Endpoint Protection

 View Only
Expand all | Collapse all

Duplicate Folders after migrate from 12.1.5 to 12.1.6 mp4

  • 1.  Duplicate Folders after migrate from 12.1.5 to 12.1.6 mp4

    Posted Jul 04, 2016 12:02 PM
      |   view attached

    Hello everyone,

     

    I used the microsoft System center for migrate from 12.1.5 to 12.1.6 MP4 in my environment.

     

    After upgrading a lot of customers are keeping the old folder:
    (Approx: 100 clients)

     

    C:\ProgramData\Symantec\Symantec Endpoint Protection\12.1.5337.5000.105- OLD

    C:\ProgramData\Symantec\Symantec Endpoint Protection\12.1.6867.6400.105- ACTUAL

     

    The old version (12.1.5) should not be deleted automatically?

     

    The event logs reported no failure and SymDiag also not recorded fault. 

     

    Someone has a idea for this issue?

     

    Thanks!!!



  • 2.  RE: Duplicate Folders after migrate from 12.1.5 to 12.1.6 mp4

    Posted Jul 05, 2016 10:59 AM

    SEP 12.1 employs a side-by-side, replace on reboot installation strategy. Side-by-side means that new files are written to a new folder, referred to as a silo, isolated from the existing operational folder. Because the two versions are separated from each other, during a migration the older software is left running unchanged until the next reboot.

    The primary benefit of side-by-side installation and replace on reboot is that the system continues to be protected by the existing software until the new version is in operation after the reboot.

    Did you reboot the system yet? The folder should go away.



  • 3.  RE: Duplicate Folders after migrate from 12.1.5 to 12.1.6 mp4

    Posted Jul 05, 2016 11:25 AM

    Hello Bryan,

    Thank you for your help.

    The system has been restarted 2 times and the folder remains in the directory.
    The SYMDIAG not detected any correction.

    I perform manual cleaning of the old antivirus folder (RU5), but the system locks even with disabled tamper.


    Another would help?



  • 4.  RE: Duplicate Folders after migrate from 12.1.5 to 12.1.6 mp4

    Posted Jul 05, 2016 11:47 AM

    is you upgrade successful and is your new client operational after the reboot ?

    did you check the client version post reboot ?

    can you try to manually upgrade an old version of SEP client to the latest and reboot once to check if the old folders are deleted automatically ?



  • 5.  RE: Duplicate Folders after migrate from 12.1.5 to 12.1.6 mp4

    Posted Jul 05, 2016 02:24 PM

    Hello PraveenAyappan,

     

    Yes, after reboot the client is on new version(RU6), but the old folder(RU5) still in client.

    Removing manually in error because the process is in use.



  • 6.  RE: Duplicate Folders after migrate from 12.1.5 to 12.1.6 mp4

    Posted Jul 05, 2016 02:33 PM

    It could be that the client is still using virus definitions from within that folder. When new defs come down they will unload and load the new ones from the latest version folder and it will be removed after that.



  • 7.  RE: Duplicate Folders after migrate from 12.1.5 to 12.1.6 mp4

    Posted Jul 05, 2016 03:03 PM

    The problem occured 3 days ago.

    The client is update.

     

    Only the file CCSETTINGS can't deleted.
    Ps: Tamper OFF and SEP client STOP

    C:\ProgramData\Symantec\Symantec Endpoint Protection\12.1.5337.5000.105\Data\CmnClnt\ccSetMgr\ccSettings_12.1.5337.5000

     

     



  • 8.  RE: Duplicate Folders after migrate from 12.1.5 to 12.1.6 mp4

    Posted Jul 05, 2016 03:11 PM

    Try safe mode.



  • 9.  RE: Duplicate Folders after migrate from 12.1.5 to 12.1.6 mp4

    Posted Jul 06, 2016 11:42 AM

    I used the utility Cleanwipe and the client SEP returned to work.

    The problem occurs in about 100 Windows servers 2008 r8. 

    I'm still searching for a definition solution for this problem.



  • 10.  RE: Duplicate Folders after migrate from 12.1.5 to 12.1.6 mp4

    Posted Jul 06, 2016 11:48 AM

    I don't know that this is a major or not. I've seen this happen before on random clients but it didn't present enough of a problem that it was worth looking into further. However, servers may be a different story for you.

    May need to get a case open.



  • 11.  RE: Duplicate Folders after migrate from 12.1.5 to 12.1.6 mp4

    Broadcom Employee
    Posted Aug 03, 2016 11:03 AM

    SymDiag does an installation integrity check that matches version numbers between the MSI and the registry as well as checks if registry values for services and the services are present.  It does not check if the paths of the file and registry value correlate or if the path matches the version (as the files may be stored in a directory that is silo-specific and, therefore, contains the SEP version in a folder name). 

    You can check this information manually by examining the registry value...

    HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\<relevant key>\'imagepath'

    If you have rebooted the system you can search the registry for the value imagepath with data corresponding to the path of the file you are trying to delete to see if there is a registry key that is still starting that service.

    If a SymDiag report from a system exhibiting this issue is delivered to support please have the support agent contact the SymDiag development team to see if this sort of scenario can be captured in a SymDiag report.

    Thanks!