Endpoint Protection

Hi All,

I need solution of this issue we have 120 clients.

SEPM Console and clients are showing latest defnication.

But in home page clients are showing offline.

We using windows XP machine with 4GB of RAM and 250GB HD.

We using SEP 12.1.

Refer the attachment for this error.

Regards,

Mohan

Attachment(s)

Clients are showing offline.docx   155 KB 1 version

Hi Mohan,

Are you able to ping and telnet the SEPM server from clients........????

Go to run --> cmd

ping server ip

telnet serverIP 8014

Also make sure windows firewall is disabled...

Hi Pkyadav,

Yes we able to ping telnet it's working fine and windows firewall aslo disabled.

are these images system?

can you pass on the sylink log from one of the client?

First please check with your network team, where anything changes done on the network which may cause this issue.

As per the snapshot its seems that only SEPM system client is connected to SEPM that means there is some communication issue between this system to all clients.

Please check your windows firewall and also follow the KN provided by Ashish Sharma.

Ok, if ping telnet is fine, please test to replace the sylink file on one or two clients.......

chek the network connectivity or Try ro replace sylink.xml either use sylinkdrop.exe or to replace sylink login to sepmanager

select the group right click export communication settings or go to SEPM server (C:\Program Files\Symantec\Symantec Endpoint Protection Manager\data\outbox\agent) put this file on a shared drive or usb as it needs to be replaced

go to client computer

open sep client change setting client management and disable tamper protection

then go to start run type smc -stop

go to C:\Documents and Settings\All Users\Application Data\Symantec\Symantec Endpoint Protection\12.1.671.4971.105\Data\Config

and replace file exported above in here simply paste it

go to start run and type smc -start

check if the client comes on line

note there is space between smc and stop /start

Hi

If your using proxy server kindly bypass Symantec Server IP address on proxy setting in Internet conntion properties.

If using any kind of firewall on your newtwork exclude *.symantec.com

Go to this link

https://www-secure.symantec.com/connect/articles/best-practices-articles

Go to this site it will help you very much :

https://www-secure.symantec.com/connect/articles/best-practices-articles

Hi,

This seems to be a known issue with 12.1. It seems to have been fixed in 12.1.RU 1

Client shows as offline within SEPM even though it is functional on the endpoint

Fix ID: 2436933

Symptom: Within the SEPM console, the client status is showing as "offline". On the endpoint, the SEP client is functioning as expected.

Solution: Resolved by changes to the client recognition logic. The "hardware ID" and "known client ID" values are now handled differently within SEPM to ensure that clients are correctly recognized by the Manager.

http://www.symantec.com/business/support/index?page=content&id=TECH174565

Also, you did not indicate as suggested above, if you have already patched to RU1.

Did the IP address of the machine change?

Please upgrade to latest version of SEP 12.1 RU1 as there are many fixes

Regards

Please upgrade to latest version of SEP 12.1 RU1 as there are many fixes

Regards

Hi,

Checked the client status: offline
Took the backup of the registry
Delete the following registry keys:
HKEY_USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\DefaultConnectionSettings
HKEY_USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\SavedLegacySettings
Set the proxy enable in the registry to 0 under HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings
Uncheck the proxy setting option in the internet options settings.
Reboot the system.
Check the client status : online/reporting to the server