Endpoint Anti-Virus Slows Down Opening Files on Network Dramatically
Updated: 22 May 2010 | 27 comments
This issue has been solved. See solution.
We are experiencing an issue with Endpoint Protection when opening any file hosted on our file server from a client workstation. Whenever you open a file hosted on the network, it opens incredibly slowly on workstations that possess 100 mb NICs (rather than 1 gb).
Upgrading all of these clients to 1 gb NICs is not an option as many of them are laptops where it is simply not practical.
When you disable A/V, the files open isntantly so the problem is clearly Endpoint Protection.
Is there a way to speed up opening files on the local network without completely disabling Endpoint Protection's A/V?
Thanks in advance!
discussion Filed Under:
Comments
hi
what is the version of SEP you are running previous versions had some issues with network shares.
upgraging to latest MU5 should fix the issues.
https://www-secure.symantec.com/connect/forums/mr4-causes-network-disconnect-slow-rates
Release notes for Symantec Endpoint Protection 11.0.x and Symantec Network Access Control 11.0.x
http://service1.symantec.com/SUPPORT/ent-security.nsf/docid_p/2007121216360648
IPv6 and Network Protection affects performance on Windows Vista virtual machines
Fix ID: 1545253
Symptom: On virtual machines running Windows Vista, copying large files to network shares might take longer when Symantec Endpoint Protection NTP (Network Protection) is enabled.
Solution: For full details see readme_sep.txt section titled "IPv6 and Network Protection affects performance on Windows VISTA virtual machines".
Please don't forget to mark your thread solved with whatever answer helped you : ) Rafeeq
What version of SEP are you
What version of SEP are you running? There was a fix in MR4 MP2 that addressed network share issues when a "Block USB" policy was in place.
http://service1.symantec.com/support/ent-security....
Fix ID: 1475460
The clients are on version
The clients are on version 11.0.1000.1375
Would they be affected by this?
Yes, there are many issues
Yes, there are many issues that have been addressed from that early build. Upgrading to RU5 should address your issue.
Thomas
Hi
As I mentioned lot of issues are fixed in latest version
UPgrading to latest version should fix all the issues.
Obtaining an upgrade or update for Symantec Endpoint Protection 11.x or Symantec Network Access Control 11.x
http://service1.symantec.com/SUPPORT/ent-security.nsf/docid/2007121216494948
Please don't forget to mark your thread solved with whatever answer helped you : ) Rafeeq
How do I go about pushing out
So based on that link...do I download the upgrade on every single client or simply on the management server?
I'm at the file download
I'm at the file download page...Endpoint is on two separate CDs. Do I have to reinstall the entire product? Why can't LiveUpdate just update each of the clients?
You need to download CD1.
You need to download CD1. Liveupdate does download the Updated Client Versions but that can only upgrade the clients for upgrading SEPM you will have to Download the CD1.
Anyways i don't think 11.0.1000.xx even downloads the Packages.So you will have to upgrade to latest version for new features and less troubles.
VMWARE-- SEP 12.1 vs McAfee vs Trend Micro
That's a ridiculous upgrade
That's a ridiculous upgrade process. This product just gets better and better.
I will go through the upgrade and see if that fixes the problem, thanks for your help thus far.
When you upgrade the
When you upgrade the management server, the server can push out new packages to the clients and upgrade them.
You should not have to touch the clients individually.
The upgrade process is rather simple.
download CD1
unzip
stop SEPM services
run setup on SEPM
Verify your console is working and clients are still managable
push out new clients via upgrade wizard in console to test group
test
deploy in small batches after issues are ironed out...
Easy as pie... In a man'tastic baking sort of way.
There is an online portal, save yourself the long hold times. Create ticket online, then call in with ticket # in hand :-) http://mysupport.symantec.com "We backup data to restore, we don't backup data just to back it up."
It will definitely fix most
It will definitely fix most of your issues that you are facing and even the issues that you might be facing aren't aware of it yet...
SEP is really becoming better and Better ( in good sense )
Just have a look at the release notes and you will get a Idea
http://service1.symantec.com/SUPPORT/ent-security.nsf/docid/2007121216360648
VMWARE-- SEP 12.1 vs McAfee vs Trend Micro
It might be getting better
It might be getting better but it's still not a quality product if this is the upgrade process.
Windows can go from Windows without any SPs to Windows SP3 simply using Windows Update.
Linux has yum update.
Endpoint Protection requires downloading entirely new media and installing from that and then to have updates pushed out to clients.
I'm thankful for everybody's help with this problem and I sincerely hope it fixed the probelm we've been experiencing. However, this product as a whole isn't the type of quality I would expect for a product that we have invested thousands upon thousands of dollars in.
MR3 introduced the clients
MR3 introduced the clients self updating themselves. But the management server ALWAYS is updated manually. Would you want your server to autoupdate a major version? I hope not.
Dont compare WIndows that has been around much longer with something like SEP that is only 2yrs old.
The upgrade process is the same for many other vendors as well.
There is an online portal, save yourself the long hold times. Create ticket online, then call in with ticket # in hand :-) http://mysupport.symantec.com "We backup data to restore, we don't backup data just to back it up."
Interesting, I find the
Interesting, I find the upgrade process actually pretty good and much more reliable that SMS or SCCM as it is now! We're lucky to get 80-90% with SCCM, we hit at least 98% with SEP!
I upgrade the servers, assign packages and within a couple of days, have them updated..............
Frankly, it's one of my favorite things about the product.
My sites - http://theamcpages.com & http://antique-engines.com
Toy:
Shadow:
From what version you are
From what version you are using now you cannot compare to SEP what it is now.Its completely different just the colour and name is the same :-)
VMWARE-- SEP 12.1 vs McAfee vs Trend Micro
Alright, well heres to hoping
Alright, well heres to hoping all of the issues we have been experiencing will be resolved with this update!
Does this mean that I can use Network Threat Protection again as well? We had to have that completely disabled or our DHCP servers wouldn't work and our backup time went from 12 hours to 36 hours.
Now I'm getting the following
Now I'm getting the following err:
"You cannot log on to the console because the server is not synchronized with the database. Upgrade the server, and then log on to the console."
But upgrading the server is what caused this to begin with...
I'll just completely uninstall it and then reinstall it.
Yes..Of-Course with the
Yes..Of-Course with the Latest version too many firewall Issues have been fixed like Wireless,DHCP and many.
VMWARE-- SEP 12.1 vs McAfee vs Trend Micro
run upgrade.bat from
run upgrade.bat from \program files\symantec\symantec......manager\bin
VMWARE-- SEP 12.1 vs McAfee vs Trend Micro
Didn't know that
Didn't know that existed................
My sites - http://theamcpages.com & http://antique-engines.com
Toy:
Shadow:
MR3 fixed a lot of that, MR4
MR3 fixed a lot of that, MR4 MP2 even more so. RU5 is the latest... Between MR2 and MR3 was HUGE, almost a brand new product yet is was just a service pack.
That said, for servers it's hit or miss. In some cases you want NTP. In others, only AV is installed.
Or in some cases, you want NTP, but you essentially withdraw the FW policy from those servers, or create a single blank rule with any<->any allowed.
There is an online portal, save yourself the long hold times. Create ticket online, then call in with ticket # in hand :-) http://mysupport.symantec.com "We backup data to restore, we don't backup data just to back it up."
I have the AV and NTP
I have the AV and NTP installed on all servers............ we've never had to change from the default policies. DHCP just plain works. Even on the DCs, they are running the SEP firewall.
My sites - http://theamcpages.com & http://antique-engines.com
Toy:
Shadow:
Upgrade.bat fixed the
Upgrade.bat fixed the syncrhonization problem, thank you.
I will say this...the support forums here have gotten a lot better.
I've been working with SAV/Endpoint and Veritas/BE for a long time and it wasn't always like this.
I remember when installing the SEP Management Console was done on port 80 by default and changing it was a ridiculous process. Glad to see this has been fixed as well.
This is the best place to
This is the best place to share and Gain Knowledge mainly on SEP...
VMWARE-- SEP 12.1 vs McAfee vs Trend Micro
This does appear to have
This does appear to have resolved the issue.
This thread can be closed. Thanks for your help everybody.
Could you post some feedback
Could you post some feedback on what you noticed after the upgrade?
How much of an improvement did you see with the upgrade and such?
There is an online portal, save yourself the long hold times. Create ticket online, then call in with ticket # in hand :-) http://mysupport.symantec.com "We backup data to restore, we don't backup data just to back it up."
The problems when opening and
The problems when opening and saving files located on the network appear to have gone away entirely like you guys said it would.
There is still a lot to be analyzed and there are now new problems I am facing such as the clients saying that the definitions for PTP are old even though they are brand new. (I have created a separate thread for this)
Additionally, on a couple of the clients SecLU.exe is detected as a threat even though it is part of the SEP solution.
The problem that prompted this has been solved the there are now new problems for me to solve before everything will be good to go.
Would you like to reply?
Login or Register to post your comment.