Endpoint Protection

Hi, We recently moved our SEPM to new server using Disaster recovery method, after that even though all the clinets are communicating to the server and updating fine, but in server console only 10 out of 200 machines are showing as online, rest are all shoeing offline.

All the clients are getting policy update and virus definition update only thing is that on server and client its not showing Green dot.

On client its showing connected to the server but no green dot.

 

I tried everything, please help

 

Thanks

Please do the folllowing and mark as a solution if it works

1. Log on to the Console, and then click Admin.
2. In the Admin pane, under Tasks, click Servers.
3. Under View Servers, expand Local Site, and then click the computer name that identifies the local site.
4. Under Tasks, click Manage Server Certificate.
5. In the "Welcome" panel, click Next.
6. In the Manage Server Certificate panel, check Update the Server Certificate and click Next.
7. Under "Select the type of certificate to import", check JKS keystore and click Next.
   Note: If you have implemented one of the other certificate types, select that type.
    
8. In the "JKS Keystore" panel, click Browse, locate and select your backed up as "keystore_<timestamp></timestamp>.jks" keystore file, and then click OK.
9. Open your disaster recovery text file and then select and copy the keystore password.
10. Activate the "JKS Keystore" dialog box and then paste the keystore password into the "Keystore" and "Key" boxes.
    Note: The only supported paste mechanism is Ctrl + V.
     
11. Click Next.
    Note: If you get an error message that says you have an invalid keystore file, it is likely you entered invalid passwords. Retry the password copy and paste process as described above.
    
     
12. In the "Complete" panel, click Finish.
13. Log off of the Console.
14. Click Start> Settings> Control Panel> Administrative Tools> Services.
15. In the "Services" window, right-click Symantec Endpoint Protection Manager and click Stop.
    Note: Do not close the Services window until you are finished with disaster recovery and establish client communications.
     
16. Right-click Symantec Endpoint Protection Manager and click Start.
    Note: By stopping and starting Symantec Endpoint Protection Manager, you fully restore the certificate.

Regards

can you pass on the sylink logs?

Please let me know the SEPM server version??

 

If you are using 12.1 SEPM server. Please change the SEPM server Date format under the Home tabe.

1.   click on Preferences.

2.   click on Logs and Report.

and change the Date format.

your client will be online next login.

Hi,SameerU

Your solution helped a lot, now about 85 machines are showing online out of 200, but rest of the machines are still showing offline.

Replacing sylink.xml didn't help

Any other solution?

Hi Baljeet Singh,

By next login do you mean next login to the SEPM or next login to the client computer by the user?

Yeah Iam using version 12.1

Thanks

from network side is there SEPM ports opened which is needed for communication client and server...

did u check it?

Nothing has changed since we implemented SEPM on the older server. Moreover its not the communication problem as the clients are able to get policy and virus definition updates.

Its just that they are showing offline in the SEPM, status update time and everything else is  fine

@ Baljeet,

 

I did what you said, still more than 100 machines are showing as offline in the server

@ pkyadav

I did that sir, after doing that about 75 machines started showing online but still more than 100 machines are there which are still showing offline even after updating the server certificates and changing the Date format as Baljeet suggested

Hi Mahendra,

As smeer suggested, Just  Update the Server Certificate  this will definatly resolve your problem.....

Mahendra,

 

Which version of SEPM you were using on old server, And on which version of  SEPM you have installed on new server?

Please change the SEPM 12.1 version Server Date format and logoff the SEPM server console.

Date format option avilable on following location.

1.    Go to SEPM server console.

2.   Click on Home tabe.

3.   Click on Preferences under the Security Status.

4.   Click on Log and Report.

change the Date format (MMDDYY) to other format.

Then restart the SEPM server.

your offline client will be online.

@pkyadav

The versions are same on older and new server, We used same setup files

The thing is, about 10 clients were showing online just after moving the server, after updating server certificate about 85 clients started showing online but still rest of the cliens are showing offline on the server even though all the communication between clients and server is fine.

Iam wondering why is it happening like this, it should either connect or not connect.

pass on the sylink logs,

Sylink logs from sylink monitor?

Enable the sylink log and send the sylink.log file............

 

To enable the sylink log follow the steps-----

Enabling Sylink debug logging via the Windows Registry:

1. Click Start > Run
2. Type in: regedit
3. Click OK
4. Navigate to: HKEY_LOCAL_MACHINE\SOFTWARE\Symantec\Symantec Endpoint Protection\SMC
5. Double-click smc_debuglog_on
6. Change the Value data to 1
7. Click OK
8. Navigate to: HKEY_LOCAL_MACHINE\SOFTWARE\Symantec\Symantec Endpoint Protection\SMC\SYLINK\SyLink
9. Click Edit > New > String Value
10. Name the new value: DumpSylink
11. Double-click DumpSylink
12. In the Value data field, specify the desired name and location for the log file. Example: C:\Sylink.log
13. Click OK
14. Close the Registry Editor window
15. Click Start > Run
16. Type in: smc -stop
17. Click OK
18. Wait until the SEP icon disappears from the system tray. (Approximately thirty seconds.)
19. Click Start > Run
20. Type in: smc -start
21. Click OK. Sylink debug logging is now enabled.

I was trying to restart the server and now a new problem started, the SEPM and Embedded database services are stopping after 2-3 seconds of start.

any Idea?

Dear,

Do one thing, uninstall and then reinstall the SEPM again by the recovery file....

@ pkyadav

Should I take the recovery file and database from the current server or should I use the backup from the older server?

use the data from older one....have you made any changes on new server....?

1st try to repaire...may be your problem resolved by repairing only....

I tried repairing but still the services are not starting Iam now reinstalling the server

Ok reinstall......

but be ensure that you are using all the same settings as your old server was....

like the IP Address, Hostname....Site name...etc

Ok I reinstalled the server using the older recovery file and database backup, Initially about 30-35 machines came online, but next day again only 7 machines are showing online rest of the machines are showing as offline on the console even though communication is happening between server and client and clients are getting policy as well as virus definition updates from server.

Iam also able to to run commands on the client.

Iam now frustrated with this problem

Can comeone please help

Thanks

Did you try deleting the client from SEPM console? Does it reflect back?

can you post the sylink logs?

Also I would suggest to open a support case.

I am not sure. But I am also seeing some of the systems shown as offline. is this happening because of less space on the server? Have a look on that too.
Original Message:
Sent: 02-02-2012 02:08 AM
From: Migration User
Subject: Clients are connecting fine, but showing offline on the server

Hi, We recently moved our SEPM to new server using Disaster recovery method, after that even though all the clinets are communicating to the server and updating fine, but in server console only 10 out of 200 machines are showing as online, rest are all shoeing offline.

All the clients are getting policy update and virus definition update only thing is that on server and client its not showing Green dot.

On client its showing connected to the server but no green dot.

 

I tried everything, please help

 

Thanks