Endpoint Protection

I am running the latest release of Backup Exec 2010 R3, and just upgraded to the latest release of Symantec Endpoint Protection V12. Over the weekend, after upgrading to the latest release of Symantec Endpoint Protection V12, I got several errors' on my backups.

Backup- \\SERVERNAME\C:
Unable to open the item \\SERVERNAME\C:\ProgramData\Symantec\Symantec Endpoint Protection\CurrentVersion\Data\CmnClnt\_lck\_RDRPluginG - skipped.
Unable to open the item \\SERVERNAME\C:\ProgramData\Symantec\Symantec Endpoint Protection\CurrentVersion\Data\CmnClnt\_lck\_SNDPluginG - skipped.

Backup- \\SERVERNAME\System?State
VSS Snapshot warning. File c:\program files (x86)\common files\symantec shared\eengine\eectrl64.sys is not present on the snapshot.

Backup- \\SERVERNAME\C:
Unable to open the item \\SERVERNAME\C:\ProgramData\Symantec\Symantec Endpoint Protection\CurrentVersion\Data\CmnClnt\_lck\_RDRPluginG - skipped.
Unable to open the item \\SERVERNAME\C:\ProgramData\Symantec\Symantec Endpoint Protection\CurrentVersion\Data\CmnClnt\_lck\_SNDPluginG - skipped.

Backup- \\SERVERNAME\System?State
VSS Snapshot warning. File c:\program files (x86)\common files\symantec shared\eengine\eectrl64.sys is not present on the snapshot.

Backup- \\SERVERNAME\System?State
VSS Snapshot warning. File c:\program files (x86)\common files\symantec shared\eengine\eectrl64.sys is not present on the snapshot.

It appears that the latest version of Symantec Endpoint Protection 12 and Backup Exec 2010 R3 do not play well together? I researched this error message and supposedly it indicates that the files are not present, but that there are registry entries. How do I correct this so that there are no longer exemptions to the Backup Exec 2010 R3 jobs.

I found that for this one error...

Backup- \\SERVERNAME\System?State
VSS Snapshot warning. File c:\program files (x86)\common files\symantec shared\eengine\eectrl64.sys is not present on the snapshot.

A registry Key HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\eeCtrl\

However, there are multiple files named with eectrl64.sys. I can change the registry key ImagePath to point to the correct location, however I am unsure of the exact path that it should be point too.

I found about 8 different locations of this file on the system.

"C:\Program Files (x86)\Symantec\Symantec Endpoint Protection Manager\Inetpub\content\{Long Number}\110717002\Full\EECTRL64.SYS"

"C:\Program Files (x86)\Symantec\Symantec Endpoint Protection Manager\Inetpub\content\{LongNumber}\110716003\Full\EECTRL64.SYS"

"C:\Program Files (x86)\Symantec\Symantec Endpoint Protection Manager\Inetpub\content\{LongNumber}\110715025\Full\EECTRL64.SYS"

"C:\ProgramData\Symantec\Definitions\VirusDefs\20110714.005\EECTRL64.SYS"

"C:\ProgramData\Symantec\Definitions\VirusDefs\20110714.022\EECTRL64.SYS"

"C:\ProgramData\Symantec\Symantec Endpoint Protection\12.1.671.4971.105\Data\Definitions\VirusDefs\20110717.002\EECTRL64.SYS"

"C:\ProgramData\Symantec\Symantec Endpoint Protection\CurrentVersion\Data\Definitions\VirusDefs\20110717.002\EECTRL64.SYS"

"C:\ProgramData\Symantec\Definitions\SymcData\spcVirDef64\20110717.002\EECTRL64.SYS"

"C:\ProgramData\Symantec\Definitions\SymcData\spcVirDef64\BinHub\EECTRL64.SYS"

"C:\ProgramData\Symantec\Definitions\VirusDefs\20110713.037\EECTRL64.SYS"

"C:\ProgramData\Symantec\Definitions\VirusDefs\BinHub\eeCtrl64.sys"

I am concerned that if I just use dummie text files that everytime an update occurs on Endpoint Protection the Snapshots will report this warning.

I had a few things pop up as well after my upgrade that were not there before to incude:

Unable to open the item \\MDSTVHR01\C:\Documents and Settings\dom_admin\Local Settings\Application Data\Microsoft\Internet Explorer\Recovery\Active\RecoveryStore.{B42CA09C-B915-11E0-850B-0019B9B76878}.dat - skipped

Unable to open the item \\MDSTVSQL01\C:\ProgramData\Symantec\Symantec Endpoint Protection\CurrentVersion\Data\CmnClnt\_lck\_RDRPluginG - skipped

these i just set up exceptions. only one left right now is 

VSS Snapshot warning. File c:\program files (x86)\common files\symantec shared\eengine\eraserutilrebootdrv.sys is not present on the snapshot. The .DR file that is required for Intelligent Disaster Recovery is not updated.

which this location after upgrading no longer exists.

We use Backup Exec 12.5 - same problem as techuser.

VSS Snapshot warning. File c:\program files (x86)\common files\symantec shared\eengine\eectrl.sys is not present on the snapshot.
 

What needs to be done to correct this problem? No answer from Symantec on this post???? It was started in July???? If anyone can help, please advise.

Thank you.

We use Backup Exec 2010 and Symantec Endpoint Protection 12.1. The same problem.

Backup- \\server\System?StateVSS Snapshot warning. File c:\program files (x86)\common files\symantec shared\eengine\eraserutilrebootdrv.sys is not present on the snapshot.

VSS Snapshot warning. File c:\program files (x86)\common files\symantec shared\eengine\eectrl64.sys is not present on the snapshot.

The issue has returned with a Symantec Endpoint Protection update. It appears that a recent update has removed the eectrl64.sys file. I went to put another dummie file back into it's place, and it appears, that I have lost write access to the folder. I have tried logging in with different administrator accounts, and cannot seem to have write access to the folder. I have also tried to adjust the remove the registry entry for eectrl64.sys and have been unable to do so.

When going to services, and looking at the Symantec Endpoint Services, they are set to Automatic, and started, but the options to stop them are greyed out. I have tried right clickon the shield and disabling, and also attempted to try and disable from the Endpoint Management Console, and have been unsuccessful in stoping the service. I promise that I have administrative rights on the machine. Does anyone know how to stop the symantec services. As a test, I have tried using taskkill and killing the PID, but that too returns that it is unsuccessful.

Please let me know if there is a way to stop the symantec endpoint services, so that I can add a dummie eectrl64.sys file to the folder so that I no longer get Backup Exec Volume Shadow Errors.

So a recent update caused the file eectrl64.sys file to be removed. I discovered that the reason I was unable to add the file, or delete the registry key was because Symantec Endpoint Protection 12.1 Tamper protection essentially locks access to Endpoint Protection files, even if you attempt to stop the Symantec Endpoint Protection Service. 

1. Disable Symantec Endpoint Protection on the Client.

You have to go to Symantec Endpoint Protection Client > Change Settings (On the Left) > Client Management > Tamper Protection Tab > Uncheck "Protect Symantec security software from being tampered with or shut down" > Click OK. 

This will allow you to create a dummie file, or remove a file in the needed folder.

2. Delete the Registry Entry that is Pointing to the eectrl64.sys file.

The registry entry to the path is ...

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\eeCtrl]

"ImagePath"

Apparently, if you perform this issue the problem will then migrate too...

VSS Snapshot warning. File c:\windows\system32\drivers\eectrl.sys is not present on the snapshot.

If you look in the registry, you'll notice that the path is...

"\??\C:\Program Files (x86)\Common Files\Symantec Shared\EENGINE\eeCtrl64.sys".

I have tried to remove the "\??\" in front and creating a dummy file to see if the problem goes away.

Recently upgraded to Endpoint Protection 12.1 and running Backup Exec 2010 R3, error on backup:

Unable to open the item C:\ProgramData\Symantec\Symantec\ Endpoint Protection\CurrentVersion\Data\CmnClnt\_lck\_RDRPluginG - skipped

Unable to open the item C:\ProgramData\Symantec\Symantec\ Endpoint Protection\CurrentVersion\Data\CmnClnt\_lck\_SNDPluginG - skipped

Please help.  I see similar errors above with no solution.

Has anyone ever found a solution to this?  I opened a support case w/Symantec, the tech I spoke with told me to exclude the files from the backup job using this article:

http://www.symantec.com/business/support/index?page=content&id=TECH35794

I am still getting exceptions logged for the system state backup after doing this.  The tech advised me that the 2 files being skipped in system state are not required and to open another case w/the Backup exec support team (love how Symantec will shuffle you around) to fix the exceptions generated.   

Hi Techuser,

Please check the follow article regarding the Issue you are facing.

http://www.symantec.com/business/support/index?page=content&id=TECH168444

Create the exception on Back up exec for the files...

Check following article for it.

How to globally exclude specific folders while performing a backup in SYMANTEC Backup Exec for Windows Servers:

http://www.symantec.com/business/support/index?page=content&id=TECH35794.

but you can not exclude parts of the system state. I receive this during backup

Backup- \\SERVERNAME\System?State
VSS Snapshot warning. File c:\program files (x86)\common files\symantec shared\eengine\eectrl64.sys is not present on the snapshot. 
 

best regards

Michael.

Run following commands to stop/start services:

smc -stop

smc -start