Endpoint Protection

We recently upgraded to the 12.1.6 SEP in our Windows 2008 server. For past few days we are experiencing unexpected shutdown and blue screen. Are any other users experiencing the same?

What elements of the SEP client do you have installed on those servers? 

You have Network Threat Proection installed as well? try uninstalling NTP and monitor the issue.

Anyone of the components could be causing this. Submit the full dump to Symantec for review and provide them any other info they may need for this case.

Thanks

Hello,

If you have installed NTP component then please uninstall it and check.

Below are the steps for uninstallation of NTP.

1. Open Add or Remove Programs.
2. Select Symantec Endpoint Protection, and then click Change.
3. Click Next.
4. Select Modify, and click Next.
5. Use the drop-down menus next to the individual component to either "This feature will be installed...", "This feature, and all subcomponents, will be installed...", or "This feature will not be available."
6. Click Next.
7. Click Install to modify the installation.
8. After the installation completes, a restart is required if the change installs or uninstalls Network Threat Protection.

https://support.symantec.com/en_US/article.TECH90936.html

@ Thumbs up for Rafeeq

Addendum:

Similar issue on this forum post:

https://www-secure.symantec.com/connect/forums/bsod-windows-server-2003-sep-1216

The "workaround" was to rollback to 12.1.4

No. We did not see any such. I have installed it myself. what features did you install? is it happening on all the servers

On how many did you install?

Try cleanwipe once and install just the V&S feature and monitor. 

I would recommnend you to open a case with symantec and submit the dumps for analysis.

Thanks for the inputs. I am going to monitor the machine with only V&S feature installed.

Previously it had following checked:

V&S

-Adv Download Protection

PTP

-SONAR Protection

NTP

-Intrusion Protection

See this similar thread NTP component has caused BSOD in the past. We had a similar issue had to remove the component since removing NTP we've had no BSOD on servers.

https://www-secure.symantec.com/connect/forums/blue-screen-3

Hello everyone. Thank you very much for the inputs.

We have had the new install running fine over the weekend.

So please advise what the recommended next steps are??

Did you open a case with Symantec?

Yes, they also suggested the same. Remove NTP. 

Can I add the NTP back after a while? Will the issue reoccur?

You can always add it back but if it's the root cause I don't see why you would want to until it gets a permanent fix.

Thank you Brian.

I have no issues of running the server without NTP. Just wanted to ensure if there is anything to do from my part. 

So I just have to wait for a permanent fix from Symantec??

Yes.