Video Screencast Help
Search Video Help Close Back
to help
New in the Rewards Catalog: Vouchers for "Symantec Technical Specialist" and "Symantec Certified Specialist" exams.

Endpoint Anti-Virus Slows Down Opening Files on Network Dramatically

Updated: 22 May 2010 | 27 comments
VDOR's picture
0 0 Votes
Login to vote
This issue has been solved. See solution.

We are experiencing an issue with Endpoint Protection when opening any file hosted on our file server from a client workstation. Whenever you open a file hosted on the network, it opens incredibly slowly on workstations that possess 100 mb NICs (rather than 1 gb).

Upgrading all of these clients to 1 gb NICs is not an option as many of them are laptops where it is simply not practical.

When you disable A/V, the files open isntantly so the problem is clearly Endpoint Protection.

Is there a way to speed up opening files on the local network without completely disabling Endpoint Protection's A/V?

Thanks in advance!

Comments

Rafeeq's picture
18
Nov
2009
2 Votes +2
Login to vote

hi

what is the version of SEP you are running previous versions had some issues with network shares.

upgraging to latest MU5 should fix the issues.
https://www-secure.symantec.com/connect/forums/mr4-causes-network-disconnect-slow-rates
Release notes for Symantec Endpoint Protection 11.0.x and Symantec Network Access Control 11.0.x
http://service1.symantec.com/SUPPORT/ent-security.nsf/docid_p/2007121216360648

IPv6 and Network Protection affects performance on Windows Vista virtual machines
Fix ID
: 1545253
Symptom: On virtual machines running Windows Vista, copying large files to network shares might take longer when Symantec Endpoint Protection NTP (Network Protection) is enabled.
Solution: For full details see readme_sep.txt section titled "IPv6 and Network Protection affects performance on Windows VISTA virtual machines".

 

Please don't forget to mark your thread solved with whatever answer helped you : ) Rafeeq

Thomas K's picture
18
Nov
2009
1 Vote +1
Login to vote

What version of SEP are you

What version of SEP are you running? There was a fix in MR4 MP2 that addressed network share issues when a "Block USB" policy was in place.

http://service1.symantec.com/support/ent-security....

Fix ID: 1475460

VDOR's picture
18
Nov
2009
0 Votes 0
Login to vote

The clients are on version

The clients are on version 11.0.1000.1375

Would they be affected by this?

Thomas K's picture
18
Nov
2009
0 Votes 0
Login to vote

Yes, there are many issues

Yes, there are many issues that have been addressed from that early build. Upgrading to RU5 should address your issue.

Thomas

Rafeeq's picture
18
Nov
2009
2 Votes +2
Login to vote

Hi

As I mentioned lot of issues are fixed in latest version
UPgrading to latest version should fix all the issues.

Obtaining an upgrade or update for Symantec Endpoint Protection 11.x or Symantec Network Access Control 11.x
http://service1.symantec.com/SUPPORT/ent-security.nsf/docid/2007121216494948

Please don't forget to mark your thread solved with whatever answer helped you : ) Rafeeq

VDOR's picture
18
Nov
2009
0 Votes 0
Login to vote

How do I go about pushing out

So based on that link...do I download the upgrade on every single client or simply on the management server?

VDOR's picture
18
Nov
2009
1 Vote +1
Login to vote

I'm at the file download

I'm at the file download page...Endpoint is on two separate CDs. Do I have to reinstall the entire product? Why can't LiveUpdate just update each of the clients?

Vikram Kumar-SAV to SEP's picture
18
Nov
2009
2 Votes +2
Login to vote

 You need to download CD1.

 You need to download CD1. Liveupdate does download the Updated Client Versions but that can only upgrade the clients for upgrading SEPM you will have to Download the CD1.

Anyways i don't think 11.0.1000.xx even downloads the Packages.So you will have to upgrade to latest version for new features and less troubles.

VDOR's picture
18
Nov
2009
0 Votes 0
Login to vote

That's a ridiculous upgrade

That's a ridiculous upgrade process. This product just gets better and better.

I will go through the upgrade and see if that fixes the problem, thanks for your help thus far.

teiva-boy's picture
18
Nov
2009
1 Vote +1
Login to vote

When you upgrade the

When you upgrade the management server, the server can push out new packages to the clients and upgrade them.

You should not have to touch the clients individually.

The upgrade process is rather simple.

download CD1
unzip
stop SEPM services
run setup on SEPM
Verify your console is working and clients are still managable
push out new clients via upgrade wizard in console to test group
test
deploy in small batches after issues are ironed out...

Easy as pie...  In a man'tastic baking sort of way.


There is an online portal, save yourself the long hold times. Create ticket online, then call in with ticket # in hand :-) http://mysupport.symantec.com "We backup data to restore, we don't backup data just to back it up."

Vikram Kumar-SAV to SEP's picture
18
Nov
2009
1 Vote +1
Login to vote

 It will definitely fix most

 It will definitely fix most of your issues that you are facing and even the issues that you might be facing aren't aware of it yet...

SEP is really becoming better and Better ( in good sense )

Just have a look at the release notes and you will get a Idea
http://service1.symantec.com/SUPPORT/ent-security.nsf/docid/2007121216360648

VDOR's picture
18
Nov
2009
0 Votes 0
Login to vote

It might be getting better

It might be getting better but it's still not a quality product if this is the upgrade process.

Windows can go from Windows without any SPs to Windows SP3 simply using Windows Update.

Linux has yum update.

Endpoint Protection requires downloading entirely new media and installing from that and then to have updates pushed out to clients.

I'm thankful for everybody's help with this problem and I sincerely hope it fixed the probelm we've been experiencing. However, this product as a whole isn't the type of quality I would expect for a product that we have invested thousands upon thousands of dollars in.

teiva-boy's picture
18
Nov
2009
0 Votes 0
Login to vote

 MR3 introduced the clients

 MR3 introduced the clients self updating themselves.  But the management server ALWAYS is updated manually.  Would you want your server to autoupdate a major version?  I hope not.

Dont compare WIndows that has been around much longer with something like SEP that is only 2yrs old.  

The upgrade process is the same for many other vendors as well.

There is an online portal, save yourself the long hold times. Create ticket online, then call in with ticket # in hand :-) http://mysupport.symantec.com "We backup data to restore, we don't backup data just to back it up."

ShadowsPapa's picture
18
Nov
2009
1 Vote +1
Login to vote

Interesting, I find the

Interesting, I find the upgrade process actually pretty good and much more reliable that SMS or SCCM as it is now! We're lucky to get 80-90% with SCCM, we hit at least 98% with SEP!
I upgrade the servers, assign packages and within a couple of days, have them updated..............
Frankly, it's one of my favorite things about the product.

Vikram Kumar-SAV to SEP's picture
18
Nov
2009
0 Votes 0
Login to vote

From what version you are

From what version you are using now you cannot compare to SEP what it is now.Its completely different just the colour and name is the same :-)

 

VDOR's picture
18
Nov
2009
0 Votes 0
Login to vote

Alright, well heres to hoping

Alright, well heres to hoping all of the issues we have been experiencing will be resolved with this update!

Does this mean that I can use Network Threat Protection again as well? We had to have that completely disabled or our DHCP servers wouldn't work and our backup time went from 12 hours to 36 hours.

VDOR's picture
18
Nov
2009
0 Votes 0
Login to vote

Now I'm getting the following

Now I'm getting the following err:

"You cannot log on to the console because the server is not synchronized with the database. Upgrade the server, and then log on to the console."

But upgrading the server is what caused this to begin with...

I'll just completely uninstall it and then reinstall it.

Vikram Kumar-SAV to SEP's picture
18
Nov
2009
1 Vote +1
Login to vote

 Yes..Of-Course with the

 Yes..Of-Course with the Latest version too many firewall Issues have been fixed like Wireless,DHCP and many.

Vikram Kumar-SAV to SEP's picture
18
Nov
2009
1 Vote +1
Login to vote

 run upgrade.bat from

 run upgrade.bat from \program files\symantec\symantec......manager\bin

ShadowsPapa's picture
18
Nov
2009
0 Votes 0
Login to vote

Didn't know that

Didn't know that existed................

teiva-boy's picture
18
Nov
2009
0 Votes 0
Login to vote

 MR3 fixed a lot of that, MR4

 MR3 fixed a lot of that, MR4 MP2 even more so.  RU5 is the latest...  Between MR2 and MR3 was HUGE, almost a brand new product yet is was just a service pack.

That said, for servers it's hit or miss.  In some cases you want NTP.  In others, only AV is installed.  

Or in some cases, you want NTP, but you essentially withdraw the FW policy from those servers, or create a single blank rule with any<->any allowed.


There is an online portal, save yourself the long hold times. Create ticket online, then call in with ticket # in hand :-) http://mysupport.symantec.com "We backup data to restore, we don't backup data just to back it up."

ShadowsPapa's picture
18
Nov
2009
1 Vote +1
Login to vote

I have the AV and NTP

I have the AV and NTP installed on all servers............ we've never had to change from the default policies. DHCP just plain works. Even on the DCs, they are running the SEP firewall.

VDOR's picture
18
Nov
2009
0 Votes 0
Login to vote

Upgrade.bat fixed the

Upgrade.bat fixed the syncrhonization problem, thank you.

I will say this...the support forums here have gotten a lot better.

I've been working with SAV/Endpoint and Veritas/BE for a long time and it wasn't always like this.

I remember when installing the SEP Management Console was done on port 80 by default and changing it was a ridiculous process. Glad to see this has been fixed as well.

Vikram Kumar-SAV to SEP's picture
18
Nov
2009
0 Votes 0
Login to vote

 This is the best place to

 This is the best place to share and Gain Knowledge mainly on SEP...

VDOR's picture
18
Nov
2009
0 Votes 0
Login to vote

This does appear to have

This does appear to have resolved the issue.

This thread can be closed. Thanks for your help everybody.

teiva-boy's picture
18
Nov
2009
0 Votes 0
Login to vote

Could you post some feedback

Could you post some feedback on what you noticed after the upgrade?

How much of an improvement did you see with the upgrade and such? 

There is an online portal, save yourself the long hold times. Create ticket online, then call in with ticket # in hand :-) http://mysupport.symantec.com "We backup data to restore, we don't backup data just to back it up."

VDOR's picture
18
Nov
2009
0 Votes 0
Login to vote

The problems when opening and

The problems when opening and saving files located on the network appear to have gone away entirely like you guys said it would.

There is still a lot to be analyzed and there are now new problems I am facing such as the clients saying that the definitions for PTP are old even though they are brand new. (I have created a separate thread for this)

Additionally, on a couple of the clients SecLU.exe is detected as a threat even though it is part of the SEP solution.

The problem that prompted this has been solved the there are now new problems for me to solve before everything will be good to go.