Endpoint Protection

Hi,

We just upgraded our Symantec Endpoint Protection Management server to 11 RU6 MP1 (11.0.6100.645). The new version is creating a broken installation packages.

I want to create an installation package for installing managed clients. I don't need firewall part of SEP, so I leave it out. When I install this exported setup.exe to Windows 7, it does not work like the installation packages from the previous version of SEP. SMC gui on the client computer says that it has only 'Antivirus and Antispyware Protection' and 'Proactive Threat Protection' installed, but Windows firewall complains "These settings are being managed by vendor application Symantec Endpoint Protection". Also Windows Action Center says that Windows Firewall is turned off. So, there is no Symantec firewall, and it seems that also Windows firewall is turned off. Not a nice situation...

Any ideas?

Best,

Olli Rajala

Restart the client once and see any difference is present....

Also try by disabling firewall through registry(Just for testing)

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SysPlant

Change the Value of Start to 4 . 1 –means enabled.

When creating the install package, are you accessing your SEPM via a remote session that is not giving you console access?

Title: 'Product corruption or failure appears during an installation or migration while using an improperly configured remote session.'
http://www.symantec.com/docs/TECH105135

sandra
 

Restart the computer and modify SEP from Add/Remove pgms..

Hi,

Thanks for all suggestions. Unfortunately they didn't help. There is no SyPlan-registry key, and it doesn't matter whether I create the installation package through remote desktop or local console.

I investigated this problem more, and I am a little confused. Right now even the autoupdates from SEP server brakes the client. I mean, I install a working version (the older RU6a) created with the RU6a server and have no problems. Then I let the server (RU6mp1) update the client to MP1 and this problem occurs.

If there is something else I should try or check, I'd be glad to hear about them.

- Olli Rajala

"There is no SyPlan-registry key" means NTP/Firewall component of SEP is not got installed.

In your corresponding group AV/AS policy go to--->Miscellaneous-->Windows security center and check the settings  once again.. 

Ragol,

Did you ever figure out a solution to this problem. I just upgraded my server to 11.0.6 MP1 and get the same error that you did on Windows 7 when I push out the updated client. "These settings are being managed by vendor application Symantec Endpoint Protection". Also Windows Action Center says that Windows Firewall is turned off.

I only have the Antivirus and Antispyware Protection installed so the firewall should still be managed by Windows and not have the message that it is managed by Symantec Endpoint Protection.

Sbaylis,

No, we haven't found a solution. Have had other problems so I have not had time to debug more, but would also like to hear a solution, because this is more than problematic situation.

I'm actually glad that some one else is having the same problem, because now it is more unlikely to be only my mistake somewhere. :)

open add/remove programs

select symantec edpoint

select modify

install NTP;

reboot the box and then follow the same steps to remove NTP.

check if that works.

Hi rafeeq,

No, changing the installed status of NTP did not help. I modified it like you suggested, but it is still broken after removal of the NTP.

And besides, even if this trick would work, it wouldn't be very useful method in an enterprise environment... :)

See this post as it may apply:

https://www-secure.symantec.com/connect/forums/what-does-sep-ru5-do-windows-firewall

True to the comment made earlier, I have tested SEPM and ever since I upgraded to 11.0.6 MP1, it doesn't create the client export package correctly.  It stuffs in IPS even though my package instructions specifically select only AV and PTP; thus, when the client gets installed with this package, the firewall is enabled.  It has nothing to do with running in a console session.

Brian81,

After reading that thread I tried to stop the windows firewall service and start it again. It works. But it is not a useful solution. I mean, who wants to restart the firewall in every computer every time they start? Not a very secure solution in an enterprise environment...

Symantec....ARE YOU SERIOUS?  This is enterprise software and the only reason why I upgraded to MP1 is to try to remove the TMP Trojan bug.  Now there is this bug which kills/corrupts the windows firewall???  And I don't even know if the TMP Trojan bug has been fixed yet.

I don't want to run your firewall.  I chose not to include this when installing.  And your software tried installing it anyways!!!  What are you people doing?  Obviously not trying to make your software better.  I don't know what VT is paying for this software, but they are wasting money.

All of our windows 7 clients are getting "windows firewall is turned off msg" and rebooting and the fixes above DO NOT FIX THIS!

If anyone has any fixes for this bug please comment here or email me.

Thank you

Stephen

Newman Library, Systems Dept.

Virginia Tech University

srecht82 <at> <vt> <dot> <edu>

UPDATE: Found this other post which could possibly help.

http://www.symantec.com/connect/forums/windows-firewall-saying-sep-managing-it

Scroll down to the solution and it might work for you.  I have tried it.  Gonna wait and see if it works for me.