As about XP machines, they are with Office 2003, so maybe that's why they are not affected.

What components of SEP are insatlled?

On one machine remove IPS and see if that helps

Hi,
If you are using application rule in your n/w for protect SEP agent, so exclude.doc, .xls and docx, .xlsx. These are extension scanning while you save your file in network. more information find attach file.

IPS? Do you mean NTP - Network Threat Protection module? I can try isntalling SEP without it, but i'm guessing SEP Firewall will stop working? Then it is not an option for us.

We are not using Application Control policies because of the issue with newest SEP versions. Some applications which are using shares stop working with that policy turned on. Also this is not an option to exclude those file types. We get lots of them from our clients, don't want to risk.

No IPS is a subcomponet of  NTP .

Just disable it for the timebeing to isolate the issue.

We have seen simliar issues where Auto Protect in RU6 has caused issues, this issue would be fixed in RU6. What i would recomend you to call support and log a case so that we can verify if this is the same issue or a diffrent issue.

I have uninstalled IPS from NTP module on one pc with Vista/Office2007 and user says, that now Excel is not hanging on saving. So, maybe this is indeed IPS fault in Office 2007 case.

I don't believe it is possible at this time to granularly uninstall IPS without uninstalling the firewall.  The drop-down clearly shows "Firewall and Intrusion Prevention".  This is why people who want to use IPS without the firewall must withdraw the firewall policy as opposed to uninstalling.  I do not know if withdrawing the IPS policy will have a similar effect.  (It is not recommended to keep IPS disabled for security reasons.)

Title: 'Best practices regarding Intrusion Prevention System technology'
http://service1.symantec.com/SUPPORT/ent-security....

Is there anything in the user's logs to indicate a firewall rule or a specific IPS detection is what's causing this?

I have not found anything relating to Excel 2007, only this:

Title: 'Modifying/Saving large Microsoft Excel 2003 files onto a network share causes the computer to freeze'
http://service1.symantec.com/SUPPORT/ent-security....

sandra

When your machine freezes...  and you are unable to kill the Excel process locally, from a remote machine...

Open a Command Prompt.

"TASKKILL /S [computer_name] /IM Excel* /F"

Taskkill allows you to terminate a process on a machine, local or remote.  To specify a remote machine "/S [computer_name]".  Specifying a process by name as opposed to PID, /IM [process_name].  /F forces the process to end. 

If it can help you stop rebooting your machines... at least there's that.

TASKKILL is not helping in this situation. I don't remember exactly what output was, but it can't access hanging excel process. The only way is cold reboot of that PC.

We are slowly reinstalling clients to older version. Is there any way to do a downgrade to older version via SEPM? Or maybe with a deployment tool?

Is it happening while saving  ALL Excel files, or just wihile saving  Excel files with macros?????

http://www.symantec.com/connect/forums/cannot-copy-files-using-smb-20-protocol-sep-11-ru6-and-ru6a
http://www.symantec.com/connect/forums/copy-over-network-freeze-when-copying-large-files
http://www.symantec.com/connect/forums/sep-mr6-and-6a-random-issues-filey-copy-network-share

Kill smc.exe -> Excel works again.

rgds, Jyrki

I can't tell for sure. But it looks like it can be files without macros. Just huge files with tons of text information, filters and some formulas. Opening such file doesn't ask about enabling Macros (and we have moderate level set), so i think there is no macros at least in one last file, which caused hangs with RU6a.

I'll suggest to install a Unmanaged Client with all features enabled on 1 machine.

Then review the real time Traffic,Security logs and find out what is getting blocked and where.Then create required Rules to allow them.

If it is related to Network threat Protection then its either firewall or IPS but we need to find out which Firewall rule or which IPS Signature is causing this behavious so that we can modify the rules/action

Disable the  file system auto-protect in SEP Then see if you are able to save.

Killing smc.exe does seem to fix excel for that session, unitl next restart.

Well, i have one machine i can test on (not for a long), and i have few documents in a share and most of the time i'm able to reproduce hangs. What exactly should i look for? And what tool should i use? I have tried to watch smc.exe with Process Monitor while Excel is hanging on save. I see some Buffer Overflow or Name not found errors related to DNSclient or Tcpip\Linkage\Bind registry entries. I don't see anything relevant in Security log. Monitoring traffic? Say with Network Monitor or Wireshark? That would be tons of packets. I need to know what should i look for, what to filter out.

Could you  install ru6 mp1, and see??

as I wrote before, look those feeds. This is same problem like many users have with file copying.
SEP versions RU6, RU6a and RU6MP1 have some bug at ntp component.
I guess, target file share resides at Windows 2008 srv or Vista wks.
Everything works if files share is located in Windows 2003, 2008R2 server or Windows 7.
Just wonder where is Symantec QA? Three months already gone with this mess.

Rgds, Jyrki

I have tried the MP1, it behaves the same. Share is on Windows 2008 x64 (not R2).

if you save excel sheet newer xlsx format, i think it success. Size is much smaller.
We have also copying problem, did you try that?
I made many manual downgrade from RU6 to RU5...

Rgds. Jyrki

We don't want to switch to xlsx yet as we have many computers with 2003 version and also clients with older systems. We don't want our 2007 users to add unsupported features to their documents, so we force usage of xls.

Helped fix my SAMBA issues on Windows 7 and Windows Vista.

**********************
Control Panel - Administrative Tools - Local Security Policy

Local Policies - Security Options

Network security: LAN Manager authentication level
Send LM & NTLM responses

Minimum session security for NTLM SSP
Disable Require 128-bit encryption

Another observation. On many computers while doing shutdown End now message is thrown with ccApp being a cause. This is a part of SEP. If user doesn't press End now, it won't shutdown usually. I see this window even on my machine, though i have more RAM than average users. Slowly downgrading almost everyone. Will think double twice before upgrading SEP again.

The issue is targetted to be fixed in next release 11.0_RU7. We do not have information about when it will be released.
http://www.symantec.com/connect/forums/cannot-copy-files-using-smb-20-protocol-sep-11-ru6-and-ru6a

I think twice before buy new maintenance after license expired. I remember clearly MR4MP1 ntp bug beginning of year 2009:
http://www.symantec.com/connect/forums/maintenance-release-4-maintenance-pack-1-mr4-mp1

Rgds, Jyrki