Endpoint Protection

Any idea why is this suddenly happening? GUP SEP is at RU6 MP3 .....

Error as below:

Windows cannot determine the user or computer name. (Not enough storage is available to complete this operation. ). Group Policy processing aborted.

http://www.symantec.com/business/support/index?page=content&id=TECH157521

check the number of connections using the netstat?

what is the OS?

Hi Pete,

Not very sure... OS is Win 2003 - 32 bit.

This is very sudden actually, never had this kind of issue at GUP machine....

does the solution in article fixes the issue?

it looks like the connections are more compared to the limit that has been set.

MaxUserPort and TcpTimedWaitDelay values can be optimized. "netstat -n" command allow to see number of connections opened and to set appropriate value to MaxUserPort.

Possible values for MaxUserPort are from 5000 to 65534 (the default value is 5000 when this key does not exist). More details available here:

http://support.microsoft.com/kb/196271
http://support.microsoft.com/kb/328476

I've applied the fix to one of the GUP, its under monitoring until end of this week.

What puzzle me is that the default TCP/IP being said in Microsoft article is about 4000, i doubt the GUP is having more than that numbers.....

Maybe 100 at very max.... 

Anybody have experience this before? Would like to understand more.

its just not GUP connections, it will also include fileshare,rpc or any traffic that has been established.

do update us on the onitoring part after this week,

Hello,

I agree with Pete's Comment above.

Check this Article:

Network connectivity loss on server with Symantec Endpoint Protection acting as Group Update Provider

http://www.symantec.com/docs/TECH157521 

OR / AND

Migrate to the Latest Version of SEP 11.0.RU7 MP3

Hope that helps!!

Understood, but i still doubt it will reach 4000-5000.

The server is just serving about 20 clients...unless i missed anything.. its possible for these number of clients to reach 4000 connections?

Also the GUP is already on RU6 MP3...

I've captured Windows 'handle' usage using Mark Russinov tool... i can see the 'System' is using most handles

Also 'netstat' capture did not show anything significant... i mean it's only about 20-30 connections....

Any idea what else to check?

does upgrading the client helps?

open a support ticket, you may be asked to run debug and SST logs to understand the issue.

Thanks for suggestion, i was considering this earlier... but if possible need to somehow confirm if it's due to Symantec issue first...

(you know the drills....if it's SQL or other apps then we'll pass to customer team that handle those...)

The GUP itself is already longtime on RU6 MP3.... SEPM is on RU6 MP2... seems no difference

Only the registry changes fix this....