Endpoint Protection

I've been in the process of upgrading our laptops from SAV 10.x to SEP 11.0.4.  As soon as SEP is installed, shutdown times on our Vista machines go from under 1 minute to 5-7 minutes for a full shutdown.  This has happened on every single machine I've setup, including our freshly imaged laptops.

Is anyone else experiencing this?  Is this just par for the course, or is there anything I can do?  Needless to say, our users have been very unhappy.  I've been telling them to just put the computer into sleep mode if they're in a hurry, but I'd love a real solution.

Thanks,
Matt

Have not heard of this happening. I am assuming it is not happening on any of your other machines running different OS's, or are all of your machines running Vista? Does disabling SEP cause the shutdown times to happen normally? Also a few other normal questions if you don't mind:

1. What components of SEP do you have installed? ie) AV, NTP, PTP
2. Is this 64 or 32 bit Vista?
3.  Unmanaged or Managed clients? If managed what OS does the SEPM run?


Sorry for the question attack. Also I googled this issue since I hadn't seen this crop up in the forums yet, and it appears that maybe it is firewall related. I don't know why this would happen, but if you are using the SEP firewall temperarily set all of your rules to allow and see if that solves the problem. Again that was just from google and not a "Symantec" solution, but I thought I would post it none the less.

Cheers
Grant-

Are you using MP4 MP2?

Are you seeing DCOM errors in the Windows event viewer?

AV, PTP, and NTP are all running on each system.

The issue is affecting both 32 and 64 bit clients, though 99% of all our machines are 32b.

They're managed clients.  The SEPM is running on a 32 bit Win 2k3 SP2 server, 1 ghz cpu w/ 4 GB of RAM.

As for the version, it's 11.0.4000.2295 (not sure what MP that is or how to find that out...)

XP machines don't appear to be affected.

I'm getting a ton of normal looking DCOM 10029 events (4 to 8 a day), and a few DCOM event 10010 errors a week (which actually appear to be occuring at startup and shutdown for the most part).  The DCOM errors each say something along the lines of  "The server {AB8902B4-09CA-4BB6-B78D-A8F59079A8D5} did not register with DCOM within the required timeout."

I'm about to try shutting down after disabling SEP, I'll update this again in a few minutes.

Disabling SEP might have shaved off about a minute, but 4 mins compared to 1 min is still pretty ridiculous.  I didn't get any DCOM errors when shutting down w/ SEP disabled...

There is an open case with Symantec for this issue (build 11.0.4000.2295). The only diffference is the issue is happening on XP clients. I would open a case with support for your issue.

Thomas

Do you have any log-off scripts running?

Hello Emsmith,

Are you still seeing the slow shutdown time issue? Can provide an answer to Paul's question?

Thanks

We have one log-off script, which clears out the page file.  That's it.  But when SEP isn't installed, this doesn't affect shut down time.

I would try testing with the latest build 11.0.4202.75 (MR4 MP2), and see if you still experience the issue.
Sorry that I did not mention this earlier.

Are you running SP2 on the clients? Vista SP 2 addresses many performance issues.

I have SP2 on my own machine, along with a few of our other users' machines.  It appears to make no difference.  I'll talk to the rest of our department about the MR4 MP2 upgrade.

Thanks!

I tried upgrading to MR4 MP2 as suggested, but the issue still persists.  Any fresh ideas?

There was a new release since your last post. RU5 (AKA MR5) was released a few weeks back. There are a few Vista fixes in this build, but nothing about a slow log in time is showing up in the release notes. You might want to give that build a try, or else open a case with support to help get to the root of this issue.

Thomas