Endpoint Protection

On Friday last week, I upgraded our SEPM server from 12.1.4 to 12.1.5. Before the upgrade I had working email notifcations, but since Friday none are working. We have an Exchange 2013 server on a Windows 2008 R2, 64bit server. From Friday the only change is the SEP upgrade.

I have confirmed the email settings on the SEPM server are correct. I have confirmed through a Telnet connection to the Exchange server from the SEPM server that I can send emails. The logs on the Exchange server report remote socketerror in the SMTP Open Relay logs.

Any help would be greatly appreciated.

If you run the test email from the SEPM, does it work? I've seen the settings inadvertantly change during upgrades.

I should clarify. The email notifications that I referred to earlier are Security Alert notifications from the SEPM server for device control and systems added to or deleted from the managed clients list.

Brian,

Yes, I did run the test email from the SEPM server. I checked and rechecked those settings to verify those were correct. I also used a Telnet session to verify that I could send email from the server that SEPM resides on. I'm open to any other ideas.

Brian,

The test emails that I tried from the SEPM server on the email configuration tab failed. Only the Telnet session worked for sending email from the SEPM server.

Try enabling FINEST debugging and re-produce the issue. It may show in the scm-server0 or catalina.out file:

How to debug the Symantec Endpoint Protection Manager

I have resolved this issue. We have an Exchange 2013 mail server. The IP address for our SEPM server is configured in Exchange's Open Relay. Before the upgrade to SEP 12.1.5, all of our SEPM email notifications worked, and did so with the username and password for the 'Sender email address' entered into the SEP Email Server Settings.

After the upgrade to SEPM 12.1.5, email notifications from the SEPM server no longer worked. In the course of troubleshooting, I had tried removing the username and password for the 'Sender email address', which did not work. I tried using a known working email username, password, and email address which did not work either.

Last week, I added a local Window's user account with administrator priviledges on the SEPM server. This user account is the same user for which the SEPM, Sender email address is configured on the SEPM server. I then logged onto Windows on the SEPM server with that user and tested the email function. The Sender username and password were entered in the Username and Password fields respectively. Initially, the 'Send Test Email' failed.

Still logged into Windows on the SEPM server with the credentials for the Sender email address, I then cleared the User name and Password fields and the 'Send Test Email' succeeded. Even after I logged off of Windows as the user I just set up on the SEPM server and logged in with the traditional user for the SEPM server, the 'Send Test Email' worked.

To Summarize this fix:

1. Create a local Window's administrator account on SEPM server with the username and password of the SEPM email sender account.

2. Log on to Windows Server 2008 with the credentials just set up in the step above.

3. Open SEPM manager, navigate to the  SEPM, Admin, Servers, %Servername%. Choose, "Edit the server properties."

4. Under the email tab, ensure that the 'Sender email address:' is that of the user in step one.

5. Clear the username and password fields.

6. Click 'Send Test Email' to verify.

After the steps above, I was able to log off and back on to the SEPM server using the traditional user account for that server. Email notifications have worked since.