Endpoint Protection

Hi All,

I am currently using SEP on 20+ Servers, and I have one server running the SEPM.
One of the 20 Servers with SEP has got an expired license - For finance purposes I wish to know when this licence specifically expired.

I understand that the SEPM Console allows me to view when the full pack of 20 licences expires, but I cant seem to locate when this licence expired.

Could anyone please advise as to how I would find this information out?

Thanks,
F

You would need to open the slf license file in notepad to view it. It is called sep.slf

Should be located at:

Drive:\ProgramData\Symantec\Symantec Endpoint Protection\CurrentVersion\Data\Config

And you will be looking for lines that contain the following:

<start_date> xxx </start_date>

<end_date> xxx </end_date>

This is the time the license is valid for.

Would this be on the server which contains the SEPM or the Server which has been affected by the expired licence?

Thanks,
F

The machine where the SEP client is installed.

The other thing you could do is run the symhelp tool on the SEPM as it will show license status.

Also from within the SEPM >> Admin page there is a License tab which will show status of the licenses.

Hi Brian,

When opening up the SLF File, it has become apparent that the 'End Date' is in the future, yet the Licence is showing as Expired within SEPM?

Any ideas?

Thanks,
Fraser

Please also note that the client is not showing any 'out of date errors' within the client itself, but as I said above the SEPM is still showing the client as 'Expired' which completely contradicts the SLF File.

Hello,

the SEP clients get the same license you import in the SEPM, hence there's no individual license management for SEP clients; when the license in the SEPM expires, the same will be for all clients at once.

Thus, what you see is not expected, maybe that system did not get the paid license from the SEPM and the trial one expired; we may continue with more complex investigation but most likely a reinstallation of the SEP agent will be resolve the issue.

Hi Beppe,

What I find curious about this whole situation is that under the 'Admin > Licence' Tab [Within SEPM] it's showing our estate as 20 Seats, and 1 Extra seat. As you said above, you would expect them to run out all at the same time, not two to run out, each at seperate times, with the SLF File contradicting the 'expiration' of the licence.

Is there any way to check whether or not they were/are running a trial licence?

Thanks,
F

Please, clarify "it's showing our estate as 20 Seats, and 1 Extra seat" with a screenshot, are you sure we are not talking about overdeployment instead of expiration?

Of course, hide personal data such as license serial numbers, etc.

I'll send some over once I've connected into the SEPM Server.
Screenshots to follow shortly.

See Attached.
Unfortunately I'll need to send attachments one at a time due to an unexpected site error when attempting to attach more than one image.

F

See attached [2nd out of 4]

See attached [3rd out of 4]

See attached [4th out of 4]

Let me know if you want any more screenshots.

Thanks,
F

Now it's clearer...

Symantec allows to buy additional licenses when customer's network grows, the seats sum up but each license has its own expiration date.

I suspect your "20 seats" paid license expired on March, the 8th, 2015 (if it is in American date format) and you currently have a valid license for 1 only seat.

In any case, the last screenshot does not show a system with an expired license, just out-of-date with definitions, most likely for other reasons.

Hi Beppe,

That is surprising.
It's a bit odd how our Licences have expired yet they're still showing up as 'Up-To-Date'.

I cant say I follow with your last comment, so they're being flagged up as 'Expired' but instead they're just out of date? What other reasons are commonly the case?

Thanks,
F

Is there any way I can check the time format from within SEPM?

Thanks,
F

Or would it just take the time from the Server?
*PS this server is based in the UK, which is currently in BST*

Hi,

it seems to me you are too easily assuming that having old AV definitions in a SEP agent is most likely due to an expired license. This assumption is not supported by the screenshots you attached here.

In SEP enterprise edition (EE), an expired paid license does not stop the product to get definitions.

This would happen in the small business edition (SBE), yet after a grace period. More about it in this article:

https://www-secure.symantec.com/connect/forums/cannot-get-sep-clients-communicate-new-sepm-server

Which edition do you have?

A client can be out-of-date for several other reasons such as communication issues, broken definitions, no disk space, etc.

Now, I am also not 100% sure of how to check if that date is in US or UK format but, as you pointed out, if that license is expired (and you have a SBE) you should have 20 clients out-of-date. As result, my current understanding of the whole situation is that the 20 seats license is close to expire (or expired?) but that system is not getting the latest definitions for different reasons than licensing. In that SEP agent you should also get some warning specifically about the license status, if that's the issue. You may also review that SEP agent system logs to spot errors and warnings about licensing and content update.

Hi Beppe,

We run SBE, if that helps.
What would the file path be for the specified system logs?

Thanks,
F

Whats curious is that from the SEPM Server it's showing as an 'Offline Endpoint' yet from the SEP Client It's displaying the message 'Your Computer is Protected'.

I've ran a tracert between the Server with the 'offline endpoint' and the SEPM Server and its running just fine.

Would it be worth running a repair of the SEP Client?

Thanks,
F

RE: System Logs

I've located them.
When checking through the system logs on the affected Server, and filtering to only Errors and Warnings, I receive no Error nor Warning logs.

*See Attached*

When filtering the logs, including 'Information' logs I receive a large number of logs, dating from today stating that Definitions and Content updates have been installed.

Hello,

please, open the SEP client UI > view logs, then browse them, the available options are self-explanatory.

Hello,

the ability of SEP to protect your system is not tied to its ability of connecting to the SEPM, "your computer is protected" as much as the SEP client is able to get latest definitions (not necessarly from the SEPM) and the files are not broken.

Try to reinstall that SEP client.

Hello,

let's try to reset the communication settings on that client:

1) open the SEPM console

2) select the group that client belongs to

3) under tasks, select the option to export the communication settings

4) rename the exported file as sylink.xml

5) import that file in the problematic client as explained here:
http://www.symantec.com/docs/HOWTO81112

Could you please provide a screenshot of #2?

Thanks,
F

Hello,

I'm not sure how I can provide you a screenshot of the groups and clients you have in your SEPM.

Step #2 means:

2.1) open the SEPM console

2.2) select the "groups" panel on the left, the tree of your groups will show up

2.3) find out the group where the offline client is registered

2.4) select that group by just clicking its name

Hi Beppe,

That's where I'm going wrong then, there is no 'groups' panel.
*See Attached*

Thanks,
Fraser

Hello,

forgive me for the mistake, I don't have a SEPM console in front of me now.

I meant the "Clients" panel on the left, you should know how to browse your groups of clients, indeed.

I am aware of how to browse my group of clients, but I'm afraid there is no 'tree' of clients/servers, simply two tables.

Please see attached image of the list of options under 'tasks', could you please specify which option to select.

F

Hello,

I've finally got a console... here are the exact steps in a screenshot to export the communication settings for a group from the SEPM:

Brilliant.
I'll attempt this first thing tomorrow.

Thanks!
F

Hi Beppe,

I'm afraid the implementation of the Exported Communication Settings from the SEPM over to the affected SEP has made no difference. - The affected SEP client is still showing as an 'offline' endpoint.

Thanks,
Fraser

Thus, time to call the support the have a deeper analysis of the communication logs (sylink.log).