Video Screencast Help
Symantec Appoints Michael A. Brown CEO. Learn more.

Finding unmnaged clients

Created: 06 Apr 2008 • Updated: 21 May 2010 | 16 comments
This issue has been solved. See solution.
When I attempt to use the console to "Find Unmanaged Clients", after inputting the IP range (or machine name, or single IP address - it doesn't matter what I use) and the logon credentials, I get an errors stating that "The parameters passed to NST are invalid."
 
Has anyone run into this before?

Comments 16 CommentsJump to latest comment

Rich Conboy 2's picture
Anyone?  Anything at all???
 
Symantec people?????  Hello????
Sandeep Cheema's picture
Am not too sure  but I suspect this could be caused by the non- alpha character(such as $) , that is used to log into the SEPM.
 
To verify, enable the fine logging in conf.properties and look in scm-server-0.log for references to "invalid parameter"
 
In case you would'nt like all the troubleshooting, try resetting the password to one without alpha numeric with resetpass.bat and see what happens.
 
 
 

De facto when AV does something, it starts jumping up and down, waving its arms, and shouting...

"Hey!  I found a virus!  Look at me!  I'm soooo goooood!"

Sandeep Cheema's picture
Forgot this :
 

Advanced logging for the Symantec Endpoint Protection Manager console can be enabled by:

1. Stop the SEPM service

2. Add the line "scm.log.loglevel=fine" (no quotes) to the bottom of the file

C:\Program Files\Symantec\Symantec Endpoint Protection Manager\tomcat\etc\conf.properties

then save.

3. Restart the SEPM service, then generate the error again.

4. Remove the extra line added in step 1, then save.

5. Detailed log files will now be saved in the folder

C:\Program Files\Symantec\Symantec Endpoint Protection Manager\tomcat\logs\



Message Edited by Sandeep_Cheema on 04-09-2008 03:20 PM

De facto when AV does something, it starts jumping up and down, waving its arms, and shouting...

"Hey!  I found a virus!  Look at me!  I'm soooo goooood!"

Nayelli Tena's picture

Does anybody know how to solve this problem??? when i tried to find unmanaged clients it sends me the same error message "The parameters passed to NST are invalid". I reset the admin password with no alpha numeric character, and the problem persists...

Paul Murgatroyd's picture
I asked the engineers about this and here is the response:
 

Hi,

 

SEPM uses NST (network searching tool) to find the unmanaged hosts. In “Find Unmanaged Computers” dialog, SEPM will pass a bunch of parameters to NST to do the search. The parameters are IP address range, login user name, password, domain/workgroup name, etc. The error means that one or more of these parameters are not valid to NST.

 

To find out why they are invalid, just turn the debug level to FINE, and restart SEPM and redo the same search. Then, from scm-server-0.log file, it will tell which parameter is not valid.

 

so, if you can enable logging as per Sandeep's post, then try again we should be able to work out why its failing.

Paul Murgatroyd
Principal Product Manager, Symantec Endpoint Protection
Endpoint twitter feed: http://twitter.com/symc_endpoint

Rich Conboy 2's picture
Thanks for the reply a full month after I posted the question.  No worries....we removed the incredible piece of garbage that is Symantec Endpoint Protection weeks ago.
 
In all my years in the industry, I've never seen a worse software package than SEP.   Not only does most of it's function work only sporadically (if it works at all), it is, without question, the least user intuative application I've ever seen.  Whoever designed that interface and workflow should be fired. It's an absolute joke, and if I thought I had a chance of getting one, I'd demand a refund from Symantec.
 
Here's an idea for the next product meeting, Paul.  Instead of building an application that tries to do 10 seperate things half-assed, try building an application that does one thing that actually works.
Paul Murgatroyd's picture
thanks for the comments, I posted the information as the thread was revived by another forum member.  Sandeep already provided all the instructions needed to troubleshoot and work out the issue, just two days after your initial post.

Paul Murgatroyd
Principal Product Manager, Symantec Endpoint Protection
Endpoint twitter feed: http://twitter.com/symc_endpoint

Kit Fisto's picture
For some reason, I found that there is a file called SearchUnagentedHost-1.log in C:\Program Files\Symantec\Symantec Endpoint Protection Manager\tomcat\logs.
 
I renamed that file to .old and restarted the SEPM service.
 
The error of NST parameters has gone! (And a new SearchUnagentedHost-1.log was created).
 
Hope this helps.
 
Regards,
 
                            ---Carlos.
CEZAR's picture

I have same problem here. I tryed to enable debug as Sandeep suggested and when I add the line scm.log.loglevel=fine and tryed to reproduce the problem, the problem did not occour. Than, I removed the line and tryed to scan again and the problem happened again. What adding or removing the line above interferes on the scanning unmanaged clients?

brav's picture

I've just upgraded to MR3 and I now receive the same error.

 

when looking at the logs I see the following :

 

2008-09-24 15:33:39.073 INFO: ProcessManager>> Registered the Process nst.exe2008-09-24 15:33:39.089 INFO: SearchUnagentedHost>> launchNST/Parameter of NST: [-ngbblw1rmks2j-i1000-c1-d%domain%-u%username%-p********-l-2147483648-t10-aC:\Program Files\Symantec\Symantec Endpoint Protection Manager\tomcat\bin\auditparams.txt-s0]2008-09-24 15:33:39.120 INFO: SearchUnagentedHost>> launchNST: NST log line -> [SEVERE: Log level (-l) is less than 1]2008-09-24 15:33:39.120 INFO: SearchUnagentedHost>> launchNST: NST log line -> [SEVERE: NST terminating early because of problems in input parameters.]2008-09-24 15:33:39.120 INFO: SearchUnagentedHost>> launchNST: NST last finish line (\u0002) -> []2008-09-24 15:33:39.120 INFO: SearchUnagentedHost>> launchNST: <<<<<<<<< out of while loop:true2008-09-24 15:33:39.120 WARNING: SearchUnagentedHost>> launchNST: NST.EXE terminates abnormally. Return code is 12008-09-24 15:33:39.120 INFO: SearchUnagentedHost>> stopProcess: NST exits normally.2008-09-24 15:33:39.183 INFO: SearchUnagentedHost>> stopProcess: Close NST process' outputstream.2008-09-24 15:33:39.183 INFO: SearchUnagentedHost>> stopProcess: Close BufferReader.2008-09-24 15:33:39.183 INFO: ProcessManager>> Unregistered the Process nst.exe2008-09-24 15:33:39.183 INFO: SearchUnagentedHost>> doRequest: The search finishes.2008-09-24 15:33:39.714 INFO: PackageTask.publishGroup(): cmd= "C:\Program Files\Symantec\Symantec Endpoint Protection Manager\tomcat\bin\sempub.exe" "-group" "C:\Program Files\Symantec\Symantec Endpoint Protection Manager\data\outbox\agent\A0BA521E86EF802F004949EC4493AE35" "09E4918583F3037FF2C8F6728E614C3C" "00CF78E386EF802F00DFEFE1F8BA7E79" "998CF1BF86EF802F006E20602BE27C9B" "80" "C:\Program Files\Symantec\Symantec Endpoint Protection Manager"2008-09-24 15:33:40.386 INFO: PackageTask.publishGroup(): returnCode = 0(Unknown Error Code) errBuf = success2008-09-24 15:33:40.386 INFO: PackageTask.publishGroup(): success2008-09-24 15:33:41.714 INFO: PackageTask.publishGroup(): cmd= "C:\Program Files\Symantec\Symantec Endpoint Protection Manager\tomcat\bin\sempub.exe" "-group" "C:\Program Files\Symantec\Symantec Endpoint Protection Manager\data\outbox\agent\92F871CD86EF802F01A5F9C09CD72712" "09E4918583F3037FF2C8F6728E614C3C" "00CF78E386EF802F00DFEFE1F8BA7E79" "998CF1BF86EF802F006E20602BE27C9B" "80" "C:\Program Files\Symantec\Symantec Endpoint Protection Manager"2008-09-24 15:33:41.823 INFO: LoginHandler->doLogin: version from database: 11.0.1.02008-09-24 15:33:41.823 INFO: LoginHandler->doLogin: version from server: 11.0.1.02008-09-24 15:33:41.839 INFO: LoginHandler->doLogin: version from template: 11.0.1.0

 

Doesn't tell me what exactly the error is .. The last time I used this was 3 weeks ago , same parameters ( except computername ) and it worked fine . 

 

The only other thing that has changed on our network since that time is that we have a new proxy server ( address changed in SEPM ) but it does have Microsoft ISA Server 2006 installed now. Would this create any issues ?

 

m00

Uffehbg's picture

We have the same problem.

Were is the solution for this?

 Tried deleting the log but it did not help.

 

David T. Kong's picture

I just encountered this error on one of my SEP manager after upgrading to MR3.

 

Since I have more than one SEP managers in my environment, I was able to compare the difference between the few (conf.properties) file that is located under (\Program Files\Symantec\Symantec Endpoint Protection Manager\tomcat\etc) directory.

 

The only difference is that the manager with the error "The parameters passed to NST are invalid" contains this extra line: scm.log.loglevel=all

 

I was able to fix the problem by:

  • Stopping the SEP manager service
  • Deleted this extra line scm.log.loglevel=all from the conf.properties
  • Start the SEP manager service
Paul Deed's picture

I had the same error. Found the error in the log below with my log level set to 'ALL'. I was going to try it with log level of 'FINE' until i saw the post from Kit Fisto, renaming that file and restarting SEPM service worked for me.

 

Thanks Kit Fisto!

 

-l -2147483648
-t 10
-a D:\Program Files\Symantec\Symantec Endpoint Protection Manager\tomcat\bin\auditparams.txt
-s 0

]
2008-11-11 09:13:06.080 INFO: SearchUnagentedHost>> launchNST: NST log line -> [ SEVERE: Log level (-l) is less than 1]
2008-11-11 09:13:06.080 INFO: SearchUnagentedHost>> launchNST: NST log line -> [ SEVERE: NST terminating early because of problems in input parameters.]
2008-11-11 09:13:06.080 INFO: SearchUnagentedHost>> launchNST: NST last finish line (\u0002) -> []
2008-11-11 09:13:06.080 INFO: SearchUnagentedHost>> launchNST: <<<<<<<<< out of while loop:true
2008-11-11 09:13:06.080 WARNING: SearchUnagentedHost>> launchNST: NST.EXE terminates abnormally. Return code is 1
2008-11-11 09:13:06.095 INFO: SearchUnagentedHost>> stopProcess: NST exits normally.
2008-11-11 09:13:06.126 INFO: SearchUnagentedHost>> stopProcess: Close NST process' outputstream.
2008-11-11 09:13:06.126 INFO: SearchUnagentedHost>> stopProcess: Close BufferReader.
2008-11-11 09:13:06.126 INFO: ProcessManager>> Unregistered the Process nst.exe
2008-11-11 09:13:06.126 SEVERE: Unknown Exception
java.sql.SQLException: JZ0S2: Statement object has already been closed.