Endpoint Protection

Hello,

I need to restart Smc.exe on various remote clients. RDPing into them is not an option.

So far, I have pstools, and when I perform the following command

c:\PsTools>psservice \\computer_IP  -u [username] -p [password] restart smc 

but I keep getting the following error, no matter what computer IP

Error opening smc on \\computer_IP:
Overlapped I/O operation is in progress.
Error opening smc on \\computer_IP:
Overlapped I/O operation is in progress.

Please tell me how to restart Symantec Management Client without disturbing the end user.

I have a vbs that will do it, pm me if you want to try it. For 11.x only at this point.

service name is not SMC

you need to write Symantec Management Client 

under services.exe; check whats the service name, u should provice that.

Hello,

You could run a startup batch script (distriburted via Active Directory) which calls the SMC.exe excutable (default location for SEP 11.x: C:\Program Files\Symantec\Symantec Endpoint Protection) and passes the -start switch.

This will start the Symantec Management client service.

You would need to write the script yourself (or find one pre-written), but the script itself should only be a couple of lines.

James

SMC.EXE which stops & starts the Symantec client console is not defined in any path, therefore Windows will not find it if you try to run it from a Command Prompt or remotely as in your command.

Windows will run the command from the Run... box because it is a 'known' application as defined in this Registry key. Note the the entry below is a folder / key named Smc.exe with a default value pointing to the actual exe.

HKEY_LOCAL_MACHINE\SOFT WARE\Microsoft\Windows\CurrentVersion\App Paths\Smc.exe

To fix your conundrum, this would be the command you need to run: (Note the PSEXEC & watch out for 64bit machines)

c:\PsTools>psexec.exe \\computer_IP -u [username] -p [password] "C:\Program Files\Symantec\Symantec Endpoint Protection\smc.exe" -stop
c:\PsTools>psexec.exe \\computer_IP -u [username] -p [password] "C:\Program Files\Symantec\Symantec Endpoint Protection\smc.exe" -start

Alternatively, if you really wanted to work with the services, you could use the built in SC.EXE from Microsoft that controls services. Your commands would look similar to this:

sc.exe \\computername_or_IP stop "Symantec Antivirus"
sc.exe \\computername_or_IP stop "ccEvtMgr"
sc.exe \\computername_or_IP stop "SmcService"
sc.exe \\computername_or_IP stop "SNAC"
sc.exe \\computername_or_IP stop "ccSetMgr"

& remember to start your services again.

@ James, @ Ian 

Wow, I will try the solution and let you know.