Endpoint Protection

I have a server that I cannot RDP into with NTP enabled. If it is disabled, you can RDP into it. There is no firewall policy in place, nor have other settings have been changed. The group that it is in has other servers in it, and they have no issue. The server is not joined to our domain, but we can still access it by adding their domain to the end of the computer name. There was no issue until last night/this morning. I have not found any attacks or anything of that nature.

Seems that this may be affecting a few onsite domained PCs as well.

Hi,

1) Did you try to  reinstall SEP and check if we face te same issue.

2) What happens if you try to create an exception for port no.3389 in Firewall rules.

Enable logging to all block rules in firewall policies and check on the client machine which rule is blocking the traffic. Post the firewall logs if its possible.

I havent tried to reinstall yet because this is an offsite vendor server, and we have to go on their schedule. There are no firewalls in place with SEP so I dont think that would be causing it.

The firewall component is part of NTP.

You server is in a group?  You can modify a "Firewall Policy" for said group and push an update to the server, which is connected to SEPM?  Than you should try creating a firewall exception for the server on port 3389 (RDP) and see if you can than terminal into the server, saving you a trip to the client and the client the need to "pencil you in".

Time to test to add exeption rule to your Firewall policies.

What version of SEP did you use anyway?

...and recalled your thread.  Please let us know if this helps.

http://www.symantec.com/docs/TECH91847