Endpoint Protection

Hello, I have a server that is Windows 2003 Server, it is a 32 Bit Operating System. This machine ONCE had, SSC, Quarantine and SAV on it. I cleared those off a while back and I was able to install SEP version 11. This was the first time SEP was installed. I began to notice issues with it, like it wasn't updating or it was very slow. I removed SEP 11 manually, I also used CleanWipe and NoNav. I was so desperate that I also risked going into the registry using the manual solution. I have created all sorts of packages for it and nothing worked. I have tried a local AND remote install with differnt features within the package, I also tried where I did not add Symantec EP to the start menu. I ran MWB scans, checked for disk space and made sure all services were in tact.

When SEP is installed, it looks like it installs perfectly, THEN what happens is all of the temp files are gone and what should be a considerable folder in the program files is reduced to a little under 7MB, symantec adds folders and registry entries but the program is totally useless because there is practically NO content. I have tried to install a managed and unmanged client. I tried a direct install which also failed. I CAN install other programs such as MalWarebytes.

This is the first machine that this has happend on, I have NEVER ever seen this happen on ANY version before the most recent one. I have a case open with Symantec and even they are looking at it and escalating it. I got so desperate that I resorted to re install SAV on this server, I didn't like this option but at least it worked. If I can remember more I will add more of what I have tried to get it to work. The reason I bring this up again is because NOW this has happened on a client PC.

To sum up, I install SEP 12.1.2015.2015 and it looks perfect, and add ALL of the files, and looks like a nice legitimate program, then out of nowhere it rolls back to almost nothing and leaves little conent which is not even useful. I can't be the only person this has happened to. I am of the mind that this issue is specific to this version 12.1.2015.2015.

The installation of SAV was sucessful, SEP doesn't seem to want to have anything to do with the system. There is 1GB RAM on this system.

I'd open a support case. Personally, haven't seen this or experienced with 12.1.2 yet but something ain't right...

Support case is open, has been for weeks, someone else HAD to have come across this in the past. This IS specific to SEP, not the OS, otherwise SAV would not have worked.

Does this happen immediately?

If I remember right, SEP_INST.log didn't show anything?

If it is not immediate, maybe you can enable smc debugging to see if it shows anything:

How to debug the Symantec Endpoint Protection client

What is support have you doing?

Right now, SEP had me run PROCMON and some other utility, they are examining that. I think for now I will just leave it with SAV until the next version of SEP comes out.

Due some time this March last I saw.

I'm always patient zero for some reason. Happened before, but nothing like this.

I also have three machines in one site, that look like they were rolled back and the install failed. When  I go to the machines, the program looks perfect and is up to date.

Does it show up as normal in add/remove programs?

The fact that this is also happening now on a client's PC indicates to me, that this has NOTHING to do with residual installations of SSC, SAV, AMS or Q-Server.

No, never gets the chance to make it there.

Well...I'm stumped! But I would need to see the procmon logs or some sort of logging to even begin troubleshooting. Perhaps you can use a progam like regshot to take a registry/file snapshot than try the install than take another snapshot and compare the diffs.

Saw this and thought it would break me free of this bond but it was not meant to be.

http://www.symantec.com/business/support/index?page=content&id=TECH104525

From '09, maybe there is a newer one from Symantec somewhere. Check with support on your current case.

This is specific to 2015 2015 Stewie. I just installed 11.x NO PROBLEM!!!!!

WHAT THE DUECE?!?!

What the deuce is right...have you tried talking nicely to SEP and asking it to install correctly

Support get back to you?

Maybe you could PM your case number to one of the Sym guys on here (SebastianZ, Mithun, or Chetan) and they can take a look and see what's going on.

I have a nice patient fellow who I have been working on. I e mail him all of my findings. I am of the mind that this is a bug in 2015 2015

OK, this is getting really weird now. Let me post a couple of screen shots to see what you think.

From the Client itself it says

11.whatever.

From the SEPM General Tab,

Deployment Target version 12.1.2015.2015
Deployment running Version 12.1.1101.401

From the Clients tab in SEPM
Client Software Version
12.1.2015 2015

I feel like Mark Wahlbergh in the movie "The Happening"

WHAT'S GOING ON?!?!?!

This all pertains to the SAME MACHINE.

So the client says it is running 11.x, the SEPM says it is running 12.1 and it wants to deploy 12.1.2? I get that right?

Correct-O-mundo!!! Ayyyyyyy!!!!!

I am bewildered as to why no one from Symantec is looking at this post. I would say I have found a MAJOR bug in 2015 2015 and it really should be looked at carefully.

Whatever this issue is, Symantec needs to release, a patch, update or hotfix.

I am of the mind that this and the GUP updating issue I had are BOTH Version specific. I have an 11.x client in that site and it never had an issue with updates.