Endpoint Protection

I recently upgraded our SEP from 11.0.6 to 12.1 and the server install went fine but I'm having trouble with one of our network applicatons loading really, really slowly.  We use Deltek Vision which is an internal web hosted application with a SQL backend that has our accounting, timesheets and CRM information.  It worked fine in 11.0.6 (our desktops use Windows 7 SP1, x64) but after I upgraded I initially could not open the application.  I reviewed the error logs and adjusted the Application and Device policy to where it now loads but it's much slower than the clients running the 11.0.6 version of SEP.  How do I trackdown what is slowing the application down?  I'm not seeing any errors now in the Application and Device log on the server so I'm a bit unsure where to look.  It happens if I try to load the application from the web link on our Intranet and it also slows the loading of Outlook 2010 as there is a Deltek Vision plug in we use for linking to the CRM information (when it's loading this plug-in the Outlook startup stalls).

thanks, nick

Have you added exceptions for the plugins?

It could be the way it is accessing the network and causing a slow down based on SONAR or NAC.

Hi,

Automatically trust any file downloaded from an intranet webiste this option is enabled by default.

Please recheck.

Hello,

I agree with Chetan above. "Thumbs up" to him

• Create an exception for the Web domain. You can create an exception for the particular Web site. Use the log event to create the exception or use an Exceptions policy.
• Enable the Download Insight option for trusted Internet or intranet sites. Make sure that you enable Automatically trust any file downloaded from an intranet website so that Download Insight allows files from trusted sites. This option is enabled by default in the Virus and Spyware Protection policy. You set up trusted sites on the Windows Control Panel > Internet Options > Security tab.

Reference:http://www.symantec.com/docs/HOWTO42237

Hope that helps!!

Nice solution, this helps.

Hey Mithun, Chetan,

I checked the download settings on the Virus policy and it was enabled, and I had already created exceptions for both the Intranet site and server hosting Deltek Vision but I'm still getting the slow load.  I've created exceptions through the SEP client and through IE's trusted sites.  Anything else I can check or try?

Thanks, Nick

Hi,

Disable advanced download protection and outlook scanner on 2-3 SEP clients and monitor the situation.

Screenshot is attached for your reference.

Hey Chetan,

I tried disabling those two components but the client forces you to disable SONAR and Intrusion Detection as well so it pretty much disables most of the protection services.  It didn't really seem to change the load problem either.  I also tried uninstalling the client (it was an upgrade on 11.0.6 RU3), running clean wipe and then installing again but that didn't help either, I was thinking the client may not have been processing the policies correctly after the upgrade.  The load differential goes from about 5-8 seconds with the previous version of SEP to 45-60 seconds with the 12.1 RU1 version so it's significant enough that it won't be popular with users.  Also, forgot to mention by way of benchmark, I use the SEP Hardening Application and Device Control Policy rather than the default Application and Device policy, not sure if that will help.

thanks, nick