Endpoint Protection

Hello all, I have been struggling for weeks to try to resolve an issue that I cannot find a solution for. My company uses Symantec Endpoint Protection on our clients and servers and we also run an application called ADP Enterprise Etime, which manages our time clocks and payroll. When a member of our HR department does the company's payroll, she runs a report through Etime which extracts data from a MySQL database on the ADP server. The only problem is that something within the SEP on the server blocks her from doing this. We consulted with ADP, who said this is a common issue, but to date they have been unable to resolve the problem. They've set exceptions to the proper files and have been in the server several times to fix this issue, but to no avail. I have personally been troubleshooting the issue and have been unable to find the issue. What we do know for sure is that when we disable SEP on the server, she can run the file every time.

Basically, I'm wondering if anyone else has ever had this issue or if any of you know of a way to fix this. It's gotten to the point where if I am unable to come up with a solution, my boss has said that we will remove SEP from the server and replace it. Any ideas?

What version of SEP is this?

What components do you have installed? Install only the AV component and see what the result is.

On the server, the version of SEP is 12.1.1000.157 RU1.

We have disabled Download Insights permanently and in the process of troubleshooting we disabled everything but the Auto-Protect. The biggest headache has been the fact that this has not had consistent results. After we disabled Download Insights, the problem was resolved for about a week. Then, one day without any known changes it stopped working again. This has been the case for everything we have tried to disabled short of disabling the entire application. The following is what I was able to successfully troubleshoot:

The program will not run properly with Download Insights enabled.

I also was forced to make the following change: In Auto-Protect, under the Actions tab, I had to set the Remote Access Scan Action to Leave Alone (log only). This worked for about a week also but eventually our payroll specialist needed us to disable the program for her again. All of the settings appear to remain the same, but we are getting inconsistent results.

Fully remove all components accept AV

I spoke with the Network Admin and when we installed SEP on this server, he only installed the Virus and Spyware Protection. None of the other components were installed. The settings I've been changing are within the AV component itself.

What is the result when you disable Auto-Protect? (not ideal, I know but for testing purposes)

Also, the latest version is RU1 MP1, so you're a version behind. And the next release, 12.1.2, is due out November 6th.

When Auto-Protect is disabled, this usually allows the payroll specialist to download the file. Last week, I dug into Auto-Protect and that's when I found that if I changed the Action for Remote Access to Leave Alone, it would work without our intervention. I thought this was finally the answer we were looking for, but yesterday she was unable to download the file, so something else is causing the problem.

Your best bet will be to open a support ticket with Symantec so they can investigate further.

You can try to upgrade to the latest version as the auto-protect functionality is constantly improved but support should have the ability to use internal tools to take a deeper look at the problem.

Okay. I will do that. I appreciate your assistance greatly and hope that we can come to a reasonable solution.

If anyone else has had this issue in the past, please let me know what you were able to do to come to a resolution, and I'll post again if Symantec Support is able to locate the issue.

Please keep this thread updated if you can. From time to time, issues with apps like this arise and rarely do we get a final update.

Okay. I have opened a support case and hope to have a solution ASAP. I will try to post the result of their troubleshooting.