Video Screencast Help
Symantec to Separate Into Two Focused, Industry-Leading Technology Companies. Learn more.

Managed SEP turned into unmanaged

Created: 23 Dec 2010 | 15 comments

Hello,

Almost all of the SEP clients managed by my SEPM turned from managed to unmanaged, even when I issue "update policy".

While the SEPM Server was up and running (Ping and Telnet to SEPM ports was ok), I tried to connect to it via remote Desktop, but no response.

I logged on locally and I got an error Message ( " Reporting queued error: faulting application GFValidate.exe, version 11.0.6005.450, faulting module msvcr80.dll, version 8.0.50727.3053, fault address 0x000046b4." ), and some previous messages of ( " Secars Started!" ).
yet the SEPM clients were accessible from the SEPM Server, but seen as unmanaged.

Is there a known root cause for this issue ?

Thanks,

Comments 15 CommentsJump to latest comment

pete_4u2002's picture

verify if there is change in sylink file?

can you post the sylink log from one of the client?

jorge_bernardo's picture

Have you tried to repair the installation?

Love as a principle and order as a basis; Progress finally

Hafiz.mohammad's picture

No, but I fear that might crash the server, is there any other alternative ?

Rafeeq's picture

this happens when sylink.bak file remains when made it from unmanaged to managed using sylink drop.

Hafiz.mohammad's picture

I have never used Sylink Drop tool.

Besides, before this incident, all the SEP clients were managed normally.

MR1985's picture

1) Login to the SEPM console and Go to Clients Right click on the group export the    communication settings.

2) Save the sylink file and Import this file on the client which is having issue.
3) Open the SEP Client GUI-- Click on Help and Support - Troubleshooting
4) Import the exported sylink file by Clicking  on  Import tab under Communication Settings.
5) After the import, restart the client service once and check the status

If the above provided Info helps then Mark as Solution

somenkar's picture

Repair the installation,generate the sylink.xml and copy it on the unmanaged client.Try it on a couple of machine.It should work.

Pawel Lakomski's picture

I suppose that clients did not change to "unmanaged" but they were simply unable to connect to SEPM, right? Open SEP client on one of them and go to Help and support > Troubleshooting. Next to server is "Not online" or "Automanaged"? Do you have database backup? I would suggest proceeding with disaster recovery procedure - it is easier and faster as you don't have to drop sylink to all machines.

--

Cheers,

Symantec Technical Specialist
Symantec Certified Specialist
MCP & MCITP
Cisco Certified Network Associate
Citrix Certified Administrator

Hafiz.mohammad's picture

You`re right, the status was Offline = Not Online,

I tried restarting the server , other than the 2 error messages I saw, all went back to normal.

However I don`t know what is the root cause for that, or how to resolve these error messages in case this happens again !

Hafiz.mohammad's picture

I tried restarting the server, and everything to my surprise is working fine...

However there was 2 errors I saw before restarting the server ;

1. Error regarding a missing dll file called msvcp.dll ( a Windows Error) .

2. Error regarding a service called wshelper.sys. (See the attachement), generated by the Symantec Endpoint Support Tool.

I can`t understand what was the reason for that, or how it worked again !

Error.png
pete_4u2002's picture

the wpshelper.sys can be igmore in case if NTP modeule is disabled while you had collected the logs.

Pawel Lakomski's picture

Wpshelper.sys is IPS driver so would not be involved I suppose. If no client could connect it was a connectivity issue, I guess on server's side as if you reset it, it was gone. Cannot tell exactly what was the issue. If it reappears, please follow

http://www.symantec.com/connect/articles/how-enabl... to create sylink.log.

It is client-server communication log which is going to tell us why the communication blocks.
Please keep logging for about 15 min and then disable logging. Please attach the log.

--

Cheers,

Symantec Technical Specialist
Symantec Certified Specialist
MCP & MCITP
Cisco Certified Network Associate
Citrix Certified Administrator

Hafiz.mohammad's picture

Here`re the logs and the error message I received was ;

Reporting queued error: faulting application GFValidate.exe, version 11.0.6005.450, faulting module msvcr80.dll, version 8.0.50727.3053, fault address 0x000046b4.

AttachmentSize
SEPM Application Logs from Event Viewer.txt 480.92 KB