Endpoint Protection

After installing SEP 12.1 on Citrix Servers running profile streaming, users could not log in, or it took very long time to log in.

After stopping the Citrix Profile Streaming service, things work fine. We have also tested with SEP 11.x and that works fine. It seems to be a problem with SEP 12.1 and this Citrix feature.

Is there a way to fix this?

Hello,

Did you check this Article from Citrix:

http://support.citrix.com/proddocs/topic/user-profile-manager-kib/upm-secure-antivirus.html

Hope that helps!!

Try this

http://www.symantec.com/business/support/index?page=content&id=TECH91070

Thanks for the feedback.

We are aware of both the documents (the white paper from Symantec and the paper from Citrix).

Unfortunately, the Citrix servers hang on logging on even when we disable the SEP Agent all together. So there seem to be some incompatibility between the low-level SEP file drivers and the Citrix drivers. Therefore it's no help to define policies for excluding things from being scnanned by SEP.

This problem was not present with 11.0.5 and 11.0.6, and we will probably have to go for 11.0.6 on the Citrix servers. Since we are running Win 2008 R2 SP1, we are then using a SEP version wich is not certified for that OS.

We have been informes that there is an upcoming patch (RU?) for 12.1. Does anyone know when this is due, and wheter this adresses this issue?

Hi,

Check this article

https://www-secure.symantec.com/connect/forums/sep-121-ru1when

Paul Murgatroyd has stated as per following.

RU1 is due early November, current feature list is below:

• Non critical defects discovered during beta
• OSX 10.7 support SEP
• OSX 10.7 for SNAC SODP
• Exception policy enhancement (applies to scan types) from RU7
• Mobile broadband support
• FIPS support
• Simplified versioning policy
• Per domain client purging options

Thanks for the info.

Cannot see anything specific related to Citrix Profile Streaming, is it possible to get more detailed info regarding this?

http://support.citrix.com/servlet/KbServlet/download/13468-102-16746/Streaming%20with%20Citrix%20Presentation%20Server%20Implementation%20Guide.pdf

This is not about App Streaming, but Citrix User Profile Streaming.

UP

when you say "even when we disable the SEP Agent all together" how are you doing this?

Which components of SEP are you installing?  Is this a 64 bit or 32 bit server?

We have tried to disable the SEP Agent by turning off Auto Protect and SONAR from the policy on the SEPM. We have also tried stopping the SEP Agent on the Citrix servers. But despite this it is not possible to log into the ICA session.

When we uninstall SEP and restart the server, trehe are no problems with logging on.

We only install AV Protection on these servers (WIN 2008 R2 SP1 x64).

Have you looked in the Tamper Protection logs?  This sounds suspiciously TP related, especially as its Citrix.

Yes, we have checked TP logs, nothing there.

And since the problem is there even when we stop all SEP services on the clients, this has to be related to low level file drivers being initiated on boot?
After uninstalling SEP and boot, the problem is gone.

Same problem with SEP 12.1 RU1

Same problem here.

I tried to find a solution for weeks now.

I even opened a support case at Symantec, but it seems as nobody could help me.

Come on, Symantec!!! Citrix is being used by lots of our customers!!!
Get yourself a testlab with a citrix farm for testing and bring an update to solve this problem!

It works with SEP11, so there has to be a quite simple solution!

Thx

Stegi
 

I am having the same issue. Has a fix or work around been discovered yet?

Anyone from Symantec that could comment on this?

Same problem here too... a question for others with the issue, are you XenApp/XenDesktop machines using Citrix Provisioining Services with disks in Standard mode? It only happens for us with PVS & Standard mode disks.

Hi Matt,

We are not using CPS.

I've been working with support on this and have this work around. Still looking into the root cause.

Go to:

- Add/Remove Programs

- Symantec Endpoint Protection

- Click on Change

- Click on Modify then Next

- Click on Proactive Threat Protection -> Entire Feature will be unavailable.

- Restart the machine.

1. Check the current state of  BHDDrvx. Start CMD and type sc query BHDrvx86. The state should be running.

2. Start up Device Manager -> View -> Show hidden devices

3. Locate Non-Plug and Play Drivers -> BHDrvx86

4. Right click -> Properties -> Device usage: Do not use this device (disable). Select Ok. 

5. Restart the machine.

Hi,

Check following KB

Tamper Protection alerts are triggered on Citrix servers running Symantec Endpoint Protection 12.1

Thats not the issue

There is now a Symantec KB artible about this issue

Symantec Endpoint Protection (SEP) 12.1 RU1 has a conflict with Citrix Profile Management 4.0

http://www.symantec.com/business/support/index?page=content&id=TECH179407

Hi,

Good to see that Symantec has produced a tech article on this.

I wonder what are the consequenses of disabling BASH? Will it reduce the functionality of SEP, i.e. increase risk of being infected?