Endpoint Protection

I have a major problem with one of the SEP manager and clients connected to that machine. All of the clients are not communicating with server. I examined one of the clients. The error on the client side is Error 109: "The request was in a format that the server did not expect". I was instructed to use Symantec Endpoint Protection Support Tool. However, it DOES not show the cause of the problem. Only error reported is "Local Security Policy's Network access: Sharing and security model for local accounts is set to: Guest only - local users authenticate as Guest.", witch i suppose is irrelevant in this case. (This client machine is part of domain network, i can authorize with alternate credential). All other tests passed successfully, including SEPManager communication tests, where the answer to request on 8014 port is http code 200.

In act of desperation, i uninnstalled client, and installed it again. This operation did not change the situation. I need assist to find out, what is the cause of the problem and solve it permanently.
Any ideas?

Thanks in advance and sorry for my english.

Hello,

What version of SEP are you running?

What OS are you running on the SEPM server and SEP clients??

Did you check this Article:

Error 109 The request was in a format that the server did not expect

http://www.symantec.com/docs/TECH93024

SEP version is 12.1.1101.401 RU1 MP1.

Clients are mainly Windows XP Pro or Home. Sep Manager is running on Windows Server 2003 Standard.

All 32bit machines.

Of course i did check that article.

Does this affect the SEP Client installed locally on the SEPM as well?

As you've already run the SEP Support Tool to no benefit, can you run the below test:

http://www.symantec.com/docs/TECH102682

And also post some of the sylink logs please?

http://www.symantec.com/docs/TECH104758

Further information about your environment would also be helpful (proxy, client distribution, etc).

Finally, if this is an urgent issue, I'd recommend logging a case with Symantec Support directly:

http://www.symantec.com/support/techsupp_contact_phone.jsp

If you have already Symantec log, please contact the Symantec Support if the issue is critical.

Have you tried already replacing the communications settings on clients?

Are the SEP clients in same version as the SEPM?

t the moment it affects all symantec installations.

Communication on port 8014 is not blocked, test with http://192.168.0.92:8014/secars/secars.dll?hello,secars finished sucessfully with status OK.

Below there is sylink log with bad request error.

02/04 08:04:19.168 [3120] SyLinkCreateConfig => Created instance: 01DC1140
02/04 08:04:19.168 [3120] Importing ConfigObject: 01DFF298 into: 01DC1140
02/04 08:04:19.168 [3120] ************CSN=64197
02/04 08:04:19.168 [3120] <GetLicenseInfo>Querying the server for license information
02/04 08:04:19.168 [3120] <SendUrlAndReceiveResponse:>http://192.168.0.92:8014/secars/secars.dll?h=159C290CE...very long hash number..
02/04 08:04:19.168 [3120] 8:4:19=>Send HTTP REQUEST
02/04 08:04:19.200 [3120] 8:4:19=>HTTP REQUEST sent
02/04 08:04:19.200 [3120] <SendUrlAndReceiveResponse:>SMS return=400
02/04 08:04:19.200 [3120] <ParseHTTPStatusCode:>400=>400 Bad Request
02/04 08:04:19.200 [3120] <PerformLicenseCheck>Error getting the license information (31)
02/04 08:04:19.200 [3120] SyLinkDeleteConfig => Deleting instance: 01DC1140
02/04 08:04:19.200 [3120] The client does not have a valid license; next license check: 60 minutes
02/04 08:05:19.313 [3120] <CSyLink::mfn_DownloadNow()>
02/04 08:05:19.313 [3120] </CSyLink::mfn_DownloadNow()>
02/04 08:06:21.628 [3120] <CSyLink::mfn_DownloadNow()>
02/04 08:06:21.628 [3120] </CSyLink::mfn_DownloadNow()>
02/04 08:07:21.741 [3120] <CSyLink::mfn_DownloadNow()>

If it is all the clients on that particular SEP then the problem is with SEPM..kindly check the the logs on the SEPM scm-server0.logs and exsecars.log ..apart from that kindly check with your AD Admins if any policy was pushed on those clients.

You mentioned "a major problem with one of the SEP manager", which suggests you have multiple SEPMs, perhaps in a replication scenario. I found this, specific to the build you are using:

Symantec Endpoint Protection (SEP) clients fail to communicate after a new Symantec Endpoint Protection Manager (SEPM) replication partner is configured

It's not quite the same error message but I thought I'd bring it to your attention.

sandra

Yes, we have 6 locations connected in VPN network over internet. Each location has SEP Manager configured in replication scenario.

I'll check server logs right away.

I have access to these files. What particular information sould i be looking for? I don't see any errors.

I made a support case. I don't know the reason of that situation, however, at least i have a solution. Each SEP installation has sylinkdrop.exe that allows to replace communication parameters file silently. I made a batch file to do that remotly by file transfer and telnet *(radmin remote managment).

It allows to made changes on WIndows XP PRO/Home on newly installed SEP instances and upgraded from SAV.

Unfortunatly in my case sylinkreplacer couldn't do the job.

@echo off
cd "C:\Program Files\Symantec\Symantec Endpoint Protection\12.1.1101.401.105\Bin"
SylinkDrop.exe -silent -p secretpassword c:\temp\sylink.xml
smc.exe -start
cd c:\
cd "C:\Program Files\Symantec AntiVirus\12.1.1101.401.105\Bin"
SylinkDrop.exe -silent -p secretpassword c:\temp\sylink.xml
smc.exe -start