Endpoint Protection

Hello,

Almost all of the SEP clients managed by my SEPM turned from managed to unmanaged, even when I issue "update policy".

While the SEPM Server was up and running (Ping and Telnet to SEPM ports was ok), I tried to connect to it via remote Desktop, but no response.

I logged on locally and I got an error Message ( " Reporting queued error: faulting application GFValidate.exe, version 11.0.6005.450, faulting module msvcr80.dll, version 8.0.50727.3053, fault address 0x000046b4." ), and some previous messages of ( " Secars Started!" ).
yet the SEPM clients were accessible from the SEPM Server, but seen as unmanaged.

Is there a known root cause for this issue ?

Thanks,

verify if there is change in sylink file?

can you post the sylink log from one of the client?

Have you tried to repair the installation?

No, but I fear that might crash the server, is there any other alternative ?

How do I collect it ?

this happens when sylink.bak file remains when made it from unmanaged to managed using sylink drop.

1) Login to the SEPM console and Go to Clients Right click on the group export the    communication settings.

2) Save the sylink file and Import this file on the client which is having issue.
3) Open the SEP Client GUI-- Click on Help and Support - Troubleshooting
4) Import the exported sylink file by Clicking  on  Import tab under Communication Settings.
5) After the import, restart the client service once and check the status

Repair the installation,generate the sylink.xml and copy it on the unmanaged client.Try it on a couple of machine.It should work.

I suppose that clients did not change to "unmanaged" but they were simply unable to connect to SEPM, right? Open SEP client on one of them and go to Help and support > Troubleshooting. Next to server is "Not online" or "Automanaged"? Do you have database backup? I would suggest proceeding with disaster recovery procedure - it is easier and faster as you don't have to drop sylink to all machines.

I tried restarting the server, and everything to my surprise is working fine...

However there was 2 errors I saw before restarting the server ;

1. Error regarding a missing dll file called msvcp.dll ( a Windows Error) .

2. Error regarding a service called wshelper.sys. (See the attachement), generated by the Symantec Endpoint Support Tool.

I can`t understand what was the reason for that, or how it worked again !

I have never used Sylink Drop tool.

Besides, before this incident, all the SEP clients were managed normally.

I couldn`t do that to 1400 clients.

You`re right, the status was Offline = Not Online,

I tried restarting the server , other than the 2 error messages I saw, all went back to normal.

However I don`t know what is the root cause for that, or how to resolve these error messages in case this happens again !

the wpshelper.sys can be igmore in case if NTP modeule is disabled while you had collected the logs.

Wpshelper.sys is IPS driver so would not be involved I suppose. If no client could connect it was a connectivity issue, I guess on server's side as if you reset it, it was gone. Cannot tell exactly what was the issue. If it reappears, please follow

http://www.symantec.com/connect/articles/how-enable-sylink-logs-registry to create sylink.log.

It is client-server communication log which is going to tell us why the communication blocks.
Please keep logging for about 15 min and then disable logging. Please attach the log.

Here`re the logs and the error message I received was ;

Reporting queued error: faulting application GFValidate.exe, version 11.0.6005.450, faulting module msvcr80.dll, version 8.0.50727.3053, fault address 0x000046b4.

Attachment(s)

SEPM Application Logs from Event Viewer.txt   480 KB 1 version