Endpoint Protection

Machine client 's installed on win XP sp2, symantec SEP 12.1 RU1

Folder 12.xxx\Data\CmnClnt\ccSubSDK has large size ~2.6GB  (I checked another computer, it's ~10MB). It's the cause that make full disk's capacity

The path is below

(drive):\Documents and Settings\All Users\Application Data\Symantec\Symantec Endpoint Protection\12.1.1000.157.105\Data\CmnClnt\ccSubSDK

I  try to restart service, reboot but it still present

What can I do to decrease capacity of folder?

Thanks.

were these machines found out with threats?can you open a support ticket for this?

Please Contact Symantec Customer Care on this issue..

http://www.symantec.com/support/assistance_care.jsp

Hello,

Could you please try these following steps:

• Purge the Folder: Disable Tamper Protection through Symantec Endpoint Protection client, or at the policy level from the Symantec Endpoint Protection Manager (SEPM.) Manually delete the contents of folder.(Re-enable Tamper Protection when finished) 
   
• Change the Submissions Policy if there is no internet connection: Open the SEPM > Clients Icon > My Company (or parent policy of machine) > External Communication Settings. 
   
• Update Policy

Hope that helps!!

These files are waiting to be submitted to our reputation servers and most likely have accumulated due to the bloodhound false positive this week. If the submission site is not allowed these will not get sent up. This is normally not a issue but with the FP there were a lot of files being sent up.

I would recommend performing the following steps on the group the client is a part of. If inheritance is on you will need to do these steps on the parent group.

Open the SEPM > Clients Icon > My Company (or parent policy of machine) > External Communication Settings

Here in the submissions tab uncheck both of submission checkboxes and let the client get the new policy. This will tell the client it no longer needs to send up reputation data and will purge this folder on its own. On a sidenote I would recommend going through the doc below to make sure that your proxies are allowing reputation data to be sent as this information is very valuable for symantec to make accurate reputation on new files.

http://www.symantec.com/docs/TECH162286

I disable Tamper protection, empty folder and then restart

"SEPM > Clients Icon > My Company (or parent policy of machine) > External Communication Settings"

=> I do not unterstand function of this option, but I will learn more about it later

Thanks to all.

reputation ( Insight) will try to submit the files for reputation check, which are stored in the folder if it is unable to connect to internet for submission.

Had this happen also on a few servers with no direct internet connection, changing the External Communication Settings did address it.

It didn't seem to be limiting itself and caused a low disk space condition, we're going to look into that.