Endpoint Protection

Hello,

I have a SEP 12.1 installed. It communicates correctly with its SEPM and appears in green in the console.

I uninstall it through the Add/remove Programs. I restart and install the same version again. Restart again.

Client in correctly installed, appears in green in the console but I still have the previous record in green as well.

The previous record will be cleaned in 60 days regarding our setting but why is this previous record still in green ? How long do I have to wait to have the refresh of this old client (no more green) ?

One question also : I installed the client and restarted. I though at each service start (or computer restart), the SEP discussed with the SEPM and the Last connection timer was increased on the console and log filed on the client. That's not my case... Is it normal ? As I have the heartbeat set to 2h, does it wait the 2 hours even if I restart the service ?

Thanks in advance for your help,

Regards

You can right click on that previous record and delete it  no issues.

Even if you delete the new one it will come back during heart beat by default its 5 mins.

SEP Automatic connection time will be 2 Hr, but if you force it by smc -stop smc -start it will do that immediately.

That's normal behaviour. You can just delete it out of the SEPM. Otherwise it will be purged after 30 days.

The issue with the older client records sounds as if it's working as intended to me.  IIRC, the client record on the SEPM side will only lose the green dot if the SEPM has not heard back from the client within the configured heartbeat interval (i.e. it means the client record will keep the little green dot until the client misses the next expected heartbeat.)

As others have mentioned, the record itself should disappear after your configured 60 days anyway.

Regarding the Last Check-In time not updating after a restart; the SEP client is certainly meant to initiate a heartbeat on startup of the machine as per:
http://www.symantec.com/docs/HOWTO80782

That said, Windows likes to startup without waiting for the NIC to be ready, so it could just be that the NIC has taken more than 30secs (default heartbeat timeout: http://www.symantec.com/docs/TECH191617) to start up after the SMC process started.

Oddly enough, an older version of SEP was meant to have fixed this, way back when:
http://www.symantec.com/docs/TECH106421

If this is a consistently replicable issue, then I'd suggest logging a case with Symantec Support and citing the above article.

Hi

What is the version you are installing

Regards

Hi all,

thanks for your help. I'll wait for the heartbeat interval to check if green dot disapears. I'll let the automatic deletion of old clients do the rest.

rgds