Endpoint Protection

About 2 weeks ago I pushed out the client to a lab of computers. They do not show up green during the day, keep saying they need restarted which I have done, will not update etc. I tried going to the program and it says it has problems but can't be fixed. I tried reinstalling but it says another instance is already running and gives me a 1500 error code. I go to add remove programs but same error. I have pushed out from console again, it says successful, but again does not work.

Where do I go from here?

There could be 3 possblity
1. the Client is not commuincating with the SEPM
2. Install is corrupt
3. There is a threat on the machine.

Download Sep Support Tool and uisng Power Eraser run a scan of the machine and then try to repiar the install.
If that doesn't happen call support and ask for clean wipe, with that remove SEP and reinstall.

http://www.symantec.com/business/support/index?page=content&id=TECH105414&key=54619

Check this KB -

MSI error 1500 when trying to install Symantec Endpoint Protection (SEP)

http://www.symantec.com/business/support/index?page=content&id=TECH104368&actp=search&viewlocale=en_US&searchid=1307563037235

I have the clean wipe utility and will try it later because it said not use to it from a non console rdp and I am remoted into one of the computers unless you all out there think I can do it without harm.

I went to a couple of them and the service wasn't running. I started it, told it to update, came back later and now it says it is fine. It didn't have updates since it was installed. Is this normal and what would cause it.

Definitely do not do Cleanwipe over non-console RDP. In fact, I would only use it locally if possible, or if a VM, through the console manager. (If you're talking about RDPing to a workstation like XP, that shouldn't matter as I believe a console session is all you can get.)

If you were using non-console RDP to connect to the SEPM server to build your packages, deploy packages or manage the SEPM at all, that could be a source of corruption.

(In any remote deploy via the SEPM server, "Successful" only means in pushing the files over, not that installation was successful.)

sandra

It is just Windows XP. You can't operate nowadays without using rdp into a server, at least not as well. For example rdp is much faster than the VM console remoting in. As fast as we can get a new VM to get rdp going the better it is. I have built and run all my 5 SEPM's the same way, rdp. This is the only one that is a problem. I understand that when it says successful that it only means it copied the files to the TEMP folder for installation there. The program is installed on these and once the service is started manually it seems to be fine after that on most. weird.

I just went ahead with the CleanWipe utility on this problem. And it's on a remote location, too. :D

Rt-Clickd on CleanWipe and used "Run as..." for the administrator account. System rebooted.

At this point uninstallation will not continue. when the user logged on using his/her account and reconnected to RDP.

Opened Task Manager, opened cmd as the current logged in user, and another cmd using the "Run as... > admin".

Terminated explorer.exe in task manager, ran explorer.exe in the admin cmd. Uninstallation continued.

taskkilled the explorer in the admin cmd (you can still use the task manager on this one) and ran the explorer in the users cmd.

Proceed with the installation of the package.

We have a policy here that prevents the user from accessing the network if no AV is enabled. And we haven't heard from the user so it means it worked.

thanks, BTW how do you do the policy to keep the computer off the network without AV?

We have a different network access control and auditing software for that.

Although I think you could do that with SNAC. I don't have knowledge of that though.

RDP is fine as long as you have a console session. In running CleanWipe over a non-console session, however, I have seen it wipe out network card drivers, which obviously makes it very difficult to reconnect.

sandra