Endpoint Protection

 View Only
  • 1.  Endpoint Preventing profiles from being unloaded on terminal server

    Posted Apr 16, 2009 11:31 PM
    Hi All,

    Running Windows 2003 x64 Terminal server. Have the latest (at time of writing) Endpoint Security installed. I am getting this in my eventlog:
    
    Event Type: Information
    Event Source: UPHClean
    Event Category: None
    Event ID: 1401
    Date: 4/17/2009
    Time: 3:25:33 PM
    User: MEDICALERT\Administrator
    Computer: TSVR-01
    Description:
    The following handles in user profile hive MEDICALERT\Administrator (S-1-5-21-1482476501-854245398-725345543-500) have been remapped because they were preventing the profile from unloading successfully:
    
    Rtvscan.exe (2012)
    HKCU\Software\Symantec\Symantec Endpoint Protection\AV\Custom Tasks (0x308)
    HKCU\Software\Symantec\Symantec Endpoint Protection\AV\Custom Tasks\Temporary Quick Scan Options {63D4262E-25D6-45D7-9F97-871FDBB19E81} (0x8e8)
    HKCU\Software\Symantec\Symantec Endpoint Protection\AV\Custom Tasks\420843B0-10FA-47E4-B970-CA677A6C0ADD (0x964)
    HKCU\Software\Symantec\Symantec Endpoint Protection\AV\Custom Tasks\420843B0-10FA-47E4-B970-CA677A6C0ADD (0xa28)

    Now. I am using the Beta of uphclean for 64bit. Anyway, whatever user, rtvscan seems to be locking the file. Any ideas?


  • 2.  RE: Endpoint Preventing profiles from being unloaded on terminal server

    Posted Apr 17, 2009 12:28 AM
    Hi,

    Try to disable NTP on this machine and check the status.

    I hope you are using SEP MR4MP1a as this is the latest  build.

    Such issues are been resolved in this build. Check your full version please.

    Rgrds,
    SAM


  • 3.  RE: Endpoint Preventing profiles from being unloaded on terminal server



  • 4.  RE: Endpoint Preventing profiles from being unloaded on terminal server

    Posted Apr 17, 2009 12:42 AM
    I am using the beta build of 2.0. The readme does not help.