Endpoint Protection

Does MR4 MP1a client need Windows Server 2008 lockup hotfix?

The hotfix is not included according to the published release notes for MR4 MP1a.

http://service1.symantec.com/support/ent-security.nsf/854fa02b4f5013678825731a007d06af/2c62c4ee0e697aae882573b000034ded?OpenDocument

 

Yes, it needs patching.  MR4 MP1a only includes the Network Threat Protection fix.  MR4 MP2 will be the first to include the AP fix. 

Do you know when approx. when MP2 will be released ?

 

Nothing is set in stone at the moment, but I would expect April/May timeframe. 

What is this AP / 2008 lockup hotfix you're talking about?

Does this mean there are still issues with MR4 MP1a?

What is this AP / 2008 lockup hotfix you're talking about?

Does this mean there are still issues with MR4 MP1a?

 

You probably didnt seen this discussion http://www.symantec.com/connect/forums/mr3-locks-server-2008-file-shares

 

MP1a only fixes Network Threat Protection bug introduced in MP1, but it doesnt include Windows Server 2008 shares and DFS lock up issue fix. You need to apply the separate hotfix after installing MR4 MP1a client version on Windows Server 2008.

Updated KB's:

Title: 'Problems accessing file shares on Windows Server 2008 64-bit running Symantec Endpoint Protection'
Document ID: 2008100113145148

http://service1.symantec.com/SUPPORT/ent-security.nsf/docid/2008100113145148?Open&seg=ent

 
Title: 'Network shares become unresponsive on Windows Server 2008 32-bit with Symantec Endpoint Protection 11 Auto-Protect enabled'
Document ID: 2008061812370848

http://service1.symantec.com/SUPPORT/ent-security.nsf/docid/2008061812370848?Open&seg=ent

 

Title: 'Network shares become unresponsive on Windows Server 2008 32-bit with Symantec AntiVirus 10.2 Auto-Protect enabled'
Document ID: 2009021611455248

http://service1.symantec.com/SUPPORT/ent-security.nsf/docid/2009021611455248?Open&seg=ent

So, if I don't have Network Threat Protection installed should I stay with MP1?

Do I still have to upgrade everyone? I have AV and Antispyware plus Proactive Threat Protection installed on my XP clients.

My Windows 2003 and 2008 servers have the quick fix applied and it's running OK for one week.

Thanks.

Hi,

in your post you mentioned this:

"Title: 'Network shares become unresponsive on Windows Server 2008 32-bit with Symantec AntiVirus 10.2 Auto-Protect enabled'
Document ID: 2009021611455248

the link you mentioned leads to page, where is statement, that issue has been fixed in Symantec AntiVirus 10.2.2.2000 (MR2). But this is not true. We have MR2 on three fileservers with approx 1000 users on each and still suffering problem described above on at least two of them.

When fix will be available for SAV 10.2?

Thank you,

Petr

I installed 11.0 MR4, then installed MP1a. Then for troubleshooting an application that pegged the CPU at 100% with SEP installed, I removed MP1a and then MR4. After seeing that it was the application's interaction with the Endpoint Protection, I reinstalled determined to figure out what setting needed to be tweaked to get the CPU to settle down. After reinstalling MR4 and rebooting, I ran the patch install and it starts the installation with a progress bar, the form goes away and then...nothing. Any tips?

What does %TEMP% SEP_INST.LOG say? 

Look for return value 3, post the 10 lines before it.

is there anything in the event log?

After installing the 2008 32bit hotfix on my Windows 2008 Std Svr it was all ok for an extended period of time and then just on Friday we had a Sev 1 call in regards to smb issues. We knew this was SEP 11 MR4 straight away and found out that the hotfix files has actually reverted back to their original state. Is there any reason for this to happen ? I then this last weekend removed MR4 and then installed MR4 MP1 thinking this had fixed this problem, but then reading this thread find out that this wont be included until MR4 MP2. If this issue was found to be a problem so far back, why hasn't it been included in the product ?

Regards,

Jon Logan
Network Design Engineer
Unisys Australia Pty Ltd

MR4 MP2 should be available on fileconnect in a couple days

Is MR4 MP2 going to fix Windows 2003 servers too? The last hotfix (patch) was fixing Windows 2008 only.

The release notes for MR4 MP2 are up now...the only thing I saw about this is:

Windows 2008 x64 share connectivity problems
Fix ID: 1442447
Symptom: After a period of time (hours to a day or so) file shares become unresponsive on Windows 2008 x64.
Solution: Auto-Protect update.

Hi Conestoga,

actually Endpoint Protection on Windows 2003 is really stable, therefore I am not aware of any plan to fix some serious issues for Windows 2003.
I think it is better if you report your issue to the Tech Support. If you prefer the forum, please open a new discussion.

is it not enough? Detailed KBs on the topic are available and already posted here.

Is it only the 64 bit version that is fixed?

Yes, MR4 MP2 includes only the fix for the 64bit version.

Regarding the 32bit version, for most customers this problem is fixed in Symantec Endpoint Protection 11 MR3, MR4, MR4-MP1, or MR4-MP1a.
As you likely already know, If you are continuing to experience the issue with Symantec Endpoint Protection MR3, MR4, MR4-MP1 or MR4-MP1a, a hotfix was created for Symantec Endpoint Protection MR3, MR4, MR4-MP1 and MR4-MP1a for Windows Server 2008 32-bit computers. The hotfix is certified for 32-bit Windows Server 2008 with Symantec Endpoint Protection.
This hotfix will be available in a future release of Symantec Endpoint Protection but, unfortunately, not the MR4 MP2.

Giuseppe Axia, there are already two topics about Windows 2003 server and there is no fix for it. The only solution provided by Paul Murgatroyd was to try the hotfix for Windows 2008.
That one works for 2008, it helps the 2003 servers but still network shares lockup after a period of time. Every 4-6 weeks instead of every 3-5 days.
https://www-secure.symantec.com/connect/forums/mr3-locks-server-2008-file-shares#comment-2409041

Issues with the file shares on Windows 2003 are really rare, maybe they are behind a strange OS setting or a hidden bug, anyway, we cannot release a patch if we don't have enough details about this issue. Of course these details have to come from the few customers who have the issue and two topics in the forum obviously don't allow us to seriously debug and patch anything, therefore who has this issue has to open a ticket with the Technical Support to properly investigate on it.

I have a case opened for so many months. (312-102-518). I am "testing" and giving feed back to Symantec for more than one year and a half, since MR2. All my Windows 2003 servers are locking up and a server reboot is required or even SEP uninstall.
My 2008 servers got fixed by the hotfix released 2 months ago and the 2003 are a bit more stable than before, but it's not a 100% fix.

There are other Symantec users having difficulties with 2003 ...

Thank you for your cooperation, I quickly had a look at your case, my colleagues are waiting for a complete memory dump from you, it is very important to manage this kind of issues.
I don't know how may users have the same problem but you are the first I know in one year, therefore or they are very rare or they don't will to cooperate with us to resolve this issue.

I hate to sound like a skeptic but we tried many release of SAV 10 that indicated the problem was fixed and still ran into server hangs.

As bad as it sounds we are at a point where we would rather run without antivirus than suffer more production down time.

I would like to hear form some brave soul that has installed SEP 11 MR4 MP2 on an x64 Server 2008 that is heavily loaded with XP clients accessing the server and had the server stay up for a week. We are a Symantec Enterprise customer seriously looking at alternatives because of this issue and the length of time it has taken to resolve.

I have just installed Symantec_Endpoint_Protection_11.0.4202_MR4_MP2 on my 2008 Server, which has given me nightmares for the last 9 days. Just to give some background we had to replace an old server for a small office (10 users) and going forward we didn't want to start with 2003. Built and tested the server for several weeks in the workshop before deploying and everything was fine until we connected the clients and started running for real when merry hell broke loose. As they are always desk hopping, there was a lot of redirection applied through group policy and all the important data was available through a mapped drive. At random times, certain user's accessing certain network files,  would suddenly lose all connectivity, and only a hard reset of the server would remedy this.

I think we have been unlucky in that when we built the server the latest version available was 11.0.4000 which was broken from the start. We specialise in small server systems for companies on limited IT budgets and we try and keep everything as simple as possible to minimise maintenance so my question I'd like answered is how much testing did Symantec do before releasing SEP versions prior to 11.0.4202. I can understand there may be conflicts on more advanced and complicated systems but I have an up to date 2008 standard box with Backup Exec and Vpop email running on it. Also it appears many others have had the exact same issue with network shares disappearing prior to  11.0.4202 which suggests a common fault.

With 11.0.4202 things appear to have settled down but it may be too early to say.

This issue has cost us a great deal of lost time and, a once good relationship with a client to be soured.
Please do not use your customers for Beta testing unless you are prepared to pay for our time.

Wish I found this thread earlier.