Endpoint Protection

I have a couple of Mac clients with a fresh install that are checking in to the SEPM or appear offline even though under the "Managment" info, it shows that it's "connected". These Mac clients have the latest definitions but are not checking in properly. I'm on 12.1.2.

Any ideas?

Have you tried replacing the sylink file with a new one?

You can turn on sylink debugging as well:

Debugging Sylink communications with Symantec Endpoint Protection for Macintosh (SEP for Mac)

Can you delete the client from SEP console and update policy on Mac client that should come up with green dot.

HI, 

Weather the communication is proper between client and SEPM ?

Do a telnet from Mac client to SEPM via port 8014 (default port).

Regards

Ajin

Brian, is there an article on how to replace the sylink on a mac?

This should help:

http://www.symantec.com/docs/TECH131585

I have tried replacing the sylink file but my mac machine checked into the secondary SEPM server, instead of the primary (no idea why) and then goes "offline" after about 15 - 30 mins. I checked the primary SEPM server but there was no trace of my mac.

On my mac, it actually shows "connected" and checking in to the correct sepm, the primary.

Any other ideas?

How is the management server list configured for the group that the Mac client is in? Is primary set to priority 1?

Yes, primary is set to priority 1 and it is set in the management server list that is applied to all groups.

Seems to be a certificate issue.

stop the smc service Delete these files and then replace the sylink

Sylink.xml.
SylinkEx.bak.
Sylink.bak.

And where is this located on a Mac?

same place where sylink is located.

http://www.symantec.com/docs/TECH131585

So after deleting those files, the client is "green" in the secondary sepm, but on the client shows it's connected and checking into the primary. What gives?

Are the SEPMs replicating?

Yes, but on a nightly basis. Still, all clients are configured to check into the primary, which my Mac client shows that it does, but when I check the sepm, my Mac only shows up on the secondary sepm and it is not "online on remote site."

Should be a cosmetic issue. Your SEPM might be in Loadbalancing mode. So its picking any one at a time.If you enable Sylink loging you can see to which server its connecting and getting the policies from

But I've never configured it to be a load balancer, the secondary sepm is there for failover. Also, "cosmetic"? How do I fix that?

If you force a replication, does it show properly than?

A cosmetic issue would require a code fix hence an upgrade.