Endpoint Protection

I have two questions regarding Installing EP protection version 11.06 on a Windows XP SP3 client.    When I go to the EP manager to search for an unmanaged client, I have one particular client which comes up as "unknown computer".    Now, on the client computer, I had completely uninstalled SAV 10x and LiveUpdate.   I restarted the computer.   Also, the Firewall is OFF on the client.    What am I missing?   Is there a setting or configuration that I should be aware of that I am missing? 

Second question, how do I get my hands on the CleanWipe tool?  I understand from reading other posts that I need to contact Symantec Support and I must have a Case Number.    Ok, so I had submitted a question which I have a case number.   What next?    I guess this CleanWipe tool is very powerful tool.    The Support person will answer my question but how do I get my hands on the Tool?

Thanks,

Phil

Phil,

This may answer your first question:

Title: '"Find Unmanaged Computers" wizard shows the list of unmanaged computers in the "Unknown Computers" category'
http://service1.symantec.com/SUPPORT/ent-security.nsf/docid/2009081720290348

You could ask the technician on your case for the credentials needed to download Cleanwipe.  It's really intended to be a 'last resort' tool when Add or Remove Programs fails.

sandra

Are you seeing any errors when trying to install the client? Can you collect the install log from the failed client?

Post the SEP_INST.log
from start - run - %temp%\SEP_INST.log
Search for Return Value 3 and post the 10 lines above the return value 3

As for you second question, ask your Tech to provide the tool to you. Only they can give you the cleanwipe tool.

try removing patches from the drive ex: c:\programfiles\symantec\ symantec enpoint or sav folders also from documents and setting>all users>application data

then try installing the client on thy machine

I don't believe there is an issue in installing.  There was only a question about how the unmanaged client is displaying in the "Unknown Computers" window in Find Unmanaged Computers.

sandra

Also delete the Symantec reg key under HKCU and HKLM ---> Software then re-install

you can export the package from the console and run it manually on the client machine,
wrt to clienwipe there is no support for it, use only when  you have no other option

Thanks to all for replying to my post.  I will try the suggestions offered.   

Sandra.G:   I have a question for you.  You said that I can get the CleanWipe tool from a Symantec Tech support person.   What is the response turnaround time for this person to answer my question?    My Case Number is :100716-000834.   Can you check to see if it has been answered yet?   Will this person give my a hard time about providing me with the Tool? 

In regards to the CleanWipe tool, I am well aware of the repercussions of using this tool as a last resort.   I like to have it for the future in case I need to use at any point. 

I will post an update to the suggestions offered. 

That's not an Enterprise (business) Support case number--therefore I do not have access to it.  If this is a Norton support case, they are Consumer (home user) Support for the Norton suite. I'm not even sure they have the information for Cleanwipe.

Enterprise Global Support #:
http://www.symantec.com/business/support/contact_techsupp_static.jsp

sandra

Here is my update to all of you who had made suggestions.   None of the suggestions worked.   I followed them to a tee.   Let me clarify something, I don't have Symantec installed on this particular computer.   I did have SAV 10.2 installed but I had completely uninstalled it.   The only suggestion that I could not try was the post from Cycletech.  

How do I create a package in the Manager but install it on one computer without the package disrupting other successful clients?  I have found another Windows XP client that comes up as "unknown computer" instead of "unmanaged". 

Under Windows XP, aside from the Firewall being turned OFF, there is no other specific configurations and/or settings that has to be in place like turned OFF or ON before you install EP protection? I know that it is basically straight forwared but what happens when the client doesn't want to cooperate with the Manager?  There has to be something in XP that is blocking the connection or preventing the Manager to fully see it? 

So, my case number is for the Enterprise support or it is not?  Do I have to submit a new case with the appropiate support section? 

How do I create a package in the Manager but install it on one computer without the package disrupting other successful clients?  I have found another Windows XP client that comes up as "unknown computer" instead of "unmanaged".

open sepm
admin
install packages
export client install package
save it on any drive
share this folder , install it on two xp machines

2)

Under Windows XP, aside from the Firewall being turned OFF, there is no other specific configurations and/or settings that has to be in place like turned OFF or ON before you install EP protection? I know that it is basically straight forwared but what happens when the client doesn't want to cooperate with the Manager?  There has to be something in XP that is blocking the connection or preventing the Manager to fully see it? 

Firewall should be off ; if not the client will not communicate with the manager, you can create ane exception for port 8014 to communicate if you dont want to turn it off completely
besides that file and printer sharing should be enabled

https://www-secure.symantec.com/connect/forums/how-remote-install-client-pc

No--as I indicated, it is not an Enterprise support case number.

If you have a business support contract you can open a case through MySupport.  You can call the number via the link I provided above to verify support entitlement.

sandra

...and I'm being completely non-sarcastic when I ask, but: have you actually tried deploying to the machine that comes up as 'unknown'? 

sandra

Sandra:  Let's get back to my original question.   Do I have to send a new question to the Enterprise support area in order to get the CleanWipe tool? 

In regards to my issue with the "unknown computer" search under SEP manager, I believe I have figured it out on my own.   I am kinda surprised nobody had thought of this solution or at least as an option.   I had two Windows XP computers which the Manager saw as an "unknown computer".  So what I did was to play around some more with the NIC card settings.   I tested it out on one computer out of the two problem computers.   So, I did a Repair on the Local Area Configuration which clears the Cache, ARP, etc.....  I tested this method on the 2nd computer problem which the Manager saw them as "unmanaged" rather than "unknown".   After that, I was able to install SEP on both Windows XP computers.   

To answer your question, when you try to install SEP on an "unknown computer", a message quickly returns as Failed. 

You might what to pass along my option as a possible solution to the next person who has the same problem or similiar issue like mine.   I will look forward to your answer.

Sorry--I thought my posts were fairly clear on the suggestion that you should open a support case with Enteprise support, in giving you both a link with the global phone numbers for Enteprise tech support as well as the suggestion of opening a case via MySupport (also linked).

Glad to hear the issue's resolved.

Thanks,
sandra

Sandra G.-  Can I have the direct link to Enterprise Support page just so I am not wasting time looking for it. 

Thanks

This page has the phone numbers for business (Enterprise) technical support.  Use the drop-down to choose your country.

http://www.symantec.com/business/support/contact_techsupp_static.jsp

Is this what you meant?

sandra

copy the Sylink.xml from machine  which is connected to SEPM and replace with the machine which is appear as unmanaged machine
before replacing the Sylink.xml file stop the symantec service

by this command in run

smc -stop

replace the Sylink.xml file

smc -start

sylink.xml location
C:\Program Files\Symantec\Symantec Endpoint Protection\

right click on symantec yellow shiled(taskbar near to time and date )and update the policy.

for SAV
http://service1.symantec.com/support/ent-security.nsf/pfdocs/2002031914291648?open

for SEP
http://service1.symantec.com/support/ent-security.nsf/docid/2007073018014248

tip to automated files and registries delete
delete files
create one batch file  filename.bat
del /f /s   (link mentioned files and location just copy paste)

delete registry
create one .reg files or export any regfiles
just put hypen (-) in the beginning of all registries.
http://support.microsoft.com/kb/310516

use excel ;)

Sandra G.:  Thanks for the link.  Now onto another problem with installing SEP on Windows XP computer.  I want to make this painless and easy to figure this one out.  LOL!   I have a Windows XP SP3 computer which the Manager sees it as "unmanaged computer".   Ok, I start the installation but within a few minutes the status comes back as Failed.    The Firewall is OFF, I moved the CAT5 cable off of a Switch and onto a jack, I restarted the computer, File and Print is ON, Disable/Enabled the Local Area Connection, and I used the Repair on the Local Area Connection.   Nothing!  I disjoined/rejoined the domain.  Nothing.   I uninstalled SAV 10.2 and Liveupdate.  Again, nothing.   After all of that, the Manager still sees the computer as "unmanaged", when I search by IP address.   However, when I search by Computer Name, nothing shows up.    Could the Computer name be part of the problem?   I am stumped on this one.  

Second question, after you install SEP on either a Vista or Windows XP, does SEP have it's built in Firewall protection?   Also, does SEP disable Vista's Firewall Service automatically and Windows Defender?   I guess "disabling" it by turning Firewall Service OFF and turning OFF Windows Defender.    Meaning Windows Defender is no longer running in the background and Firewall Service is managed now by SEP.  Actually both would be managed now by SEP.  


Anyone??

Sandra G.:  The link you gave me, Enterprise support is only calling them for support.   They don't have email?  

As I mentioned... :) If you don't want to call, you can open a case via MySupport -- https://mysupport.symantec.com/ .  This is a web-based interaction.  The agent who gets your case may write to you via email, but there is no way to open a case through email.  If you need help setting up MySupport, you will need to call Customer Care (the link for that is on the MySupport page).

sandra

Sandra G.:   Setting up a ticket through Mysupport, will I be able to get the CleanWipe tool from this angle?   All I want is to get this tool.   That's it.   If I can avoid calling Symantec support of any kind, that would be helpful.   Point me to the easiest way to get this tool without going through my hoops.

Open a support case through the online portal, then PM me your case number. I will make sure the tech assigned gets you the Cleanwipe tool.

Thomas

CycleTech:  I will do that.    I have many questions for you regarding the SEP client.  

1.  Does SEP client have a Firewall built-in into the program?
2.  Does SEP client stop or disable Windows Firewall service? OR override it?
3.  Does SEP client stop or disable Windows Defender service and program from running?
4.  If Question 2 and 3 are true, what happens if SEP client DID NOT stop or disable those services?
5.  Same thing as Question 4, what happens if SEP client corrupts the Windows Firewall service from starting and stopping?
6.  Finally, what happens when you install SEP client on a Vista computer, the Deployment Status is successful but in Vista the SEP icon nor program show up? 

I will send you the case number.    Thanks.

Cycletech:   You said, for me to use the online portal to open a new case.   Can you provide me with the link?    Do I have to call?

Cycletech:  I sent you a reply about a week ago.   I haven't heard anything from you.  Can you please respond to my questions.   If you don't have the time, please refer me to an available tech person.

1. Yes and No.  It does have a Firewall, but it needs to be installed.  You can install only AV/AS or other components including Firewall.

2. It does not stop the Windows Client Firewall, this can be done manually or through GPO.

3. Same as 2.

4. If you leave the firewall enabled on Windows, you are going to need to configure ports for communication to the SEPM server.

5. N/A

6. If the installation was successful, the application will show up in [drive letter]:\program files (unless otherwise specified.  There is an option to not show the Shield and Green Dot.  This can be changed.  If it is installed and not there, check the settings in your SEPM.

Hi philip706, I never got a PM from you with a case number.

Answers
1. SEP client does offer a firewall
2. SEP will disable the microsoft FW on install
3. SEP will keep the Windows Defender service from starting due to compatability issues between the two applications.
4. Not sure that is possible
5. Never seen or heard of this happening
6. Does the Vista client show in the SEP manager with a Green status?

http://seer.entsupport.symantec.com/docs/349006.htm

http://service1.symantec.com/support/ent-security.nsf/854fa02b4f5013678825731a007d06af/9e4c1e7528d67210882573b50056df25?OpenDocument

http://seer.entsupport.symantec.com/docs/305173.htm

I provided the link for the web portal to open a case already:

https://mysupport.symantec.com/

Edited to add:  Sorry, I meant to answer these sooner.

1.  Does SEP client have a Firewall built-in into the program?

Yes.  Network Threat Protection includes a firewall component.

2.  Does SEP client stop or disable Windows Firewall service? OR override it?

Disables.  The exception is Windows 7, which hands over management of the firewall to SEP.

Title: 'About Windows Firewall and Symantec Endpoint Protection's NTP'
http://service1.symantec.com/SUPPORT/ent-security.nsf/docid/2009120816110248

3.  Does SEP client stop or disable Windows Defender service and program from running?

Disables.

Title: 'Microsoft Windows Defender service will not start after installing Symantec Endpoint Protection (SEP).'
http://service1.symantec.com/SUPPORT/ent-security.nsf/docid/2007121807485348

4.  If Question 2 and 3 are true, what happens if SEP client DID NOT stop or disable those services?

Communication issues if two firewalls are running concurrently.  Else, see the above document.

5.  Same thing as Question 4, what happens if SEP client corrupts the Windows Firewall service from starting and stopping?

I have never heard of this occurring though I have heard of GPOs forcing the Windows Firewall service back on, causing issues.

6.  Finally, what happens when you install SEP client on a Vista computer, the Deployment Status is successful but in Vista the SEP icon nor program show up?

It usually means that the deployment (i.e. the file copy) was successful but the installation was not.  Troubleshooting at the local computer is recommended.

Title: 'Symantec Endpoint Protection: Preparing computers that run Windows Vista for remote client deployment'
http://service1.symantec.com/SUPPORT/ent-security.nsf/docid/2007091021513648

Hope this helps,
sandra

CycleTech or Sandra G.:

The link that Sandra provided is ok.   However, I don't know what the Technical Case ID nor Support Number is.   I work for a School District which could you look up to see the Support Number for our District?   This is where I am stumped.   I don't know any valid Support numbers to go forward with submitting a Case question to the technical support.    The School district is Bayshore School District in Bayshore NY.    If you can provice me with a validation code or number to I can submit my question. 

Philip

Philip, nothing comes up when I search by your School district name. Can you PM me your full name and business address and I will try searching again.

It would not be under my name.   You can try this name:  Mark Fielbig.   He is my coworker.   The license should be either Bayshore School District or BOCES.    The School District address is: 75 West Perkal Street, Bayshore, NY 11706.

Nothing is coming up with that information. Try calling licensing at 1-800-721-3934 and select option 2. They should be able to help sort this out for you.