Endpoint Protection Small Business Edition

Hello,

The company I work for just recently purchased and installed Symantec Endpoint Protection Small Bussiness 12.1 (it has been about 1 month since installed). Nearly every department  has started complaining about their computers being extremely slow since then. I have tried disabling Proactive threat protection on a few and that didnt not seem to help very much . I have also tried making a few unmanaged clients and that did not help at all. Are there any settings or changes that anyone would suggest changing to help speed up the computers?

Server with SEPM spec

Windows server 2008 R2

Dual core 2 duo processor

2GB ram

Most clients

Win XP SP3

Pentium 4 CPU @ 2.80 Ghz

1-2GB ram

 SEP version 12.1.1000.157 RU1

Thank you for your time

Hello,

Could you please let us know what Process is taking the highest CPU & memory usage and how much?

Is the SEPM performing any aother activity other than being a SEPM server?

Is there a Network application which accessing the network continously?

Thanks for the help,

After checking a few computers the  process taking up the largest memory seems to be iexplorer.exe running 2-3 times taking up a total of 150,000k-200,000k and the highest CPU  usage is "System idle process"

The Server has nothing installed on it except SEPM  and SEP and i have only changed a few settings to make the server be able to see and deploy SEP to a few Windows 7 machines on the network.

That's internet explorer.

Do these machines do anything special (software?) Or are they your standard inet browsing, MS Office, apps on there?

Are they slow all the time? At a certain time? What are the user(s) doing when it's slow?

Possible virus in your network? What AV product was on these systems before you installed SEP? Try running a scan using the Power Eraser tool, and see if anything gets picked up.

See the following thread for more information on detecting and removing a threat.

https://www-secure.symantec.com/connect/forums/your-system-infected-symantec-tools-help-clear-infection

The pc's are all vary in what they are running, but the most comon would use MS office and iexplorer with other programs that run specifically off our servers and dont require much from the pc. They predominatly slow down when on the internet but aren't limited to only then; however, this was not as huge of a problem untill i installed SEP 12.1 the machines. Before SEP 12.1 the machines either had Microsoft essientials or an older version of SEP depending on the computer.

And Thomas i will try the Power Eraser tomorrow and let you know if it catches anything!

Thank you very much for the help!

I have the same exact problems.

We were previously using AVG and had no performance issues at all.

After replacing it with Symantec Endpoint Protection small business edition we've had nothing but complaints about performance.

i have disabled real time scanning, set all clients to the high performance policy, firewall/network threat protection is not installed.

workstations are not high end, windows XP SP3 fully updated, 4GB of ram in all stations but dual core celeron CPUs.

from what i'm reading this is just to be expected with symantec endpoint protection, there are a ton of complaints on the internet about the product causing system performance to drastically decrease after SEP is installed.

the client is ready to switch back to AVG and is demanding a refund for recommending symantec to them.

The SEPM is running on Small Business Server 2003 which is also their domain controller, file server, print server, exchange server, etc.

This is a shot in the dark, but try disabling Insight lookups for a test and see if this has any impact on performance.

How does Insight Lookup work? - http://www.symantec.com/business/support/index?page=content&id=TECH169282

unfortunately that had no impact.

i uninstalled SEP on one of the workstations and performance dramatically increased.

reinstalled it and it instantly went back to being horrible again.

i have this configured so real time scanning is shut off, network threat protection is not installed, Outlook add-in is disabled, only set to scan once a week when they are closed on weekends, cloud scanning is disabled, etc.

i'm starting to think that this is just a bad product, if you need to shut off a majority of the functionality to get borderline acceptable performance out of it, what's the point?

in reviewing these forums and elsewhere it seems that most of the complaints are coming from XP stations. 

has anyone had any experience on if these performance issues seem to be related to XP vs Windows 7, or is it just that a windows 7 system will come with better hardware?

Does your XP computers meet the minimum system requirements?

Have ou tried a bare bones installation of only AV/AS.  Strip away the rest.

Next open internet explorer.

- tools -> internet options

- - Programs -> Manage add-ons

- - - Disbale or remove Symantec Intrusion Prevention add-on.

* * * * * * *

You will now have an AV/AS solution equivalent to the amount of protection provided by AVG.  I.E.  Only Anti-Virus and Anti-Syware.

Test if performance has increased.

thanks, i will give that a shot.

these systems have pentium-D (roughly 3 years old) CPUs, 4GB of ram on 32 bit windows xp.

The Ram amount looks good, from reading your stories i'm really not sure what causing it.

What time full scan is run?  Maybe try @Jason's suggestion and remove all component except AV & AS.

See if any changes.

using only AV & AS component should help to narrow down the issue, also are the comuters running slow all the time or is it on some spicific time. 

  Are the systems set to scan daily or weekly.

For the company i work for the scans are set to run either on weekends or in the middle of the night depending on where the computer is located so that is not the problem.  However i will also try what Jason suggested on a few pc's to test it out; However i dont like that my boss spent so much money on this software to disable almost every feature on it, ideally we want to keep download protection, E-mail protection, and automated scans on at all times.

We do have a few windows 7 machines running SEP without any problems, but that could also be because they are newer machines with 4GB+ RAM  and i7 processors  instead of p4 with 2GB

I agree that the amount of money spent, to remove most components is not ideal.

However, we need to be able to narrow the scope and figure out where "the slow down" is coming from.

We will be able to re-add the components afterwards.

First thing to determine is, is it the AV/AS portion causing the issue.

Once ruled out, it is not likely to be App/Dev control or the firewall.

IPS can be greedier as well as download protection and automated scans.

* * * * * *

You can try

http://technet.microsoft.com/en-us/sysinternals/bb896645.aspx

Or create some custom WMI traps in XP to monitor the SEP process directly.

See what component(s) are the greediest causing the slow down.

When you say that they "slow down" is it CPU? RAM? HDD? ie. is the HDD constantly churning away or does everything freeze intermittantly.

What is the end user experience precicisely i.e. Internet Explorer takes 10 seconds to load or Outlook always says Disconnected something along those lines.

In my experience when people say their machines are slow its always down to a browser being slow so I'd just like a bit of clarification on that front.

Thanks!

Some of it could be the scan technology changes in 12.1.  I know that we kept some clients on SEP 11.x because network share applications perform a lot better on SEP 11.x vs 12.1 RU1 MP1.  It didn't matter what components were disable/uninstalled, SEP 11.x just performed better.

hmm i thought the new 12.1 is faster than 11?

Not when running applications from network file shares.  It is better in all other areas though.

we deployed sep12.1 on about 200 computers, we have those os types: windows xp, windows 2003 enterprise edition (32bit and 64bit),windows 2000 server, windows 2008 server.

but recently,we find a problem on 2 computers,both are windows 2003 server.

several days after the sep installing, the server did no response to any operation ,whether by mouse or keyboard.

i think it's a serious problem, but when i call the symantec customer service line, they didn't give any helpful

suggestion or information,

since the server is very important ,we don't have time to do too much troubleshooting to find the problem.

to resume the service,we had to reboot the computer, and uninstall the sep12.1 client.

well, we still worry about this issue. does any one find a solution or better ideas about this problem.

any information is appreciated.

I am having a similar issue with my Windows 7 clients and my Windows 2008 Servers also. I have my CPU jumping from 4% to 100% spikes and what is causing the spikes:

smc.exe,smcgui.exe(3 listed with 3 PID's?),PortectionUtilSurrogate.exe(3 also running)

The program will eat as much memory as possible no matter how much you upgrade the physical hardware or Virtual Memory. This is clearly poor programming and has been causing alarms on my DC's and DB servers. From the threads and what I have read nothing can be done except go with a new product.

We ran 12.0 and had major issues so we downgraded to 11. but it still is a hog. What I find most interesting is that these servers are Virtual and have nothing much on them running, I could see if this was an old server that has been used for years with tons of updates and what not. I have tried disabling scans, and features which is unacceptable. What products does anyone know this is certified to run on? I cant imagine they have not loaded this on any machines before pushing it out without seeing how much CPU and RAM It is consuming.

There is a memory leak causing such behavior in Windows XP. Make sure that your machines are patched with this:

http://support.microsoft.com/kb/959658

Also, your problem is with the RAM. SEP requires more RAM because the way the definitions works.

Is there anything showing in the logs?

Hy we have same problem after upgrade our clients to SEP 12 RU1 MP1, some cliente with WinXP SP3, was very slow, and now We identify that all clients who updated from WSUS, was slow too.

So, you can resolve the problem? Any Idea??

Also having the same problem, my systems are also losing time because of SEP. Symantec has always been famous for having a programs that sucks up LOTS of resources. My new fix is not to bang my head on the wall anymore I am now installing Microsoft Security Essentials on all of our systems. Problem Solved!

Best of luck to the rest who like banging thier heads!

Anyone still active on this thread?

I've found that the major slowdown in our office is related to "Browser Intrusion Prevention" when running Internet Explorer 9.  Browsing is drastically slowed when this option is ON.  Turning if off restores normal performance.  Also, no performance degradation is seen when using IE8, Firefox, Safari or Chrome.

Anyone have suggestions to offer for fixing this issue aside from switching browsers?  We have some IE required functions that restrict us a bit.

Thanks in advance.

Todd

Hi Todd,

You should check the performance using latest SEP version. Latest SEP version is SEP 12.1 RU2.

Hmmm...  I just downloaded and pushed out what I thought *WAS* the latest.  12.1 RU1 MP1.

Is this a known issue that has been resolved?

12.1.2 is out tomorrow.

Hi,

In the release note of Beta version I don't see any specific known issue.

If issue is not resolved in the latest version then please get in touch with support to troubleshoot it further.

SEP 12.1.2 released........... lot of enhanced features in latest build...

Upgrade it will fix most of the issues

https://www-secure.symantec.com/connect/forums/sep-1212-has-been-released-finally

Hello,

Symantec Endpoint Protection 12.1. RU2 is Released Today.

You may find the Latest Release of Symantec Endpoint Protection 12.1.RU2 from: https://fileconnect.symantec.com/

Upgrade and Migration paths

Symantec Endpoint Protection 12.1.2 (RU2) can upgrade seamlessly over the following:

• Symantec Endpoint Protection 12.1.1101.401 (RU1 MP1)
• Symantec Endpoint Protection 12.1.1000.157 (RU1)
• Symantec Endpoint Protection 12.1.671.4971 (RTM)
• Symantec Endpoint Protection 11.x (can be upgraded to enterprise version only)
• Symantec Endpoint Protection Small Business Edition 12.0

Reference:

Latest Symantec Endpoint Protection Releases - Symantec Endpoint Protection 12.1. RU2

Note: If incase you do not see the SEP 12.1 RU2 Release on Fileconnect, you may see the same in few days on your Fileconnect Account.

Hope that helps!!

Hi,

In case you see SEP 12.1 RU2 available for download then it might be in English Edition only.

For local languages you might have to wait for few more days. (Probably till 30th Nov'12)