Endpoint Protection

I've done a bit of research on this issue and have tried disabling all BIOS power save features and OS power save features.  

when the computer is in the "locked-up" state, the mouse will still move,  it will have the default solid blue background and nothing else.  no keys work, CTRL-ALT-DEL wont work and a force power off is the only way to reboot hte machine.

removing SEP will solve the issue, but when it is reinstalled the issue comes back.  We have tried to disable network threat protection with no luck either. 

we have managed to fix the problem on one machine only, by re-installing the entire system on a different hard drive.   I have serveral of these machines (Dell 760, 2gb of ram) having the problem, but most of that hardware is working properly.

Thanks in advance.

Can we get some details on your system?

1. What OS and SP is this happening on?
2. 32 or 64bit?
3 .What Version of SEP client are you running?

Thanks,
Thomas

can you post the logs from the event viewer related to SEP problem

How much is the free space on your system drive ?..

Hmm I had this same problem when I was running Vista, but after upgrading Vista to SP2 it fixed my problem. So if you are running Vista make sure to install the latest service pack.

Hope this helps,
Grant-

1. What OS and SP is this happening on?   windows XP SP3 all updates
2. 32 or 64bit?   32 bit
3 .What Version of SEP client are you running?    11.4014.26

there are 20-40gb available on the drive.

On one of the machines, I sometimes get a iastor event ID 9 "The device, \Device\Ide\iaStor0, did not respond within the timeout period."

we saw this error on the first drive and relaced it with a brand new drive.  both hard drives have been tested fine with chdksk and full dell diagnostics and do not display the errors when SEP is not installed. 

I am not finding any cases in our database similar to your problem.

Read this MS KB - How to troubleshoot event ID 9, event ID 11, and event ID 15 error messages

http://support.microsoft.com/kb/154690

I hope this helps,
Thomas

Could you go to

Click Start, then Run and Type CMD
Type Systeminfo and Click OK

Look for the following values:

Virtual Memory: Max Size:  ____MB
Virtual Memory: Available:  ____MB
Virtual Memory: In Use:       ____MB


Thanks :-)

I had this same activity (showing background only) on 3 computers in one of our labs of 30 (all same hardware, HP dc5100 sff)  I rebooted them and am not sure if the problem has returned.  I didn't think much of it at the time (computers do crash), but it did happen directly after installing SEP.  I'll definitely stop by that lab again to check on it.

Ours are also XP SP3, 32 bit, with ~20gb free, running SEP 11.0.4202.75.

I had this occur on 2 more machines today.

What can I do to further troubleshoot?

The machines are "frozen" with Faronics Deepfreeze software, so looking at the event viewer to view the errors before rebooting is not possible.  Remotely accessing the event viewer does not work either while the machines are showing only the black background.

The virtual memory info as requested above is:
Virt Mem Max Size: 2,048MB
Virt Mem Available: 2,008MB
Virt Mem in Use: 40MB

This is on a machine before the black background issue occurs, as obviously I cannot view this information afterwards.

Thanks,
Mark

I just had this occur on more machines.. One of them is locked at the screen saver.. the other two are showing the full desktop background, as well as the desktop icons, start menu, systray, etc.  On all of them, you can move the mouse cursor but do nothing else.

mwolf, I suggest you open a case with Symantec support to start troubleshooting the issue ASAP.

Regards,
Thomas

You should definetely take cycletech's advice and open a support case, and you should also post that case number back here if you can. This allows us to check in on the case. It also helps to keep us all up to speed without too much hassle. Aside from that is this issue only happening on the Dell 720's or is it being seen on other pc's as well?

Also in case you get really desperate here are a few ways to get around deep freeze remotely. Easiest is posted below.

1.http://www.faronics.com/faq/default.asp#11

    How do I enable or disable Deep Freeze?
    B) Remotely via Deep Freeze Command Line Control (Deep Freeze Enterprise only):

Deep Freeze Command Line Control (DFC.EXE) can be used to Thaw/Freeze Deep Freeze through a script or batch file. More information about using this utility can be found in the Deep Freeze Enterprise user guide available at:
http://www.faronics.com/doc/DF6Ent_Manual.pdf

I opened a case (#281741217) last night.  I "thawed" the machines and left them up overnight.  I'm going to stop by that building later today to check on them and see if the issue has reoccured.  If so, I'll check the event logs and also use a tool given to me by support to upload a .sdbz file.

The original poster was having the issue on Dell 720s.  I do not have any Dells, the issue is happening only on HP dc5100 SFF PCs for me (so far).

Thanks for the help!

I will see if i can run those commands on the machines we have.  There seems to be no commonality to the event logs on the different machines.  All machines behave properly without SEP installed.

I'll try those virtual memory commands and see what I can get.   I'll also be closely following your case mwofle.

Running Windows XP Pro w/ SP 3 with SEP 11.0.3001.2224 on a Dell Latitude E6500.  We have a group policy to start the screen saver after 15 minutes and lock the system on resume.  On this system the password prompt box does not show after you resume from the screensaver.  All I see is the users background and nothing is functional. 

The user did state that if he has some programs running (MS Word was the example he gave) that the system unlocks fine. 

We have multiple E6500's and all of them were imaged using ghost and this is the only one with the issue.  On the plus side we also use the Optiplex 760's and fortunately have not seen this issue on any of them (knock on wood.)

I had this reoccur again today, on one machine of a lab of 30.  I uploaded the requested .sdbz file to the case, as well as the Application and System logs from the computer.

I did not see anything in either log that appeared (to me) to give a clue as to the issue.

Using PSEXEC remote cmd line tool i was able to find the following:

PC 1
Total Physical Memory:     1,980 MB
Available Physical Memory: 1,455 MB
Virtual Memory: Max Size:  2,048 MB
Virtual Memory: Available: 2,000 MB
Virtual Memory: In Use:    48 MB
PC2
[can ping, but did not respond to command, it was verified to be in the "hung" state]
PC3
Total Physical Memory:     1,980 MB
Available Physical Memory: 1,357 MB
Virtual Memory: Max Size:  2,048 MB
Virtual Memory: Available: 2,008 MB
Virtual Memory: In Use:    40 MB
PC4
[can ping, but did not respond to command, assuming its in the "hung" state]

Any updates on this?

@ SysAdmin1979, How many computers are you having this issue with? Are these XP SP3 systems? What version of SEP 11 are you on?

Mwolfe is currently working with support on this issue. We are waiting for the customer to give us an update.

Regards,
Thomas

XP SP3, Dell GX760's, SEP 11.0.3

I haven't personaly seen the issue, my field techs have. It's only happening on a handfull of systems.

A Dell forum I found references a possible problem with AHCI being set vs. ATA in the bios for the SATA controler.

I've just been brought in on the problem recently and started looking at differnt forums and doing google searches for any possible fixes / trends.

The issue supposedly only occurs if SEP is installed. I don't yet know if that is true or not.

I'll provide more information as I get deeper involved in the issue.

Also, is everyone else with this problem having it on ghosted machines? Is everyone having this problem with the chipset drivers that are installed by windows or are they using the drivers provided by Dell on the resource cd or via download? - Just curious here.

Thanks Cycletech!

@ Sysadmin1979,

Can you give us an update on your issue when you have a moment?

Thanks,
Thomas

This is still happening in one of my labs, but it is not very widespread.  It seems to occur on 1-2 machines a week.

The technician suggested that I disable email auto protection on those machines, but that does not seem to have resolved the issue.

All of our machines here are ghosted, but they are HP, not Dell.  I'm not positive of the source of the chipset drivers in our current image build, but I would guess that we are using any drivers provided by HP.

Turns out it appears as if our issue was with the CD ROMs Dell provided with half of our shipment. We took shipment on about 1,600 Dell GX760's and about half of them came with Hitachi DVD ROMs. There appears to be an issue with the drivers / firmware for this particular drive.

The computers would just lock up at completely random times. Dell's answer was to update the firmware on the drives.

To test to see if you have the same issue, look and see if you have Hitachi drives and if you do, simply unplug them and turn off that controller / drive in the bios.

I'm trying to get my hands on Dell's actual write up from one of our techs. I'll post it when I do.

I have encountered this problem specifically on Dell Optiplex GX760s with the afformentioned Hitachi DVD drives running SEP on XP SP2 and SP3 32-bit.  Removing SEP removes the problem.  The severity varies from once every couple of weeks to several times a day.  I have flashed the updated firmware to the drives.  However, preliminary testing indicates that this has just changed the nature of the problem to spontainious reboots rather than simply locking up the PC. 

For what it's worth, the few times I could get information off of a test machine from just before it locked, or now rebooted, showed that COH had just started for whatever reason.  I have also caught the same, initially mentioned symptoms occuring on other models with SEP and XP 32-bit not equiped with Hitachi drives.  However, the problem is far more infrequent.  For those other PCs, I might notice 3 a month or so out of about 200 workstations showing the symtoms when making my morning rounds.  I do not know if this is the same problem, or just the same symptoms since our shop is almost all XP and all SEP.

We have several labs running older machines - Dell SX280's with a similar problem as others have mentioned.  PC's will freeze up randomly, sometimes right after logging in and getting to the desktop, it could be a couple hours after usage or coming out of sleep mode.  You can use the mouse but nothing works.  When you look at the SEP icon in the tray it has a yellow circle.  This is the only thing I can find in common amongst the machines.

They have been working on this issue since I got here about a month ago and I am trying to figure out what it could be too.  Not sure if deep freeze isn't allowing SEP to update and this is the issue or if there is a problem with SEP.  No error logs I'm assuming cause once you hard shutdown and restart deep freeze has cleared any of that info.

XP SP3
32-bit
10+ gigs free space on HD, 1gig mem
SEP 11.0.4

Any suggestions/solutions would be welcome!

Here at our college we are having the same problems with student workstations. Random lock ups with only mouse movement and yellow signal on sep sheild on task bar. We had also come to the conclusion that it must be the combination of DeepFreeze (recently installed in 2009) and SEP so we changed some worstations back to the harware safety card we had in the past, Radix and Reborn cards. Unfortunaly still the same random lockup problems. Our administration pc`s have no problems what so ever just they dont have any safety mechanisms.

HP7600 workstations
20Gb free disk space
XP SP3
32- bit
1 Gb mem
SEP 11.0.5

I was able to solve the problem by fixing a couple of things that we had going but unable to narrow it down to exactly what it was.
If you are using Altiris to push out your SEP clients make sure the collection you are using has expluded the Windows PC's with SEP client installed (see Below) otherwise Altiris will keep on trying to roll out the client to the PC's because they will always be in the collection.
Also make sure that your SEP client upgrade (Install Packages) is still not trying to upgrade if all your clients in that group have reached the upgraded version.

Collections excluded from this collection (2):

All 32-Bit Windows Computers with Latest Symantec EP Client, All 64-Bit Windows Computers with Latest Symantec EP Client

After fixing these 2 issues i have not had any freezes upon wake.

hi

i am french sorry for my english !

i have in my school the same pb with deepfreeze and end point

we use end point 11 and 11.0.5002.333 Win32 version for client
and deepfreeze enterprise version 6
my workstation are  LENOVO (~40) and HP (~50 DX2250 and DC5700)

when i disable deepfreeze and enable autoprotect, there are no probleme
when i enable deepfreeze and disable auto protect there are no probleme
but the same in same time, some computer hangs, but not all , only fews.
i have 15 computers LENOVO who are the same harware, with same software, installed with ghost, and 2 or 3 hangs ??!

i fixe the probleme with disable all fonctions of end point client (heuristique bloohound , risk tracer etc...) except auto protect