Video Screencast Help

SEP Citrix issues

Created: 11 Oct 2012 | 9 comments

Has anyone had issues with SEP causing blue screens on Citrix W2K3 servers?  I am experiencing isolated issues on a handle of Citrix servers.  Most of the fleet is not having any issues.  I am not convinced the SEP is the culprit, but our Citrix team seems to think so.  I'm just sending out feelers to see if anyone has experienced the same.

Comments 9 CommentsJump to latest comment

pete_4u2002's picture

well, enable the full dump and pass on the logs to support team.

hope you are using the latest version of SEP client

.Brian's picture

What version of SEP and what components are installed?

Please click the "Mark as solution" link at bottom left on the post that best answers your question. This will benefit admins looking for a solution to the same problem.

P_K_'s picture

There  are some issue that aare fixed in 12.1 Release Update 1 Maintenance Patch 1 for cirix. If possible try to install 12.1 Release Update 1 Maintenance Patch 1 and see if that helps

Citrix EdgeSight for Virtual Desktops application errors
Fix ID: 2608836/2637570/2647457
Symptom: Citrix EdgeSight for Virtual Desktops is installed with SEP and the Application and Device Control feature is enabled. Several applications may terminate unexpectedly after the computer is restarted:
“Rundll32.exe – Application error: The instruction at 0x75447740 Referenced Memory at 0x75447740. The memory could not be written.”
“Wermgr.exe – Application error: The instruction at 0x75447740 Referenced Memory at 0x75447740. The memory could not be written.”
“WerFault.exe – Application error: The instruction at 0x75447740 Referenced Memory at 0x75447740. The memory could not be written.”
“Userinit Logon Application has stopped working”
Solution: A method to get the volume name for a mount point was moved from the Application and Device Control DLL (sysfer.dll) into the driver (Sysplant.sys) to resolve this issue.

MCT MCSE-2012 Symantec Technical Specialist (SCTS)

P_K_'s picture

http://forums.citrix.com/thread.jspa?threadID=245085

Disable Tamper Protection and  I m sure that would help

disable the Symantec tamper protection filter driver - SPBBCDrv.

This is done in the registry:
HKLM\System|CurrentControlSet\Services\SPBBCDrv
Set the Start value to 4 (which means disabled) and reboot the server.

http://www.symantec.com/business/support/index?page=content&id=TECH162566

MCT MCSE-2012 Symantec Technical Specialist (SCTS)

Mithun Sanghavi's picture

Hello,

What version of SEP 11.x / 12.1 are you running ?

Has the Best Practices for Symantec Endpoint Protection on Citrix and Terminal Servers followed?

Check this Article: http://www.symantec.com/docs/TECH91070

However, for further investigations on BSOD, you would have to collect the Full Memory Dump files and create a Case OR contact Symantec Technical Support.

QuickStart Guide - Create and Manage Support Cases in SymWISE

http://www.symantec.com/docs/HOWTO31132

How to update a support case and upload diagnostic files with MySupport

http://www.symantec.com/docs/TECH71023

OR

Regional Support Telephone Numbers:

United States: 800-342-0652 (407-357-7600 from outside the United States)

Australia: 1300 365510 (+61 2 8220 7111 from outside Australia)

United Kingdom: +44 (0) 870 606 6000

Additional contact numbers: http://www.symantec.com/business/support/contact_techsupp_static.jsp

Hope that helps!!

Mithun Sanghavi
Senior Consultant
MIM | MCSA | MCTS | STS | SSE | SSE+ | ITIL v3

Don't forget to mark your thread as 'SOLVED' with the answer that best helped you.

nwranich's picture

We are running RU7 MP1 on these particular servers.  Memory dumps have already been sent to Symantec for review and the best practices document has been reviewed and the needed changes implemented.  

.Brian's picture

Are you still getting the BSODs?

Please click the "Mark as solution" link at bottom left on the post that best answers your question. This will benefit admins looking for a solution to the same problem.

dpeters11's picture

Also, if it's still happening, what version of Citrix is it? I know it can't be higher than 4.5, but that may also make some difference. Are all the servers running the same version with the same Citrix patches?

Mick2009's picture

Hi nwranich,

The latest versions of SEP should work very well with Citrix, when the best practices are followed. 

Do update this thread, if time allows, when you have received the results of the memory dumps that were submitted for examination! 

With thanks and best regards,

Mick