Hi All,

 

I was wondering if anyone can help me with this query, the server Symantec endpoint protection is installed had to be changed as the server was very old. This means that the clients are not connecting to the new software as they are still looking to the old server. is there a way to fix it so they look at the new server now? we have over 170 computers but about 30 come up in the client list as I manually reinstalled these.

 

 

Gramzon

You need to replace the sylink file. If on 12.1 RU2 or higher you can do it from the SEPM

See here:

Restoring client-server communications with Communication Update Package Deployment

Article:HOWTO81109

|

Created: 2012-10-24

|

Updated: 2013-10-07

|

Article URL http://www.symantec.com/docs/HOWTO81109

 

whats the version of SEPM you upgraded? you can use the sylink deployment 9remotely) using SEPM http://www.symantec.com/docs/HOWTO81109

we are currently using 12.1.671.4971

edit: I dont see the Communication Update Package Deployment in the deployment wizard?

This feature does not exist in this version as it was the first for 12.1. You can upgrade to the latest, 12.1.4 if you wish.

If you're not going to upgrade, call support and ask for Sylinkreplacer for 12.1

How to create a new case in MySymantec

http://www.symantec.com/docs/TECH58873

Phone numbers to contact Tech Support:

Regional Support Telephone Numbers:

    United States: https://support.broadcom.com (407-357-7600 from outside the United States)
    Australia: 1300 365510 (+61 2 8220 7111 from outside Australia)
    United Kingdom: +44 (0) 870 606 6000

Additional contact numbers: http://www.symantec.com/support/contact_techsupp_static.jsp

then you need to get the sylink replacer by calling support and use for replacing the sylink.xml on the offline clients.

or upgrade the SEPM to latest (SEP 12.1 RU4) as the one you using is bit old and use the above link to replace sylink.

Hi, 

You will get slink replacer utility to remove Sylink.xml, which can be use multiple computers.

Regards

Ajin

 

If you have SNAC enabled in your environment then following article helps you out

 

https://www-secure.symantec.com/connect/articles/moving-sep-clients-independent-sepm-another-independent-sepm

Hi, I received the sylink replacer from Symantec but it didn't solve my problem, they have recommended that I upgrade my endpoint protection to the latest and should be able to fix this issue using the built in communication update package. Will this actually work? Gramzon

Yes. It's much easier to push from the SEPM using this feature.

it didn't work, finds the computers in the network and when i click to push it out, does some stuff says some are complete some aren't clients before 44 and after 45 :/

It seems to only update files of clients that it is already able to communicate, the others says updated but it hasn't actually worked.

Did you have have below Perquisites

 

 

• Prepare computers for remote deployment and management


• Modify firewall settings to allow communication between Symantec Endpoint Protection Small Business Edition components:
  • Push deployment ports, used on management servers and clients: TCP 139 and 445, UDP 137 and 138, and TCP ephemeral ports.
  • For legacy communications, open UDP port 2967 on all computers.
  • General communication: TCP 8014 (HTTP)/TCP 443 (HTTPS) for management servers. These are the default ports, and may be customized. See Symantec Endpoint Protection 12.1: How to Change the ports used for communication between the Manager and clients.
  
  
  Prepare Windows XP computers that are installed in workgroups: Windows XP computers that are installed in workgroups do not accept remote deployment. To permit remote deployment, disable Simple File Sharing. Note: This limitation does not apply to computers that are part of a Windows domain. Detailed instructions are provided in the following document: http://www.symantec.com/business/support/index?page=content&id=TECH102867
  
  Prepare Windows Vista, Windows Server 2008, or Windows 7 computers: Windows User Access Control blocks local administrative accounts from remotely accessing remote administrative shares such as C$ and Admin$. Perform the following tasks:
  
  
  • Disable the File Sharing Wizard.
  • Enable network discovery by using the Network and Sharing Center.
  • Enable the built-in administrator account and assign a password to the account.
  • Verify that the account has administrator privileges

 

Steps to prepare computers to install Symantec Endpoint Protection 12.1 client

 

Article:TECH163112

|

Created: 2011-06-23

|

Updated: 2013-11-01

|

Article URL http://www.symantec.com/docs/TECH163112

 

There is another problem here, I've reinstalled the client software on the computers as a last resort to see if that works. the clients are showing the green dot to indicate they can communicate with the server but when I go in to the server and check the client list they are not listed. This doesn't make any sense?

try to this articles one system and check

How to repair duplicate IDs on cloned Symantec Endpoint Protection 12.1 clients

 

 

Article:TECH163349

|

Created: 2011-06-27

|

Updated: 2013-05-17

|

Article URL http://www.symantec.com/docs/TECH163349

 

If you do a seearch on the SEPM, does it show up?

How do you do the search?

In the SEPM, go to the Clients page and on the Clients tab, under Tasks, click Search clients

Add in the necessary info and click Search

It doesn't come up unfortunately.

So you did upgrade to the latest version, 12.1.4?

Open the client GUI and go to Help >> Troubleshooting

Under General Information you will see the Server field. Does it show as connected to your SEPM?

Yes I upgraded to latest version 12.1.4 and I've checked the client shows the correct server. it has the correct server IP address. last connected 1 minute ago :/

Ok after I reinstalled the client it has come up in the clients list. But it isn't listed in the front dashboard of endpoint manager under endpoint status and under total endpoints it only shows 47 still the number doesn't change

Did you refresh the Home page? It may take a little time.

Is this under Total Endpoints?

I have refreshed it many times, I've also logged off and on again. It's still the same. Yes it's under total end points

Do you have try as per below articles ?

http://www.symantec.com/business/support/index?page=content&id=TECH163349

 

No I haven't tried that, is there a way to check first whether this is the problem? for example to check they are cloned before performing the steps? I don't want to do this only to find out it wasn't the problem.

Plus, I've reinstalled the client remotely via the deployment package created by Endpoint, if cloning was an issue, wouldn't this have fixed it?

run this query, if they had duplicate ID then they are cloned

https://www-secure.symantec.com/connect/articles/how-find-duplicated-hardware-ids-database

When you reinstall your SEP client HWD ID has been changed and system will be show in your sepm console.I suggest you can try one or two system and check observation.

%ProgramFiles%\Symantec\Symantec Endpoint Protection Manager\ASA\win32\dbisqlc.exe I can't find this path, it doesn't exist.

 

Edit: found it`

Also You can try this.

Duplicated HWID query - result shows:
♦ Client computer ID and IP address
♦ Logged-in user
♦ Hardware Id
 DECLARE @TimeZoneDiff int  
SELECT @TimeZoneDiff = datediff(minute, getutcdate(), getdate())
SELECT UPPER([COMPUTER_NAME])
   , [COMPUTER_ID]
   , [HARDWARE_KEY]
   , [CURRENT_LOGIN_USER]
   , dateadd(minute, @TimeZoneDiff, dateadd(second, [TIME_STAMP]/1000, '01/01/1970')) as [Time Stamp]
   , [IP_ADDR1_TEXT]
FROM [V_SEM_COMPUTER]
WHERE [COMPUTER_NAME] in
   (
      SELECT [COMPUTER_NAME]
      FROM [V_SEM_COMPUTER]
      WHERE [DELETED] = 0
      GROUP BY [COMPUTER_NAME]
      HAVING COUNT([COMPUTER_NAME]) >1
   )
ORDER BY [COMPUTER_NAME]
   , [Time Stamp] DESC
 

https://www-secure.symantec.com/connect/articles/compilation-sql-queries-sepm-database

Some clients have a Yellow arrow facing down and a red cross in the top right corner, what does this icon mean?

Can you share screen shot ?

Description of the different shield icon statuses in the System Tray for Symantec Endpoint Protection

 

Article:TECH106347

|

Created: 2008-01-23

|

Updated: 2010-01-27

|

Article URL http://www.symantec.com/docs/TECH106347

About the client protection status icons

 

Article:HOWTO55020

|

Created: 2011-06-29

|

Updated: 2011-12-16

|

Article URL http://www.symantec.com/docs/HOWTO55020

 

It's not in those tables, this is what it looks like https://www.dropbox.com/s/ffr3dke2zu0qsdr/Untitled.png

mean that the client installation/upgrade of SEP rolled back.