Endpoint Protection

Hello,

When I upgraded SEPM from 11.5 to 11.6 (right now i have 11.6 MP2) some workstations has occasionally problems with files copying from local drives to our file server (file storage is on Hitachi HDS disk array). I use only AV, NTP and ProActive Threat Protection, NAC and Dev Control is off. My workaround is downgrade client version to 11.0.5002,. In all 11.6 x release notes I see, that some copying issues should be solved, but my problem still exists.

Disable NTP just as a test and try the copy again. What are the results?

Hi mniechcial,

What protocol is in use with that copying?  If it is SMB2, then you are likely encountering a known issue.

Please add details about the OS version and protocol- forum membes will then be able to confirm!

Thanks and best regards,

Mick

Kindly see the following:

File copies over SMB2 fail with Network Threat Protection installed/enabled 

http://www.symantec.com/business/support/index?page=content&id=TECH139768&actp=search&viewlocale=en_US&searchid=1293722184485

File server which shares files works under Windows 2008 and problem is with vista and win7 workstations. When I turned off SMB2 on file server, all my shares disappeared, so I can't do this. Tell me if I will turn off SMB2 only on worstations, will it help?

That definitely looks like the known issue. The link to the official KB on the subject has been provided above by another forum member.

There are two workaounds at present: use SMB (not SMB2) for the fileshares, or disable NTP.  Disabling it just on workstations won't likely help matters.

This issue is expected to be corrected in the next release of SEP.  No exact release date is currently available, but it should be within the first part of 2011. It is possible on Symantec's website to subscribe to notifications of new releases for products- highy recommended!  

Thanks and best regards,

Mick

As I wrote before, I can't disable SMB2 on fileserver, because I will loose all shared disks and probably all permissions to shares. i would like to not disable NTP (decreasing the security). All works fine, when clients had sep 11.0.5002. Is it possible to automatically downgrade client versions (now all clients has the newest sep version)?

You will need to remove the latest version manually, reboot, install RU5, reboot to complete.

Hi,

We had the same issue and had to disable SMB2 on our workstations. Here is the app I wrote to do this:

https://www-secure.symantec.com/connect/downloads/smb2-toggle-too-mikes-tool-set

We did NOT need to run this on the file servers, just the workstations.

Hopefully it will work for you as well.

-Mike

P.S. I agree that disabling NTP is a less than optimum solution...we did not take that route either.