Endpoint Protection

Looks like SEPM 12.1.2015.2015, client is installed on Windows 2k8, when rebooting SEP is nor releasing the "system event notification service'. which causes the server to hang.

Any inpput on this would be helpful.

Does this help

http://social.technet.microsoft.com/Forums/en-US/winservergen/thread/65634267-8550-4b96-b6d1-6e020859aee7

And what happens if you temporarily disable SEP and reboot again?

disable SEP, reboot is good or if i uninstall SEP, force reboot - then try to reboot - works fine

I suspect it may be auto-protect. SEP 12.1 RU3 is out in a few days and I see a few tweaks made to auto-protect:

http://www.symantec.com/docs/TECH206828

You may want to wait to test it or give support a call.

Disable only auto-protect and try again to see if it can be narrowed down to just AP.

There is a dependency of SEP on Event service.

Try this 

 If no system event notification service exists, remove dependency for symantec management client service from registry.
- take a registry backup.
- navigate to  HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SmcService and delete the Value "DependOnService.
- close registry.
- reboot is required at this time.

https://www-secure.symantec.com/connect/forums/event-notification-service-dependency

Thanks, i'll look into 12.1.3

Hi,

Could you please test with SEP 12.1 RU2 MP1

Make sure you are not affected with the following fix id.

Server is unresponsive after installing Symantec Endpoint Protection 12.1