install Network Threat Protection on client computers that currently run third-party firewalls.
    ------------------------------------------------------------------------------------
    Do not install Network Threat Protection on client computers that currently run third-party firewalls. Two firewalls that run on one computer at the same time can drain resources, and the firewalls might have rules that conflict with each other. Third-party firewalls include Microsoft ISA firewall and Windows Firewall.

     

    Make sure to turn off the Windows firewall... a GPO would probably be the best way to do it in a domain.



  • 11.  RE: After Installing MR4MP1 Conection to Exchange 2003 and DC is blocked stil same with MR4MP1a

    Posted Mar 19, 2009 03:40 PM

     

    Adrian
    I can advise do not upgrade Exchange server with this builds (MP1 and MP1a) because after this exchange server will start generating a lot of errors (you can look in my earlier posts in this topic). Also I what to advice to not upgrading Active directory Domain Controller Server because after this not only exchange server will start doing crazy things but also other apps(For example network Connectivity will have serious problems. I have for example problems with virtual servers on Virtual Server 2005 trying to connect to Windows Update services.).
     In fact it’s more important to not upgrade Domain Controller than Exchange Because if MP1 is installed on exchange and not on DC exchange will work somehow (with small glitches) except Outlook web access that will not work.
     


  • 12.  RE: After Installing MR4MP1 Conection to Exchange 2003 and DC is blocked stil same with MR4MP1a

    Posted Mar 19, 2009 05:41 PM

    I can confirm that after upgrading one DC/Exchange/SEPM server, clients that use this server are talking to another domain controller/Exchange server (a lot of traffic).  I don't know what kind of traffic, but for one site, it's maxing out my fractional T1 (clients with no server).  I only installed AV and AS on the server and clients are mixed MR4 and MR4 MP1A.  SEPM on the server is MR4 MP1.



  • 13.  RE: After Installing MR4MP1 Conection to Exchange 2003 and DC is blocked stil same with MR4MP1a

    Posted Mar 20, 2009 04:29 AM

     

    Hi Rick,

    You installed AV/AS only on your server but did you withdraw firewall and IPS policies from a group which your server resides?  

     



  • 14.  RE: After Installing MR4MP1 Conection to Exchange 2003 and DC is blocked stil same with MR4MP1a

    Posted Mar 20, 2009 04:40 AM

    No, I didn't.  Was I supposed to?  When I look at the client on the server, NTP and PTP do not show as being installed.  If I was supposed to withdraw the policies, why has this been working since MR2 and suddenly give me problems going from MR4 to MR4 MP1A?  I think I may be missing something.



  • 15.  RE: After Installing MR4MP1 Conection to Exchange 2003 and DC is blocked stil same with MR4MP1a

    Posted Mar 20, 2009 04:48 AM

    Before I uninstalled MP1A, I tested OWA and it worked on my DC/Exchange/SEPM server.  This was an Exchange 2003 sp2 Backend server while the Frontend server (nothing but Exchange 2003 sp2) was running SEP MR4 for the client.  HTH



  • 16.  RE: After Installing MR4MP1 Conection to Exchange 2003 and DC is blocked stil same with MR4MP1a

    Posted Mar 20, 2009 08:48 PM

     

    RickJDS
     Do not withdraw firewall polices from group!!! I have tried this and it has catastrophic result for Server where Exchange was installed (I mean not only exchange software but whole server). It's better to uninstall NTP from Add/Remove.
     
    About OWA I think its problem of exceptions (AV Exceptions) not working correctly with this builds. Because I have added folder exceptions for AV both in SEP Client and SEP Manager (Global Exceptions) but it’s not working correctly. I have exchange anti spam and antivirus and GFI Mail security on some mails is generating errors. This is why I think problem is with exception handling.
    P.S I am absolutely confident that I have all relevant folders to exceptions because earlier this was working fine.
     

     



  • 17.  RE: After Installing MR4MP1 Conection to Exchange 2003 and DC is blocked stil same with MR4MP1a

    Posted Mar 21, 2009 08:54 AM

     

    RickJDS
    Do not withdraw firewall polices from group!!! I have tried this and it has catastrophic result for Server where Exchange was installed (I mean not only exchange software but whole server). It's better to uninstall NTP from Add/Remove.
     
     Hi
     
    You need to withdraw policies after you removed NTP component not before it! In my experience removing NTP only set the driver to dormant mode, in the other hand firewall driver (teefer2.sys) is always present and sometimes process polices when it shouldnt do that!


  • 18.  RE: After Installing MR4MP1 Conection to Exchange 2003 and DC is blocked stil same with MR4MP1a

    Posted Mar 21, 2009 07:48 PM

    Now I'm not sure what to do.  Firewall policies are inherited but NTP was never installed on the server I'm having problems with.  I've never had problems until I tried to upgrade the server's SEP client from MR4 to MR4 MP1A.

    I'm now working on purchasing and installing Netflow Analyzer so I can see what kind of traffic is generated.  Just have to get the purchase approved.



  • 19.  RE: After Installing MR4MP1 Conection to Exchange 2003 and DC is blocked stil same with MR4MP1a

    Posted Mar 23, 2009 08:07 AM

    Rick - if you are fairly certain that it's traffic between your Exchange box / DC, then Wireshark should be a much free'er option than netflow for a 'one off' analysis.

    nick

     

     



  • 20.  RE: After Installing MR4MP1 Conection to Exchange 2003 and DC is blocked stil same with MR4MP1a

    Posted Mar 27, 2009 05:12 AM



  • 21.  RE: After Installing MR4MP1 Conection to Exchange 2003 and DC is blocked stil same with MR4MP1a

    Posted Apr 07, 2009 10:02 AM
    Don' t use host groups for exclusions and rules, and don't exclude the DCs from Intrusion prevention under the excluded hosts button.
    It seems to choke up name resolution.


  • 22.  RE: After Installing MR4MP1 Conection to Exchange 2003 and DC is blocked stil same with MR4MP1a

    Posted Apr 07, 2009 10:32 AM
    Injecting Firewall in servers is equal to injecting plenty of risks in your servers!!
    No doubt! eliminate anything that may role as firewall such as the Network Threat Protection, IPS and application and Device control.

    Next is that when you apply such policies to your servers, the transaction to the the SEP Server will be impact by the rules. Therefore retrieving new policies willo be affected by the present rules. hence, try to apply the new plicies on a normal computer that you are 100% sure it recieves them, and then export the policies from this one. Then you can save and transfere the exported policy to your mulfunctioning server and then import them to the SEP Client.

    I hope it helps you get rid of the hell you described!!