Endpoint Protection

 View Only
  • 1.  SCS - After Uninstallation, network acts odd

    Posted Dec 07, 2010 03:56 PM

    I have a few machines in my organization where Symantec Client Securities have been uninstalled. After uninstallation, without any other network threat protection software running, all inbound connections to the endpoint device are completely blocked. Connections initiated by the endpoint device work fine and in most cases, it does not affect productivity of the end user at all. In a few instances, like laptops, it becomes a huge inconvenience when trying to assist the users with things like installing printers. 

    Does anyone know the root cause of this issue? The activities to reproduce the issue include uninstalling SCS then restarting. After restarting I verified that the Windows Firewall/ICS service has been disables per local machine policy and that the machine is connected to the network. From a different computer initiating an RDP connection, an RPC connection, a remote adminstrator connection (port 4899), and a simple IPC connection attempt all fail. All inbound connections fail. Uninstalling and reinstalling the driver may work.

    This issue was first observed after uninstalling SCS and installing SEP. SEP does not seem to be the problem as simply uninstalling SCS and disabling Windows FW/ICS still creates the problem. It seems to be on a lower level (something SCS does upon installation).



  • 2.  RE: SCS - After Uninstallation, network acts odd

    Posted Dec 07, 2010 04:02 PM


  • 3.  RE: SCS - After Uninstallation, network acts odd

    Posted Dec 07, 2010 04:15 PM

    Does just disabling FW/ICS service does the same ?



  • 4.  RE: SCS - After Uninstallation, network acts odd

    Posted Dec 07, 2010 04:32 PM

    Have you tried installing SCS again on the computer to check if the issue still remains same?

    Also you can try manual removal, below is a document use it to check if there are some files or remains of SCS

    Title: 'Manual uninstallation documents for Symantec Client Security products'
    Web URL: http://www.symantec.com/business/support/index?page=content&id=TECH99631&locale=en_US



  • 5.  RE: SCS - After Uninstallation, network acts odd

    Posted Dec 07, 2010 04:58 PM

    Hey guys, thanks for the fast response. I'll respond in order:

    1. Rafeeq - The issue doesn't seem to be RRAS related. The client devices (Windows XP SP2 and SP3) are able to pull network resources just fine. So they can log into the network, browse the internet, and pull network drives and data just fine. You cannot however initiate any sort of connection to the XP machines. So for example, if you had a remote administrator application running, and you attempted to connect to the XP machine, it would get denied. It happens will all remote calls to the XP machine from another device (RPC, RDP, even FTP if you were to setup a server on the XP Machine)
    2. Vikram - The issue persists when FW/ICS is disabled. By default, per group policy and local policy, the Windows FW/ICS is disabled. On the machines I have seen with this problem in the field, FW/ICS is disabled.
    3. Mudit - Once you reinstall SCS, the problem disappears. However, if you change to a lax policy (IE an Any/Any policy) then uninstall, the problem reappears. I will try the link you provided. 


  • 6.  RE: SCS - After Uninstallation, network acts odd

    Posted Dec 08, 2010 04:24 AM

    My question could be trival but after reboot - does the network connectivity start working fine again? The driver will be removed,reconfigured at reboot only if it a kernel level driver...