Endpoint Protection

Hi!

I'm now monitoring our SAV Parent servers for a while and made some changes due to network drive scan and else in the client configuration administrative options. I thought that this changes will be passed on to the clients after awhile or maybe after their reboot. But they still keep the option i.e. "scan network drive" or "lotus mail scan"  when I view them directly or via SSC console.

Why don't the clients take this changes in configuration? (Firewall is off, all sym services running, all clients have the same version number) How can I force the clients to take this new configuration?

Best regards,
DWMIT

Please check this document this is how the clients take the change.

http://service1.symantec.com/support/ent-security.nsf/docid/2005041910541048?Open&src=tranus_ent_br

if the clients are not taking the changes means they are not communicating with the parent server.

Make sure you checked all the below steps.


Troubleshooting communication problems with Symantec Client Security 3.x or Symantec AntiVirus Corporate Edition 10.x

http://service1.symantec.com/SUPPORT/ent-security.nsf/docid/2005033015282148?Open&src=tranus_con_sl

If you have create a group for those client then copy the GRC from the folder "\\server\\VPHOME\Groups\<Groupname>"

Try to replace the above mention GRC it should work...
 

Hi!

Checked this no in detail. Clients are communicating with the parent server. Whenever I make changes, the GRC.DAT is copied to \\Client\Documents and Files\All Users\Application Data\Symantec\Symantec AntiVirus Corporate Edition\7.5. by the parent server.

After that it take a 1 to 2 minutes to compile the GRC.DAT on the client, then it disappears. Bot i.e. I have changed the option that network drives will not be scanned or not including Lotus notes scan. These changes are not set on the client. of course I can set them manualy on the client. How come?

How can I see in the GRC.DAT that these options are set correctly? Didn't find any ScanNetWorkDrive=1 or else in the GRC.DAT.

The clients are pingable, no firewall. Checked all below.
What else can I do?

DWMIT

Hi shp!

Thanks for the answer.

There is no group for any of our clients. They are directly connected to the parent server. Whenever I click on the parent server in the SSC all the managed clients appear right.
Should I create a group to work around this problem?

If you are not able to find changes in GRC(VPHOME) you can try with the group.. The grc file under that group should reflect the changes made in the console for that group..... 

Did you check the registry in those clients... regarding those settings...

Hi!

Well, I found out - via comparing the two GRC.DAT in a text editor -  that i.e. checking or unckecking network drive scans changes the parameter NETWORK=D1 to D0 in the GRC.DAT. The server passes the new created GRC.DAT to the client. After awhile the GRC.DAT disappears from the folder and seem to be processed by the client. I can see the GRCUpdateTime is different from before.

But where can I check under HKLM/Software/intel/LanDesk/VirusProtection6/CurrentVersion that the network parameter has chenged?

Greetz!
DWMIT

For network scan its this key

HKEY_LOCAL_MACHINE\SOFTWARE\Intel\LANDesk\VirusProtect6\CurrentVersion\Storages\Filesystem\RealTimeScan

on right hand side you will find a key called Network, 0 is disabled , 1 is enabled.

About Network Scanning Options in Symantec AntiVirus 10.1 and Symantec Client Security 3.1

http://service1.symantec.com/SUPPORT/ent-security.nsf/docid/2006030817095748

if you want to edit your GRC.dat you can use configed.exe which can be found under tools folder in CD1 of SAV
it has a pdf file, read that, you know what are getting changed when u uncheck each option.
 

Thanks Rafeeq!

I was not primarily to edit the values by hand, it was more to see, if anything is happening at all on the client by using this network scan parameter as an indicator.

I just want to find out: Does the parent pass on the GRC.DAT to the client?
If yes, does the client proecesses the new GRC:DAT?
If yes, do the chenged paramters make it to the regitsty?
if so, does the client accept the new parameters?

Somewhere between this I'll find the solution for the problem that the client's are not taking the configuratiuon from their parent server.
...