Endpoint Protection

Hello,

I have tried searching the Forums for the answer but have had no luck.  If you know of a thread that discusses this please post a link to it, thanks.

Basically one of my clients is sending the same Security Alert Notification every day.  The notification is always dated 02/17/2010 and at the same time and it is always an application control event saying the task manager tried to shutdown Symantec. 

Is there some location that the notification could be stuck that causes it to repeat itself?  Where are the notifications stored on the clients before they are sent to the server? 

Any help would be appreciated.  If you need more information just let me know.

My Version is 11.0.5002.333

Thank you, 

processlog.log - Application and Device Control log

C:\Program Files\Symantec\Symantec Endpoint Protection\processlog.log 

Stop SMC server ( smc -stop) and delete the file then start SMC service it will re-generate.

 
So I tried your suggestion and it does not appear to have resolved the issue.  I got the old notification this morning again and went to the PC to attempt the fix.  When I returned to my desk I had another notification in my inbox and received another one shortly after I started writing this reply.  I assume both were generated by starting and stopping the client service.  

The reports are always from the same date and time.  I guess I will wait and see if the report is generated again tomorrow before I decide for sure that this didn't work.

can you delete your notification and try adding a  new one? 

Are you getting the even always about a particular client or it is different onces..?

Sorry, I forgot to close up this thread.  

In the end what was causing the issue was an Adobe Reader 9.3.1 installation.  One of the other admins had setup a policy in AD to automatically update Adobe on people's computers that were still running version 8.0.  For some reason the Adobe install was messed up and would install version 9 along side 8 and not replace it.  This resulted in the Adobe install trying to run every time the user logged in.  When this happened for some reason it was causing SEPM to run a repair install which was what kept generating the reports.

As too why the reports were always dated the same I can't say for sure but once we stopped trying to run the remote update for Adobe we stopped receiving the reports.  I know this is a little short on details but it was a while back now and the details are a little foggy.

I will mark Vikram with the solution since he was the first to reply. 

You should not mark posts as the solution unless they resolved the issue. This defeats the purpose of the feature and could cause other forum users to waste their time with posts which did not resolve issues.

Regards,
James