Endpoint Protection

Hi everyone,

I'm having very weird issue with SEP 11.0.5. On last Monday I upgraded SEPM and SEP to version 11.0.5. Everything went smooth and without any problems except one thing. One of my users reported that she is no longer able to access any shares on the network. She is getting the following error message:

The specified network name is no longer available.

She is able to browse Internet and  Intranet and ping each file server. I was reading and googling trying to find out what is wrong with this and I found some information that this issue was related to old versions of SEP, but the one I have now is 11.0.5 and documentation says that it has been resolved in this release. When I uninstall SEP she is OK. She can access all shares.

Do you have any ideas what may be causing this issue? Any help is more than welcome!

Thank you!

Kris

Have you installed all the features of SEP on this machine i.e. AV/AS, PTP, NTP?.  If yes then try installing only AV/AS to start with and check for the connectivity. If its ok then install PTP (PTP is not recommended on a server OS), and finally install NTP(Network Threat Protection). The NTP feature is similar to that of a Firewall which can block incoming and outgoing traffic.NTP should be tested on a test environment,  if we conclude that its the NTP thats blocking the shares we can configure the firewall to allow accesss to the share.

Go to add remove programs in the problematic PC.Select SEP click on change
It will open a wizard,in the second screen select modify,in the next screen remove Network threat protection.Click next-->Install.Reboot the PC and see any change is present. 

Thank you both for your replies. You are absolutely right. it is Netowork Threat Protection which is causing this issue. How do I modify the policy settings of this module? I know that it has to be done in SEPM, but could you please tell me what exactly has to be changed? Also, how would you explain that this issue refers to only one client?

Thank you again!

as per this document add a network service, in that add network neighborhood browsing and network neigbrour sharing.
apply it to all your groups.
( this example is from dhcp)
http://service1.symantec.com/SUPPORT/ent-security.nsf/docid/2007101210172548 

Thank you for all you help guys! I will try that!

Edit the firewall policy (This you can do in the SEPM console Clients--->respective group----->policies---->firewall policy---->edit ----->rules) find the rule "Block local file sharing" set the action to allow 

Also keep the client user interface mode to server mode(In SEPM  Clients--->respective group----->policies---->location specific policies) 

Hello, it took me a while but I'm back and unfortunatelly unsuccesful. As per your advice I created a new rule in my firewall policy and added two network services into it: Network neighborhood browsing and network neighborhood sharing. Action is set to allow on all adapters, rule is on the first place on the list with severity 1-Critical and of course is enabled, but still this particular workstation is unable to access any shares on the newtork.

To AravindKM: I dont have that kind of rule in my firewall policy. I also checked Client User Interface Control and it was already set to Server Control.

Any other thoughts and ideas are more then welcome! Thank you

open sep client
click on logs
try to access the share, if it blocks you can find the filewall rule which blocked it
go to sepm , try making it to allow should work. 

Hi,

I was trying to do that but log is empty.

 In Server Mode you will not see the logs on the clients.
Block local file sharing ..Yopu have set it to allow however did you check the box next to it to enable it ?
Also click on service - add and add network neighborhood browsing and network neigbrour sharing.

Vikram, Yes, all is done like you are saying (please check my previous post). I think i'm going to give up if this issue involves only one workstation, which by the way is very weird, don't you think so? 

Well..if its just one workstation then either
Un-install Network Threat Protection on that client
or in Monitor - logs - Pull the NEtwork Threat Protection logs for this clients and check what is getting blocked and by which policy. 

Also double check whether the windows firewall is on in that work station.. 
Are you getting any error in the event viewer?

If you go to start and run and type in the IPs of the machine with the shares can she get to them?