Endpoint Protection

Hello,

I have reinstalled the server & restored old backup. But in my case server is showing green dot but on client there is no green dot.

I have read on this forum & tried below steps

To pickup the correct sylink.xml :

1. In SEPM select the group.
2. Right click on it - Export Communication settings and export it to Desktop
3. Rename the file as Sylink.xml

Now on the Client

1. Start > Run > smc -stop
2.  Navigate to C:\Program Files\Symantec\Symantec Endpoint Protrection\
3. Copy the Sylink.xml that was exported on the server desktop and replace the one in this location.
4. Start > Run > smc -start

please help me out.

Thanks

Umesh

Hello Umesh ,

Select one client machine

1. Start > Run > smc -stop

2.  Navigate to C:\Program Files\Symantec\Symantec Endpoint Protrection\

and delete exisiting sylink.xml and sylink.bak first

3. Copy the New Sylink.xml that has exported on the server desktop and replace

4. Start > Run > smc -start

Make sure exception for port 8014 is set in your windows firewall if it is turned on

To make sure the client can communicate at the SEPM, run the following command in a web browser from the client.

http://<SEPM IP Address:8014>/secars?hello,secars

If the client can successfully talk with the SEPM on port 8014, the browser should return "OK"

Hi ,

Please refer to the below KB Article for Disaster Recovery http://www.symantec.com/docs/TECH102333 . After Restoring Database from old server make sure to restore the server certificate  as described in the article which will help all the clients to report the newly installed SEPM .

You could also try running the SEP support tool. In your local client click on help and support and download support tool. Run it on the machine and it should flag in detail items in red where it's having issues. This support tool also runs the secars test. Details will also give you ways to fix to the issue.

Dear Swapnil,

I have tried all suggested steps.

I have old backup of last week, which was taken by backup and restore. I already restored it so i did not make policies and groups again.

And I am having a copy of \program files\symantec folder.

please suggest, green dot is available on few clients in Management console.

On client system when i replace sylink.xml, after starting service it show green dot for 1 sec then disappear.

I have tried to delete client from server but all displayed again and few of them become green dot.

On client side there is no success, i have 40 client system.

Pls note previously I had Symantec Endpoint Protection 11.0.6 MP2, Now installed : Symantec Endpoint Protection 11.0.6 MP3. On client it was : 6200

Please help me out. Waiting for valuable reply, Clients are not updating from last few days.

Thanks

Umesh

Is this happening on all your clients? I remember having an issue with a server where SEP said it was off-line and it turned out to be this issue here -

http://98.129.119.162/connect/forums/sep-client-offline-without-green-dot

Basically -

From Kedarnath Ravikumar -

1. HKCU\SOFTWARE\Microsoft\Windows\Currentversion\Internet settings Click on the internet setting key check for the keys called "ProxyEnable" if it is set to 1 then change it to 0 also check if there is a registry value called "GlobalUserOffline" if it is present change the value of the DWORD to 0

2. Now expand Internet settings key and take a backup of the "Connections" key, Delete the entire key

3. Check HKU\.Default\SOFTWARE\Microsoft\Windows\Currentversion\Internet settings Click on the internet setting key check for the keys called "ProxyEnable" if it is set to 1 then change it to 0 also check if there is a registry value called "GlobalUserOffline" if it is present change the value of the DWORD to 0

Just a thought.

Mike

Once you run sylink tool attach those logs

Hello Umesh ,

Please run sylink monitor on 2 machines on which client comes and goes offline i am attaching steps below for the same ,kindly run this tool on 2 client machine for atleast 20 minutes .

1. Open registry
2. Locate the following key:
HKEY_LOCAL_MACHINE\SOFTWARE\Symantec\Symantec Endpoint Protection\SMC\smc_debuglog_on
3. Make the value of this key to 1 if its 0.
4. Close the registry. Close the SEP client if its opened.
5. Go to Start->Run and type "smc -stop"
6. Now you will notice that the shield icon in the system tray has disappeared
7. Go to Start->Run and type "smc -start"
8. The shield icon should re-appear in the system tray now.

You can download sylink monitor tool from link below .

https://www-secure.symantec.com/connect/articles/how-capture-sep-sepm-communication-logs-sylinkmonitor-mr3-onwards-troubleshooting-communica

pls find attached file sylink tool.

--

Umesh

Attachment(s)

sylinkMonitor Log (client).txt   62 KB 1 version

hi,

have you restored the server certificate after restoring the backup?

I did see these errors in the sylink logs, can you confirm if the restore of certificate has been done and are the clients communicvating with http or https with SEPM?

08/12 11:47:10 [1552] <mfn_DoGetIndexFile200>Content Lenght => 1351
08/12 11:47:10 [1552] <mfn_DoGetIndexFile200>Signature verification FAILED for Index File Content..

Umesh the certificate are in Server private key folder .jks

Login to Sepm admin tab restore certificates if you have backed up

If the certificates are not present then sylink needs to be manually replaced on all machines ,

also check permission on db and data folder

Thanks for time,

I have complete copy of symantec folder which was in c:\program files

I have not taken the backup of jks file seperately. While i am importing any jks file situated in that folder it is giving error invalid certificate file.

Thanks

Umesh

are u trying to put inside SEP 12.1 ?

No, i am using SEP 11

-

Umesh

Hi All,

I think you guys are right, there is certificate problem.

But one thing where i am bit confused I have created setup from current sepm and install in one of my system. but there is no green dot even after it. I am ready to install Symantec on all clients but not on server. Because of policies on server.

Please help me out should I go for reinstallation on server without restoring any backup. But it will be big headache i have to create policies again.

Even Reinstallation on client with new created package is unsuccessful.

Is there any other way to done it with my current scenario. 

Waiting for valuable reply.

----------------

Umesh

Hi,

If you have installed the fresh server and SEP manager. Make sure you keep the same Server DNS name and IP address with other details.

Please restore the backup of SEP database and do restore the KEY Store password from the backup.

Check firewall ports for client and server connectivity.

-Prabhakar J

i have reinstalled the server.

Then replace sylink.xml file on all clients

Done.

Thanks

For all suggestions.

Bye.