Endpoint Protection

Hey all.

Bit of an issue.

I had a server 2003 system get a request from SEP to reboot the other day for something that I have not been able to trace down.

It shows in the system event log, three entries

MSI Installer running for SEP
Installation finished
Requesting a reboot

Not sure why this happened and here is the reasons why.

The Server is in it's own container seperate from all the others.
Nothing was installed on the server nor was anything changed in the container.

None of the policies were changed as well, so this is a real brain scratcher

Any ideas as to where to look, have not been able to trace down the log files on the server yet, so if someone could point me to the right direction that would be great.

Thanks
Dan

was the reboot initiated from SEPM console?
did you install Network threat protection coz that will ask for reboot
open sepm
under the home tab
there is a option called reboot required; click on that ; check why its showing your machine.

Int he SEPM go to Monitors > Logs > System > Client-ServerActivity OR Client Activity.  Click Advanced and enter the server name in the Computer field.  Set the time frame to something long enough to cover when this event occurred and set the Limit to 1000 entries.  Hopefully this will shed some light on it for you.

Good tip.  I did not know to click on Reboot Required to see the reason for the reboot on a particular machine

Rafeeq:

No, at the time there was no one logged into the console besides myself and I was in another part of the tree at the time.
It was already installed, but it has been disabled.

Thanks
Dan

Hey, another question for you, if the firewall componenet is installed but disabled and gets an update.

Does the firewall re-enable itself and apply the update, require reboot, to disable itself???

Thanks
Dan

if it was installed ; it will get an update from SEPM 
Needs a reboot; check the reboot required in the status summary ( in home tab)
you might find the reason..do you see any machines say reboot required ( whats the count u see there)

Hey.  I actually see a bunch of system there needing reboot.  Not the one that needed it however, probably because it has already been rebooted, but ALL of them say it is because of Network threat Protection component has a product patch to apply.

Thats the reason then...:)
As you have rebooted the entry is removed from the list. It was NTP patch which requested reboot.. :)
monitors-logs
system
client activity
click on advanced
put in your server name
create the log
check if NTP patch was updated.
you should find one
Let me know if you have any other questions..

so the firewall no matter if it is disabled or not will get a patch and then require a reboot?

The firewall component is installed but not enabled( disabled by you)
however the smc will do the job of getting definitions for all the components installed.

So even tho it was disabled by me, it still will do a reboot after getting updates for a component that was disabled

it wont reboot; it would say reboot is required.

Okay, then if that is the case, why would the system stop responding during this request, when it happened the system was working fine, then did the update, then requested a reboot.  During this time, the program (remedy) stopped responding and the system became unstable.

would it be because the system was trying to activate the firewall to install component before reboot?

Thanks
Dan

sorry for so many questions: I am getting heat over this.

It Looks Windows update and SEP install colided with each other..So 2 or more request cannot be postponed for system reboot.
SO call it a reboot fir windows update or SEP install..but you will have to reboot.

Hi Vikram,

I had the same problem, but everything is fixed now. Thanks for the support.
I rebooted the client I was having the problems with (2008 server R2) and everything is fine now, but on the “Home” page the client still show “Restart Required” even though I rebooted the server a couple times. The reason is The “Network Threat Protection component has a product patch to apply” but the Network Threat Protection feature is not installed in this client. I removed and reinstalled the client and rebooted the server and the “restart required” status will not go away. How can I make this status go away?

Thanks

Ray