Endpoint Protection

Hello All,

We have recently upgraded our SEP11 AV servers from MR2 to MR4 MP1a. We have over 8000 clients reporting to the manager.

For upgrading our clients we created pilot groups for testing and moved over a few hundred clients on them (about 400) .

Now what we've learnt is that after the upgrade, the Proactive Threat Protection (PTP) goes to 'Waiting for Updates' and the eraser engine version comes up as 0.0. After much troubleshooting it was found that this problem goes away after uninstalling the client and reinstalling it again. Also this problem can only be identified if one goes to each client manually and check the status.

Incidentally there is no symantec report that shows the status for PTP or atleast the Eraser engine version no. so that we can identify how many machines exactly have this problem. According to our survey it seems 9-10 people we've contacted so far have reported this problem.

MY QUESTION IS - Is there a registry key that shows the eraser engine version OR Is there a way of generating a report that might show the eraser engine version as this would give us the exact count of machines with the above said problem.

Also, does anyone know a specific reason for this problem?

I would really appreciate it if someone can suggest a better solution or a workaround of some kind coz we have a huge no. of clients spread all accross US and this looks like a major issue.

IS ANYONE READING MY THREADS????? :( :(

CAN SOMEONE PLEASE REPLY BACK IF THEY'VE SEEN OR ENCOUNTERED SUCH A PROBLEM BEFORE.....

Check if this helps:

HKEY_LOCAL_MACHINE\SOFTWARE\Symantec\COH_PVLInfo\COHEngine

"Version"


Thanks :)

Lemme go to one of the clients with the issue and check this registry key. I hope this shows the version as 0.0 (as it does with the issue). This is enable us to identify the no. of clients that are affected with this problem.

I appreciate your prompt reply.

Thanks!!!

My pleasure - would wait for further updates

Thanks :)

Hey my friend!

It was a dead end........I checked a few clients with the PTP problem.......Incidentally the registry key that u gave does not help in identifying if the eraser engine version has gone to 0.0

It shows the version for SEP PTS Engine Win32 but this does not help at all as it remains the same for all the machines (with or without the problem).

Are you running Truscan on these machines?

Are you upgrading clients from MR2 to MR4 MP1A?  That's not a supported upgrade path (should upgrade to MR4 first then MR4 MP1A).

There is a full KB about this issue.

http://service1.symantec.com/support/ent-security.nsf/854fa02b4f5013678825731a007d06af/65a2cceb4de45f69882575a20059f655?OpenDocument

workarounds III + IV are the best ones in my opinion, but re-installing the client is suggested first in I + II.  This issue has been around for awhile (MR3 at least).