Endpoint Protection

Hello All,

I have been having a bit a trouble (just like all of us on this forum...).

I have installed SEPM on 7 servers.... (Let's call them Server1, Server2, etc...)

Server1, 2, and 3 actually replicate. Server4, 5, 6, and 7 do not.

Server1 is my main server. It's the one that connects to the internet to get the LiveUpdates.

On Server4-7 I have noticed there is no SEMP Service in the Services snap-in
When I try forcing a replication from Server1, I get error code 0x80020000
When I try to log into Server4-7 locally onto the console I get a 'Failed to connect to server' message. I'm assuming this is because there is no SEPM service.

When installing SEPM on all the servers, I cannot exactly recall which ones I have installed with the recommended website settings and which ones with the default website.

I have tried googling for days.... weeks even, but still no luck. Can someone help shed some light on this issue?
This has been dragging out for way too long and there are computers in the company that are not protected!!!

Thank you all in advance.

the SEPM on one which the replicatin failes, copy and paste the scm-server-0.log

Hi. Thanks for the quick reply :)

I can't seem to fins the scm-server-0.log....... I have tried googling for it's location and did a full search on 2 servers, but I can not find it. Could you help me locate it.

Thanks again.

I have found where the log file is supposed to be located by more googling :P
"C:\Program Files\Symantec\Symantec Endpoint Protection Manager\tomcat\logs"
But that file is not there..... including the catalina.out does not exist.
The only files present are:
Install_log.err
Install_log.out
smbinstall_log.err
smbinstall_log.out

you may need to set log level to fine and see if the file exists after configuring as per the steps mentioned.

http://service1.symantec.com/SUPPORT/ent-security.nsf/docid/2009120813414448

Hi Pete, Thanks again.

There is a problem with the first step..... Stop the Symantec Endpoint Protection Manager service......

That service does not exist for me..... It does not exist on Server4-7.....

:(

Are there any other log files that would be helpful?

i'm not sure if at all SEPM has been installed properly. You may want to reinstall SEPM and add as replication partner.

I make sure all prerequisites are met before I insall the SEPM.
There is no error message during install.
The errors start when Server4-7 try to start the replication straight after the SEPM install.
After several hours "please wait", it fails to replicate...

Would installing the SEPM to use the Default Website port 80 cause it to fail replication to a server that uses the Symantec recommended port (8443?)

But then again, that does not explain why the Symantec Endpoint Protection Manager service does not exist...... This is driving me insane! :-(
To be honest, I've never had a perfect experience using Symantec products.....

EDIT:
And I have tried un installing and re installing several times on different servers. All have the same result....

You can try to delete and add the replication partners again.

Things to check:
- Does it show validation failed? or authentication failure?
In that case, you need to replace the server certificates from main site. You could also try to restore certificate from old backup copies of certificate on non-replicating sites themselves.

- replication.log would give you information about replication logs

- If still issue persist, Strong recommendation is to open a case with Technical support for detailed analysis

did you try installing using local administrator account ?


you can paste the sepm_inst.log ( from %temp% directory) and someone can confirm if it has been installed properly.

Thanks for the replies guys. I am calling it a night tonight.... I will report back tomorrow in the morning!!!  :-)

SemSvc.exe......
How do I install this service? What are the switches' requirements ?
If I need to open a case with Tech Support, How would I go about doing that.

The SEPM_Inst.log is over 11MB...... over 41,000 lines.......

I can not find the replication logs on the troublesome servers.

Thanks.

semsvc.exe service exists, if you have installed SEPM. Run the Management configuration wizard.

To open a support case, you need to have support id  and call up the number from the link. Select the Country from the dropdown box.

http://www.symantec.com/business/support/contact_techsupp_static.jsp

Opened a Support Call, waited half an hour on  hold, 4 days ago. Then they tried remote controlling my PC, but that didn't work. They sent me a SEP_SupportTool.exe that checks everything. Generated a 14 MB file and told me to email it to them. That didn't work either. Called them to say it didn't work (another half an hour on hold), so they  had me ftp it up to them. Now, Monday morning, calling them again to see what the go is..... I have been on hold with them for 15 minutes now.... Funny tho, this voice keeps saying the customer that has been on hold the longest was no more than 4 minutes (Said that 3 different times and that I was a valued customer and my call was being expedited!!! HA!!!) now that voice came back and said, the customer that has been on hold the longest was no more than 12 minutes..... How does that work....?

Well on the 15 minute mark, the call was answered by a "call routing person" (that's what he called himself)....... back on hold again...... *sigh*

And at least they could play some music that doesn't make you fall asleep!!!!!!!
Below satisfactory for me.

I have now been on hold for about an hour!!!! And for the past 20 minutes there has been nothing but silence!!!! The music is not playing, and all i hear is the hiss of the line.... WTF! Part of me thinks my call has been dropped.... another part of me says Someone has picked up my call, but then placed me on Mute so I don't hear anything..... I used to work in a call centre, so I know these sneaky tricks!!!! **AAAAHHHHHHH** Royally Teed Off!!!!

I am placing my current call (over an hour hold) on hold myself, and calling on a different line.  This is retarded...

In SEPM_inst.log search for return value 3 and paste 10-15 lines above to it.Any other web based programs present in your server?Any Java is installed in it?