Endpoint Protection Small Business Edition

Since more than 3 weeks or so I can't open the SEP client version 12.1.2015.2015 running on my SBS2011 server.

Selecting right mouse button on the SEP client icon in the right bottom tray, selecting "Open Symantec Endpoint Protection" gives me a popup: Symantec Endpoint Protection cannot open because some Symantec services are stopped. Restart the Symantec services, and then open Symantec Endpoint Protection.

I tried to restart (under all tasks) the service named "Symantec Endpoint Protection" but this is not possible because this option is greyed out. It even states that this already running.

On this SBS2011 also the SEP manager (version 12.1.3001.165) is running (without noticable issues) and as a desperate attempt I tried to push the 1.21.3001.165 client version to the local machine without succes (does not appear). After the deployment of the package, the SBS2011 server asked me to allow displaying the message "Symantec Endpoint Protection had detected that there are pending system changes that require a reboot. Please reboot the system and rerun the installation". However I have rebooted the server serval times without any change in this message/action.

By the way, my remote connection to the SBS2011 is disconnected after a few minutes, have seen this more than once, during reading of a message that SEPM to displayed on my remote screen.

Is anybody familiair with this error message and possible the cure for it? Should this work with the 12.1.2015 version or do I have to update? And if so, how do I do that because that seems to fail?

Have you tried running a repair?

Navigate to HKLM\SYSTEM\CurrentControlSet\ Control\Session Manager

Delete the key called PendingFileRenameOperations

Than try the install again. Do not reboot after deleting otherwise it will come back.

Hello,

This issue has been addressed in the Symantec Endpoint Protection 12.1 RU1 release.

Check this Article:

Unable to open the Symantec Endpoint Protection client interface after migrating to 12.1 on Windows 7 64-bit

http://www.symantec.com/docs/TECH164707

However in your case you are still facing this issue in SEP 12.1 RU2.

On a kind Note: It is recommended to install the Latest version of Symantec Endpoint Protection 12.1 on your machine. Currently, the Latest version is Symantec Endpoint Protection 12.1 RU3

Latest Symantec Endpoint Protection Released - SEP 12.1.RU3

https://www-secure.symantec.com/connect/blogs/latest-symantec-endpoint-protection-released-sep-121ru3

For the issue, "Symantec Endpoint Protection has detected that there are pending system changes that require a reboot"

Open registry and go to 
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Session Manager\
highlight Session Manager on the right hand side delete the value 
PendingFileRenameOperations

Also delete the same value from
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet001\Control\Session Manager\PendingFileRenameOperations

then run the install...without rebooting the PC

Reference:http://www.symantec.com/docs/TECH95608

Mithun-

Customer stated he was running SEP RU2 and his SEPM is RU3!

Please read the original post more carefully before responding

Hi,

Thank you for posting in Symantec community.

I would be glad to answer your query.

You should try to start the SEP client service manually, to restart the service go to:

Start --> Run --> (type) smc -stop (Stop the service)

Start --> Run --> (type) smc -start (Start the service)

If not helped, try to execute SEP 12.1 RU2 package locally on the sytem and check.

Uninstall and reinstall of SEP can be the last option if only single machine is affected.

For other error, follow these steps:

Search for the value PendingFileRenameOperations in
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Session Manager
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet001\Control\Session Manager
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet002\Control\Session Manager

- if found backup the key and remove the value, try to restart the installation

Search for the key RebootRequired
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate\Auto Update\

- if found backup the key and remove it

Search for PendingFileRenameOperations in
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet001\Control\BackupRestore\KeysNotToRestore

If found then delete it and try to send SEP 12.1 RU3 package again.

Hi Cetan,

I've run smc -stop and smc -start from the start-> run box without any difference. No error shown (so not sure if the restart was done correctly). Is there a service that  should stopped and restarted, if  so, which (full) name does this service have? I do not see a service named smc.

The issue is still there so tried to do your next suggestion: start SEP12.1 RU2 (I assume that is the 2015.2015 version because I do not understand  the link between RU2 and versions of SEP  clients?

I know I can deploy this version via the SEPM but in order to install this from a File Explorer window I have to know the location, which I don't know? Where can I find this deployment location from where I should find the installer for the RU2 verison?

Hi,

You can not restart Symantec management client through services.msc, you can do with the help of command prompt only. Start & stop options are grayed out. It's by design.

To redeploy package you can refer the following article.

How do I create a non .exe OR a .msi Install Package for Installing Symantec Endpoint Protection

http://www.symantec.com/docs/TECH96388

Installing Symantec Endpoint Protection clients remotely

http://www.symantec.com/docs/HOWTO59432

You may deploy clients via a weblink and email, remote push, or save a package for later local installation or deployment using third-party tools. Only the remote push is described here, in the following steps:

In the Symantec Endpoint Protection Manager console, click the Home tab at left.

On the Home page, in the Common Tasks menu at upper-right, select Install protection client to computers. The Client Deployment wizard starts.

In the Welcome to the Client Deployment Wizard pane, choose "New Package Deployment" and click Next.

Select the client version, the feature set, the client group and content options, and then click Next.

Click Remote Push, and then click Next.

Locate the computers to receive the client software, and then click >> to add the computers to the list. To browse the network for computers, click Browse Network. To find computers by IP address or computer name, click Search Network, and then click Find Computers. Authenticate with the domain or workgroup if prompted. Note: You can set a timeout value to constrain the amount of time the server applies to a search. Click Next.

Click Send to push the client software to the selected computers. Wait while the client software is pushed to the selected computers.

Click Finish. This means that the Manager's work is done, but the installation has started on the client and is most likely still running on the client computers. The installation takes several minutes to complete. Depending on the client restart settings of the deployed client, you or the computer users may need to restart the client computers.

Confirm the status of the deployed clients in the Clients page of the Manager console.

You have several solid answers above. When you do smc -stop in the Run box, the service that stops is called Symantce Management Client. You can observe that it stops by looking in Services.msc and by the yellow shield disappearing. When you start the service the yellow shild returns (unles you have configured it to not display).

After doing smc -stop and smc -start,  the next thing I would have tried it Going to Add or Remove Programs and doing a repair on SEP.

Please remember to mark the answer that was most helpful to you.

Thanks

I have removed all 3 values PendingFileRenameOperations in the Session Manager keys and did a new push of the 2015.2015 version. Which was (just as before) succesfull. I did not make other changes in the Registry.

Before rebooting the server I also tried to do a repair of the SEP client, which was not succesfull because the system told me that I had to reboot first.

I did that out of office hours tonight and after the restart SEP client version 2015.2015 is running fine and I can open it again (and change settings etc).

So my issue is solved! Thank you all for the suggestions made!

Please don't forget to mark this thread solved for the reply that best helped you. It will be a great benefit to future users searching for a solution to the same issue.

Take care,
Brian

Not sure if I did correctly, but there were several comments that learned me to remove some settings in the registry that was the key to the solution, so I hit all comments stating that solution with a split solution (are now pending?)

Checked status of SEP client  on our server this morning and the same issue is there again! :(

I will try to push the newer version to the server (again) so see if that will keep SEP running. I know now how to (propably) do a succesfull push to the server.

Glad to know issue has resolved.

It takes around 24 hours to reflect split solutions. 

Yes, you can do split solutions.

I allready did, but it is still pending, have to wait 24h.

Reinstalling the 12.1.2015.2015 didn't help, the problem came back within 12 hours.

Yesterday evening I deinstalled the 12.1.2015.2015 version, I rebooted the server and installed the 2.1.3001.165 version and had to reboot again and this version runs up to now without displaying the error.

Hopefully this will stay this way.

Hello,

I appreciate you updating us on the issue.

Please do let us know if the issue reappears in SEP 12.1.3001.165 version.

Regards,

I will, but so far so good (running 2 days without problems)