Endpoint Protection

We are not sure what this may be or if it was even caused by SEP. Apparently prior to the SEP installation, wireless would work, after SEP it did not. It is also being mentioned the SEP is interfering with Windows updates after it has been installed. Has anyone come across this? This is a newly imaged PC. It is to be used as the base image.

We are thinking that the ClientSideClonePrepTool may be what is causing this issue.

What happens if you disable SEP, specifically NTP?

***Edit**

What if you remove SEP and test.

Alos what is the method of autentication is being used?

Windiows 7

Have not been able to test that, Helpdesk removed SEP and got the Wireless to work.

When you say wireless doesn't work, does it not turn on, does it not connect to the AP, does it connect but browsing doesn't work?

I would disable NTP only to see what happens, and to get more granular, disable only the firewall.

If is is the firewall, than we'll need to look at the traffic logs. You may need to allow the wireless adapter via a rule.

Yeah, I saw that later , my bad :)

If removing the SEP works, can you get me these logs:

Logs from client (if Windows 7):

1. From a command prompt, type “netsh trace start scenario=wlan capture=yes report=yes persistent= yes tracefile=C: \Client.etl” hit enter.
2. From a command prompt, type “netsh ras set tracing * enable and hit enter.
3. Reproduce the problem
4. Turn off tracing from a command prompt with ‘netsh ras set tracing * disable’
5. Run netsh trace stop  ( Once the issue happens use the command to stop the trace)
6. Stop and save logs.
7. The logs are contained in the %SystemRoot%\Tracing folder.

PM me the etl logs and the RAS tracing folder.

We've imaged many machines in the past with SEP and haver never needed to do this.

Just trying to rule it out/place blame

What's the SEP version?

My favorite version man

12.1.2015 2015

Tried to turn wirless on/off and it said no adapters found, when SEP is off, Wireless works fine.

Even if it is NTP, I can't keep that disabled.

Is there anything in the traffic log showing a block at the time you try it?

Bryan, if possible and you want to dig into the issue get the 2 logs

1. ETL

2.  RAS Tracing

It's the client side prep tool, when I took these steps manually, this did not happen.

I hate to sound like a novice, but I do not know what that is or how to get that.

In early days of  SEP, used to see alot of issues with wireless documented here,

http://support.microsoft.com/kb/2699785

Ca you check that, don't go by the KB's heading just check the registry value if they are modified.

Never use it so I'm not to familiar

Something in this sequence is causing this

The ClientSideClonePrepTool does not run silently, but the following steps may be scripted as a silent alternative.

1. Delete all instances of sephwid.xml on file system. Possible locations (usually only in the PersistedData folder):
   C:\Program Files\Common Files\Symantec Shared\HWID\ (if it is migrated from 11.x);
   C:\Documents and Settings\All Users\Application Data\Symantec\Symantec Endpoint Protection\PersistedData\
   (Replace "Documents and Settings\All Users\Application Data" with "ProgramData" on Vista/Win7/2008+)
   C:\Windows\Temp\
   C:\Documents and Settings\<userName>\Local Settings\Temp\
   C:\Users\<userName>\AppData\Local\Temp\ (on Vista/Win7/2008+)
2. Remove all copies of communicator.dat from the file system. Possible locations:
   C:\Windows\Temp\
   C:\Documents and Settings\<userName>\Local Settings\Temp\communicator.dat
   C:\Users\<userName>\AppData\Local\Temp (on Vista/Win7/2008+)
3. Delete HKEY_LOCAL_MACHINE\SOFTWARE\Symantec\Symantec Endpoint Protection\SMC\SYLINK\SyLink\HardwareID
4. Delete HKEY_LOCAL_MACHINE\SOFTWARE\Symantec\Symantec Endpoint Protection\SMC\SYLINK\SyLink\HostGUID

Deleting this seemed to have presented the issue

1. Delete HKEY_LOCAL_MACHINE\SOFTWARE\Symantec\Symantec Endpoint Protection\SMC\SYLINK\SyLink\HostGUID

When I didn't do it, seems to work ok.

These loggings are new to this forum. :)

Mostly used to trouble shoot wireless connectvity issue.

They are the one mentioned above.

What is the value you have here

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\RasMan\PPP\EAP\25 HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\RasMan\PPP\EAP\13



·         ConfigUiPath

·         IdentityPath

·         InteractiveUIPath

·         Path

C:\Program Files (x86)\Symantec\Symantec Endpoint Protection\12.1.2015.2015.105\Bin64\SymRasMan64.dll

Here is a screen shot

I currently have a ticket open with Symantec, who has CONFIRMED this to be a known issue, we are now running CWipe and installing the newest version. Will continue to update as I go

We are installing and testing SEP RU2 MP1

Affects only 12.1 RU2??

Would that surprise you sir?

I will check with the tech when I am back on the line.

SHOCKED!! but I'm on RU1 and not moving off until I see a build without a serious bug. This would likely affect us as well...

I feel like patient zero. :-)

I hate this version, it is the worst one that I have dealt with since SAV days.

I make sure to follow your posts in case I ever decide to upgrade, I know to check with you first to see if there are any bugs

That's awesome!!!

I AM patient Zero

Not always a bad thing. It's because of your unmatched sacrifice that the rest of us can sleep a little better at night!

Too funny, and when we DO  find the bugs and get past the annoyances, the NEW version comes out with a whole NEW set of problems!!! Woo hoo, go team!!!!

Rolling out 2093 did NOT do that trick, back to the drawing board with Symantec tomorrow.

More log collection will be needed, likely from Procmon as well.

This occurs during a repair or change, we are using Acronis to do the imaging...

Maybe something will be in the SEP_INST.log file

Nope, nothing in there. Looks like it doesn't write to this file when doing a repair, etc. Only on install

This did not work.

Doing this pretty much destroyed the image, now whenever I attempt to install SEP, it will not install and it says it is waiting for a previous installation or uninstallation and needs a reboot, 5 reboots later, the same problem exists.

I got it to work, I took off IPv6 for a little while, then released all IP's restarted and Wireless came back, I am NOT sure if this is the solution, but it is the first time I got it to work with Wireless and SEP installed.

Seems like something was preventing the wireless connection from picking up an IPv4 address.

I deleted the log, it was taking to much space up and I got tired of scrolling.

Any idea? I disabled the IPv6 for a few mins, restarted and it picked up an IPv4 address, once it picked up the IPv4 address, I re enabled the IPv6 and it still worked. This has to be something to do with IPv6

I know SEP fw blocks IPv6 by default. Maybe something funky there.

How do I unblock it? Should I unblock it?

The thing is, we don't even use IPv6 for anything. (Yet)

b-

Thank you shouldn't have to worry about it.

It's in the firewall policy

Block IPv6 and Block IPv6 over IPv4

Just uncheck the two boxes to disable the rules.

HERE is how I got it to work...

 OK, if I removed IPv4 and IPv6 BEFORE the smc -stop it makes no difference, if I do smc -stop THEN take away and re add IPv4 and IPv6 then I need to restart the PC. Once the PC is restarted it continues to work.

I tried to do this without restarting the PC and using smc -start and it did not work.

This shows me that SEP is in fact causing some issue with the networking.

I welcome any advice/suggestions ideas, comments I hope this can spark a permanent answer so we can go back to Symantec and inform them of this so that it will not continue to be an issue for others as well as myself.

I removed this because I wrote it incorrectly.

Does this spark any ideas? Thank you.

I believe this has to do with version 12.x mainly because of the fatal error messages we are getting when we attempt to change or repair the installation.

PIC for emphasis

The install disabled Windows defender, I am wondering if this has anything to do with this issue.

Stopping SEP

smc -stop

removing ipv4 protocol and restarting the PC is what got this to work.I just wish I know what the cause was.

The PC MUST be restarted as smc -start will not do the trick.

smc -stop is divine!!! I don't know what the CAUSE of the issue was, but using the smc -stop helped eliminated BOTH of my issues, the one with the wireless and the fatal error stuff. If you want to add/repair/modify do it with smc -stop.

The Wireless NIC is Intel(R) WiFi Link 5100 AGN, I noticed, it did this on a machine that was NOT part of our newest image, but the SAME exact thing happened after I updated the Wireless NIC drivers. Again, the resolution was the same, go the the properties of the Wireless NIC while SEP is turned off using smc -stop, remove IPv4, restart, then re addd IPv4. I am curious to know if there is something going on with the most recent driver for the Intel(R) WiFi Link 5100 AGN.

There is a bug with SEP 12.1 RU 2, 

check if this is the case: 

Migration from Symantec Endpoint Protection 11.0.5 or higher to Symantec Endpoint Protection 12.1 RU2 and removing Network Threat Protection causes network instability

Fix ID: 3063813

Symptom: When upgrading from a later version of Symantec Endpoint Protection with the firewall component installed to a Symantec Endpoint Protection 12.1 RU2 install package without the firewall, the network may not load upon reboot.

Solution: Updated the migration mechanism for removing Teefer3 components from prior Symantec Endpoint Protection versions during the firewall uninstall.

Sounds closer to what I have been experiencing, but this was not upgrading to a later version, this was installing the latest version on an image.