Video Screencast Help

Secars error message

Created: 28 Jan 2008 • Updated: 22 Oct 2010 | 14 comments
Event ID: 4097
Source:   secars
Error Message from the Computer:
Failed to start Radius Server.The radius port may be used by another process.
I keep getting these messages. We do not even run  radius server. How can I make this go away?

Comments 14 CommentsJump to latest comment

GrahamA's picture
Just to check, are you also running the Symantec Network Access Control functionality? You can quickly check by going to the 'Policies' page within the console and seeing if 'Host Integrity' is listed as a policy type.
Typically, RADIUS related msgs should only be relevant to the Symantec Network Access Control functionality.
Also, could you try START > RUN > CMD, then at the DOS prompt, type in netstat -a -b, review the results and look for port 1812 or the relevant line may mention radius instead. If you see either of these, the -b switch should confirm which exact executable is currently tied to the  open socket.

GrahamA Product Management, Symantec Security Solutions

Steffen's picture

Hi. I have the same problem. The server are not running the Symantec Network Access Control functionality. I tried "START > RUN > CMD, then at the DOS prompt, type in netstat -a -b, review the results and look for port 1812". Nothing on port 1812. The error is logged every other day at AM 4:01. How to solve it? Regards Steffen

M2TheJ's picture
I am also getting the 4097 error along with:
Event ID: 4096
Source:   secars
Error Message from the Computer:
Create Log File Error!
Has anyone come up with a solution for this?
Nolan Tininenko's picture
Instead of typing "netstat -a -b" at the command prompt, try "netstat -a -n -b".  The -a displays all, the -b displays the PID, the -n converts everything to numerical form.  In your previous result you could look for "radius", but with the -n switch it should display "1812" instead of radius.
BTW, I'm getting the same errors, but I've been using IAS.  I think it's ridiculous to have to reconfigure a common service to work around Symantec's product.
doyouwantmore's picture
We have the same problem(Event ID 4096 & 4097) on two SBS 2003 R2 SP2 sites following an Endpoint rollout. It was my understanding that MR1 would fix this issue. Has this not been the case?
Nolan Tininenko's picture
It certainly doesn't look like it.  I'm running MR1 on SBS 2003 R2 SP2.
JT2's picture
Change the ports for IAS Radius. Ridiculous to use a common service port, many ports available, but always using the same.
GrahamA's picture
I have more info re this issue now. It has since been fixed and the fix is due to appear in our next maintenance release, MR2, which is due toward the end of March.
The fix will ensure no conflict occurs between an existing process bound to the Radius port (such as IAS) and the SEPM.

GrahamA Product Management, Symantec Security Solutions

Nolan Tininenko's picture
I'm glad to hear it.
I had changed the port for IAS a while back but have still been getting the messages.
Dennis Martinez's picture
We are in the process of deploying SEPM and SEP throughout our network.  Got the SEPM on a W2K3 Standard and we are also seeing these events logged in the early am.  The server does not have IAS enabled.  I just want to verify that someone else is using W2K3 Standard with IAS disabled and are getting these errors.
4x3combo's picture
Grahm.... I am getting the same errors ( Secars 4096 and 4097) every other day.   How do I check to see what version I am currently running. If I don't have the latest version.......where do I get it in order to stop getting these event codes?   Thanks
Paul Murgatroyd's picture
from the SEPM, click About on the toolbar, if you don't have 11.0.2000.1567 or later you should refer to the sticky here:
on how to go about downloading the latest version

Paul Murgatroyd
Principal Product Manager, Symantec Endpoint Protection
Endpoint twitter feed:

Melbourneben's picture


I'm having this very same problem and I'm running version 11.0.5002.333, does anybody have a solution for this? I've tried changing the port in the config and restarting the IIS service but no joy.


rkstr's picture

I'm having the same problem using 11.04.000.  Any way to correct it?  Will moving to RU6 solve the problem.