Endpoint Protection

My Office Manager has sent me this in an email:


My Macola crashes 5-10 times a day with the following error message


MSL Technical Error Info:

An error occured in MacMSL.dll (ver. 2, 0, 1, 49) DB Provider Error: Native Error number: 11 Error number: 0x80004005 [DBNETLIB][ConnectionWrite (send()).]General network error. Check your network documentation.
COM Error: Error
Code = 0x80004005
Code meaning = Unspecified error
Source = Microsoft OLE DB Provider for SQL Server Description = [DBNETLIB][ConnectionWrite (send()).]General network error. Check your network documentation.
Op : 02, fhOpenIO
 Table or Script: MSLGetSQLData Script

MSL Error Info:
Type: MSLGetSQLData Script Error..
Function: OpenSQL.
Script Name: (null).

SQL Statement:
Select cus_no FROM arcusfil_sql WHERE cus_no = 'whee02'



Do you think this is a Macola crash unrelated to SEP Firewall Policy Settings, or is my recent "Block Local File Sharing" the culprit?
Also, because Macola kept crashing, the manager has right clicked and disabled his Symantec Endpoint Protection Client.  Why is he able to do this when the clients are under Manager Console (server) control?

Can you give us some details of you environment?

1.OS Version and SP
2. 32 or 64bit
3. Version of SEP and the features your are using
4. Are you using Macola on other systems without issues?
5. What version of Macola are you running

Thanks,
Thomas

Users would be able to disable even if tis managed

you need to configure " users ablility to disable symantec EP "

here is the doc for that.

How to block user's ability to disable Symantec Endpoint Protection on Clients

http://service1.symantec.com/SUPPORT/ent-security.nsf/docid/2007110514540148

if you allow your SMB , ,,,,does your application work?

in that case its the culprit :)

 well from the error above " General Network Error"
It does seem that it might be the firewall...As far i remeber you have hardened your SEP firewall Polcies..
So this block might be due to Block all other Traffic rule..if you have enabled..

With this little informaton in hand what I can guess is that your application is not able to connect to the database which I guess i on a mremote computer..allowing that port might work..

Good to see you again, Vikram.

At the current time, "Allow all other IP traffic" and "Block all other traffic" are both disabled.

What I should add is that there is a rule named "Allow local file sharing" , which was enabled, but set to Block and log to traffic log.

I noticed that it was being written to the traffic log a LOT, which means a lot of the machines were trying to stay connected for local file sharing apparently.

I have it set to allow now, but the office manager now has his SEP client disabled    (>_<). I am unable to test if the error will sprout itself again.

 Well ..Local file Sharing Specially the UDP packets generate a lot of traffic..Each computer throws out this UDP 137 it is used NETBios Name Service and UDP ..TCP will be less as they are the actual secure communication channels..

Well for this ERP application had more issues with Tamper Protection and Application n Device Control..but here thats not the case as when you right click and disable it neither of them get disabled...and even the Network error in the logs point towards the Firewall..
Do update us when u get a chance to test it..