Endpoint Protection

Hi all,

Yesterday I upgraded a Microsoft Surface Pro 3 from Win 8.1 to Win 10 Ver 1511.  Before the upgrade, I uninstalled managed SEP 12.1.6 MP3. All went well without incident.  I then re-installed SEP 12.1.6 MP3 by pushing it from the Management Server.  I noticed later that I was getting Windows Update errors as it was unsuccessfully trying to install Windows Defender definitions Normally, after you install SEP in Windows, you see the following if you try to open Windows Defender from Control Panel:

After the install I see the following instead when I open Defender from Control Panel:

I believe this is why Windows Update was trying to download Defender definitions.  I solved the issue by using Group Policy to disable Defender.  After doing this I now receive the following when I try to open Defender:

It appears Defender is no longer being properly turned off in this recent, major update to Win 10 when SEP 12.1.6 MP3 is installed.  My work around solved the problem but I wanted to see if there was a solution to this minor but annoying issue. I repeated this scenario on another machine that was running Win 10 Ver 1511 and received the same results.

Thanks!

CQ.

Best to call support and get a case open so they're aware. It may be an unknown issue.

My tale of woe,

I opened a case online with Symantec and just spent over an hour on the phone with a tech from India who was not understanding what I reported above.  As my temper increased, I was told to contact Microsoft as SEP is working fine. It is not my responsibility to contact Microsoft. MS would tell me to contact Symantec lol!  I finally ended the conversation telling the tech I wanted to talk to someone in America.  Supposedly, I will be contacted in 24 hours.  I thought I was trying to report a possible issue between the client install of SEP on Windows 10 Ver 1511 and the proper disabling of Defender.  I even gave the tech the link to this forum post to help explain the potential issue. As Brian suggested, I wanted to make Symantec aware of a potential install issue with the most recent version of Windows 10.  Oviously this needs to be looked at by Symantec engineering to see why Defender is not properly being disabled.

If anyone from Symantec is reading this, my case is  # 09835321. Now you see why I started with the forum in hopes of avoiding tech support.  I am normally a very patient person but this one blew my head gasket. There, I feel better now.

CQ

I'm also having same situtation as CQ in his first post...

A followup:

I installed SEP 12.1.6 MP3  on a Windows 8.1 Pro machine and defender was properly disabled.  I then installed SEP 12.1.6 MP3  on another machine converted to Windows 10 and the same issue noted in my original post occurred.

Apparently, some sort of natural disaster occurred in India (flooding?) and support has been emailing me apologies about a lack of followup on their part. So, at this point I have received no possible solutions or answers.

Hello,

Could you try disabling the ELAM from Windows 10 machine?

Secondly, the steps provided in the below article:

Keeping Windows Defender Enabled when Deploying and Installing Symantec Endpoint Protection Client package.

https://www-secure.symantec.com/connect/articles/keeping-windows-defender-enabled-when-deploying-and-installing-symantec-endpoint-protection

Regards,

Mithun,

Thanks for your suggestion.

You are misunderstanding the issue.  I WANT Defender to be disabled after the install of SEP.  It just needs to be disabled properly as I show in the pictures in this thread.  I believe Support just needs to turn this over to the Software Engineers for review.  My group policy edit solved the problem bu a user should not need to do this.  My testing definitely shows the problem is limited to Windows 10. Also, given oxbow's comment, the problem appears to not be limited to just me.  Many who have installed SEP on Windows 10 probably have not noticed this subtle problem,

CQ

Hello,

Check the above Article, which tells you how to enable the Windows Defender - 

<computercode>DISABLEDEFENDER=val</computercode>

• <computercode>1</computercode> - Disable Windows Defender (default)

• <computercode>0</computercode> - Do not disable Windows Defender

Hope that helps!!

Mithun,

I read the article.  Why would I want to change to DISABLEDEFENDER=0 when installing SEP?   A 0 leaves Defender active after the install which is not what I want.  A standard install from the management server always, by default, disables Defender which is what I want.  In Windows 10, defender IS turning off but not properly. Windows update keeps trying to download Defender definition updates and shows an error when you open live update.  This problem does not occur on earlier versions of Windows including 8.1.

Your article is great but is not really applicable to the situation I am reporting. 

Thanks,

CQ

Hello CQ,

I hope you have tried uninstalling and reinstalling the SEP from the machine.

It seems you have already created a case with Symantec. 

Regards,

Mithun,

Yes, I have uninstalled and re-installed several times on 3 different Windows 10 machines.  No change in the results each time.  As you noted, I created a case in mid November.  The case# is listed earlier in this thread.  It really needs to be pushed to programming to see why SEP is disabling Defender differently on Windows 10.

Thanks,

CQ

I, too, am seeing this same issue when testing SEP 12.1.6 on a Win10 Pro 1511 build VM.  Windows Update fails with error 0x80070643 when trying to install the definition update for Windows Defender which was supposedly disabled by the SEP client install.  I'm in agreement with CQ that Symantec engineering or their backline guys need to take a look at what the SEP 12.1.6 installer's doing differently to disable Windows Defender in the "1511" Win10 build which is apparently interfering with Windows Update.

Hey Fellas -

Have your open tickets been pushed to backline or dev? At this point, it appears a code fix is in order. Hopefully in MP4 but I'm also curious to others out there that see the problem. It may be worth asking support how many other tickets they've seen come in with the same problem.

Hi Brian,

My case was closed after I was finally contacted by a different tech who seemed to understand the issue.  We closed the case and the tech assured me the problem would be pushed to programming for investigation.  By your comment, it appears they have noted the issue.  I will let you ask them the question about how many others have encountered this issue lol.  The less I talk to level 1 support the better.  I was sent a survey and I gave Symantec low scores.  To Symantec's credit, within a couple of days I received a phone call from a supervisor and I explained my frustration with, what I thought, was a simple issue to be reported.  I was told by the supervisor he was going to listen to the recording of the call(s).

Thanks for the update about a possible fix coming.

CQ

That's quite alright ;)

Since it's likely a code fix, hopefully, it's provided in the next release.

Hey Brain,

is this information pubilically available anywhere ?

What information specifically?

Just for the Record I just did a fresh install on Windows 10 Pro machine (stand alone - No domain) and have the exact same problem.

The Quality control these days seems to be weak at best.

Thank You CQ for your efforts to keep pushing.

Seems we are all the Beta testers anymore !!!!

I too encountered this issue with a fresh install of Windows 10 and SEP 12.1.6 MP3.  However after some trial and error I found a workaround:  After initially installing SEP, go to Programs and Features and do a "Repair".  This seems to fully disable Windows Defender and puts it into the state where Windows Update won't attempt to download updates.

I hope this helps others until Symantec corrects the issue in a future release.

The "Repair" workaround does not help here. Windows Defender is active since the last windows updates from January 2016. I am 100 % sure Defender was before de-activated.

The "Repair" workaround disabled Windows Defender for me... thanks Russell for discovering and sharing this!

I hope Symantec corrects this install issue in a future release.

There is no defect opened on our side. So there is no root cause, and so there is not a fix forthcoming.  We had an older similar issue back in RU4 and it was on the Microsoft side to fix and we worked with MSFT.  I did a search  internally and cannot locate an open defect.

<EDIT>Sorry you had a bad experience, I pinged Support management, and if a new case is opened it will be investigated deeper.

You can ping me here or directly to my account the case #. I'll ask for escalation. Note you can ask for escalation as well by speaking to a Duty Manager.

josh_symc,

My case# is 09835321.  I believe the case should be re-opened for the sake of others with the issue.  Let me give more details on the Win 10 issue. I found if SEP is ALREADY installed/running on the computer and it is then upgraded to Win 10 I did not see the problem.  I only saw it on a new install of SEP to a Win 10 machine not running SEP.  When you say you had no issues ("I am running Windows 10, with MP3 and dont have the issue") was yours a fresh install of SEP to a Win 10 machine or was SEP already installed when the machine was upgraded to Win 10? 

My world is fine with the Group Policy work around I discovered.  I think Symantec needs to talk directly to MS to report the issue.  Obviously something is going on here regardless of who is at fault.

Thanks,

CQ

Unfortunately a case cannot be re-opened, as I asked on the Support side. We have no logs, no root cause, no duplication, and without a case and investigation, nothing to fix. My 3x duplications did not show what you see. One person in the thread contacted me offline with a new case, and steps, and I have it being escalated. I did a fresh SEP install, after a CleanWipe and reboot.

I concur the original case should have been examined deeper If you want to open a new case, send me the case number so can make sure has proper attention.

I can confirm having the same issue with Norton Security Deluxe (version 22.5.5.15).

josh_symc,

For the record, I was assured by the second support person who called me that the case could be re-opened down the road but support is telling you it can't.  Hmmm... I have used SEP and another Symantec (now Veritas) product for years and on the occasions I needed support I was ALWAYS told a closed case could be reopened if necessary. Your answer from support is completely contradictory.   At this point I see no need to open a new case as you have found someone else with a case that can be used.  I will just sit back and see where this goes. More facts....  All my installs were managed and pushed to the client by a management server.  Two installs were done on physical machines and one was done on a VM.  The issue was consistent.

The bigger issue here is how support bungled my case and wasted my time.  Most people using SEP are business customers and ,frankly, I received the kind of poor support you would see at a private, consumer level.   No attack on you josh_symc, but I expect better.

Thanks,

CQ

I agree totaly.

My first mistake, where I can not blame Symantec, is that I installed Windows 10.

My second mistake, that I renewed all my customers lics for 3 more years with SEP.

I have the same problem.

The endpoint protection installer seems not to deactivate Windows Defender properly. This is bothering me mainly because every machine throws errors back to wsus.

On every machine I now need to do a repair on SEP, after that Defender would be deactivated properly.

I need a fix which can be deployed/applied efficiently.

Hey all. 

After josh_symc p​osted that he couldn't find an open defect relating to this issue on their side, I took his advice and opened a new case on the issue.  I worked with Symantec and provided them with the step I took to show the issue.  I received word today that the issue has been successfully reproduced in-house and that it was being passed along to the appropriate people to be looked into further.

Hi,

That's great!  Out of curiosity, what steps did you take that reproduced the error as opposed to what josh_symc did?  At least I know now I was not imaging this issue lol.

CQ

CQ,

I'm not sure of all the differences but one I do know is that I was always doing a fresh install of Win 10 to reproduce this issue.  Initially, josh_symc tried running the Cleanwipe tool on a system and was unable to reproduce the issue.

He and I messaged back and forth for awhile and I think he was able to eventually reproduce the issue.  I then worked with another person (who was assinged the case I'd opened) and gave them my steps to reproduce as well as pointing them to the exact ISO I was using from MS.  That's when they confirmed successful reproduction of the issue both with build 10586.0 and the latest cumulative patch 10586.71.

this thread has been quiet for a month - is there a solution yet? i am having this problem too

Jack, the "solution" ist to deacivate defender on your own, best before installing SEP...

12.1.6 MP4 was just released which corrects the patch issue linked above:

http://www.symantec.com/docs/INFO3517

Current version MP4 did not fix the problem for me. Turn off Defender, install MP3 or MP4, all looks good until I reboot.

The system goes into automatic repair, and I need to use the restore point in order to back into windows. Been working

with support for 3 weeks now, still no solution. I am going to disable the defender services, run cleanwipe and try again.

MP4 does still not correctly disable Windows Defender. Issue is not fixed.

Same issue here. MP4 does not fix the issue.