Disabling SEP 12.1
Created: 26 Jan 2013 | 8 comments
We are running through a reindex of our DMS, and they say it's running slower than it should. I have kept being asked to make sure certain folders are excluded from scanning, which they were. I (partly to make a point) ran smc -stop on the relevent servers, and verified that all Symantec services were stopped. The indexing performance has not changed.
Am I right that with all SEP services stopped that all AV functionality is completely disabled, and that the lack of any improvement in performance means that it could not be caused by SEP?
Discussion Filed Under:
Comments 8 Comments • Jump to latest comment
smc -stop will not disable SEP. Otherwise you can stop the SEP service from services.msc. This should disable it.
If you have NTP installed, you can right click the SEP icon in the task tray and select "Disable", this will disable the NTP component.
You can check this as well:
Disabling the Symantec Endpoint Protection client Network Threat Protection and Intrusion Detection System components
SEP Knowledge Base
Endpoint SWAT
smc -stop was the first thing I did. I went into services and made sure all Symantec services were stopped. So currently no Symantec services are running, including the SEP service and SMC.
what version of SEP?
is the "Symantec Endpoint Protection" stopped too?
Cheers!
Pete
Help Link: http://www.symantec.com/business/support/overview.jsp?pid=54619
12.1 RU1 MP1
Yes, the Symantec Endpoint Protection service is stopped. Symantec Management Client service is off.
I feel the issue is elsewhere, but whenever there's a problem it seems like they always say "It's Symantec". I turned everything off so that it couldn't be seen as that the exclusions weren't working. The vendor's documentation actually says to disable real time protection in any AV program running on one of these servers, permanently.
yes exclusions are the correct way to check. it should be stopped, can you check this registry entry to know if AP is off or on
HKLM\SOFTWARE\Symantec\Symantec Endpoint Protection\AV\Storages\Filesystem\RealTimeScan\OnOff
Cheers!
Pete
Help Link: http://www.symantec.com/business/support/overview.jsp?pid=54619
That's set to one (under wow6432node). Does that mean that Realtime Protection is currently running, or just that it would be if the services were started?
yes, 1 represents on, change it o in registry and check the reindex. also suggest to open a support ticket.
Cheers!
Pete
Help Link: http://www.symantec.com/business/support/overview.jsp?pid=54619
Easiest way to be 100% sure of SEP is the cause is to deinstall it from this machine for test and check if the problem still occurs.
Would you like to reply?
Login or Register to post your comment.