Endpoint Protection

I have 2 servers that run ACS v 4.1. When I upgraded one from SAV to SEP, I included the following exceptions

C:\Program Files (x86)\CiscoSecure ACS v4.1

C:\Program Files\CiscoSecure ACS v4.1

Within a day or two one of them stopped working. I was told that the database was corrupted by SEP. I did not see anything in the risk history.

Does anyone have any idea what went wrong or what I may have missed?

Thank you.

I'd be curious to see how the justification for that was reached. Similar situation here but have never had any issues. No exclusions are set either.

In any event, aside from the program directories being excluded already, check what working directories are also created and exclude those. TMP files (or similar) could be being created constantly and SEP is scanning these. I'd check mine but don't have access.

Check this might help

http://www.symantec.com/business/support/index?page=content&id=TECH105234&profileURL=https%3A%2F%2Fsymaccount-profile.symantec.com%2FSSO%2Findex.jsp%3FssoID%3D13631814838636yVbz4Pj38cxhrQTtjwS8DbAhLJRg3506b9Rx

One of the ACS boxes USED to be a Primary SAV and had SSC installed. I doubt it had anything to do with it.

Is it only running the AV component?

If firewall is enabled, I could see something being blocked possibly.

The server has been rebuilt, but when I deploy I strip everything down to the bare essentials, No PTP no NTP, no whatever else is there. When I do a remote push I push "Basic protection for servers"

I would guess that Auto-Protect would be the culprit than. If you can find out if there are any working directories that need to be excluded that should help.

The other thing I would suggest is to disable Auto-Protect for a short period of time to see what the result is. Not ideal or even recommended but it may help to pinpoint any issues.

The server has been rebuilt, but when I deploy I strip everything down to the bare essentials, No PTP no NTP, no whatever else is there. When I do a remote push I push "Basic protection for servers"

If Autoprotect did in fact cause the collapse of this system, why wouldn't it have been logged or registered anywhere? I am not sure what caused this, but I don't think it was auto protect.

AP only would log actions it took on malware.

You would need to configure actual client logging of all AP events and even than this may not show that it actually corrupted something.

You could try vpdebugging to show real time scanning

How to enable "Vpdebug Logging" on Symantec Endpoint Protection 11.0, 12.1, and 12.1 RU1

Or even Process Monitor might help

How to Configure Sysinternals' Process Monitor to Record Symantec's Auto-Protect Events

I will check into this tomorow. I have hit my afternoon snag :-)

Thanks