Endpoint Protection

I am in the process of troubleshooting several servers, and notice that a bunch of them have NTP enabled.

Servers in our environment are only supposed to have Antivirus and Antispyware installed.

Is there a registry key that I can flip off so that NTP, PTP is disabled. Or, do I have to re-deploy SEP install packages that only have Antivirus and Antispyware (taking longer, and more of our bandwidth)

Hello,

Network Threat Protection works on teefer2.sys drivers which get installed when the packages is deployed. Again, you also require a restart for the machines for them to install and work properly.

In your case, you want to uninstall the NTP and PTP features, then you can simply add the new custom packages for Auto-upgrade. Check this Article:

http://www.symantec.com/docs/TECH103055

http://www.symantec.com/docs/TECH90936

You can also remove NTP and PTP from the server in Add/Remove Programs by selecting SEP and then choosing to Modify.  This may take a bit longer as you have to hit each machine, but you will be sure that NTP and PTP are removed.

You simply have to select to not install any of the options associate with NTP and PTP and this will then remove them from the SEP installation.

Go to regedit take reg back up and go to

HKEY_LOCAL_MACHINE\SOFTWARE\Symantec\Symantec Endpoint Protection\SMC\smc_engine_status 

If the value of  smc_engine_status  is "0" that means NTP is Disabled

If the value of  smc_engine_status  is "1" that means NTP is Enabled

Please check

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Teefer2

If you find teefer2 remove it and reboot the machine

Note making changes to smc engine status ntp enable or disable needs an reboot .

Note:-Please take reg back up before making any changes to it

The below command should work, we tested and it worked for us.

MsiExec.exe /I {product code} /qn REMOVE=PTPMain,ITPMain

To find the product code for your product

1. In the Windows Registry Editor, expand the following key:
   
   HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall
   
   This key contains many <Product Code> keys.
   
    
2. In the left pane, click each <Product Code> key.
3. In the right pane, look at the DisplayName value.
4. Find the <Product Code> key whose DisplayName value is Symantec Endpoint Protection
    
5. Use the product code in the command line as shown in the next section of this document.
   The surrounding braces are part of the code

Refer : http://www.symantec.com/business/support/index?page=content&id=TECH102668

There is this option, too, if your servers are all in one group. This way you don't need to modify the servers through Add/Remove programs one at a time.

How to add or remove features to existing Symantec Endpoint Protection client installations
http://www.symantec.com/docs/TECH90936

Also: (from document)

"Network overhead considerations
As each existing SEP client already contains all components (whether or not they are installed) and the version is not being upgraded, no installation files are actually sent over the network. No network bandwidth or traffic spikes should occur when changing the installed feature set."

sandra

Hi All,

Is there any entry for installed component of SEP11 in registry?

See Swapnil's comment above.

https://www-secure.symantec.com/connect/forums/registry-key-enable-or-disable-ntp-ptp#comment-6742741