Endpoint Protection

I have few SEP 12.1 RU1 clients (both XP and Win7) which the Symantec Point Protection service doesn't start automatically when the machine power up. I have to go to the services.msc console to start the service manually before the clienst can get the virus definition updated. I tried uninstalling and reinstalling and it didn't help. I used the clean-wipe utility and it didn't make the difference.

Any idea? Thanks

Does this happen all the time?

When you start the service is doesn't give you any error or starts normally?

Navigate to HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\Symantec endpoint protections and tell me what is the startup type. It should be authomaic.

START TYPE           LOADER                    MEANING

0x0                         Kernel                      Represents a part of the (Boot)   driver stack for the boot (startup) volume and must therefore be loaded by the Boot Loader.

0x1                          I/O                          Represents a driver to be loaded (System) subsystem  at Kernel initialization.

0x2            Service  Control Manager   To be loaded or started (Auto load) automatically for all startups,    regardless of service type.

0x3            Service Control Manager    Available, regardless of type,(Load on but will not be started until demand) he user starts it (for example, by using the Devices icon in Control Panel).

0x4            Service Control Manager   NOT TO BE STARTED UNDER ANY(disabled)    CONDITIONS.

yes, it is very  consistent. I checked the event viewer and did see that the service did start and entered to stopped mode afterward. I can start the service manually by going to the services.msc console.

In the services registry sub-key, I see SNAC\SMCservice but not Symantec endpoint protection.

check this artical

http://www.symantec.com/business/support/index?page=content&id=TECH97729

Follow the steps below in order to resolve the issue:

1. Open the service console from Start --> Run --> Services.msc
2. Right click on Symantec management client service and select properties.
3. Click on the dependencies TAB.
4. Check if there are any services listed under "The service depends on the following system components"
5. If the services are listed it needs to be deleted from the registry key HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\SERVICES\SmcService
6. Take the back up of the registry by right click on the registry key value and select export.
7. Delete the string value DependOnService
8. Reboot the machine and Symantec Management Client service should start automatically

Hi

Please repair the client and take the restart

Regards

Is tamper protection enabled within your SEPM?

There may be something on the system that is disabling SEP before it has a chance to start. If's not enabled turn it on and try restarting machine and client once policy picked up.

Ashish Sharma, there is no dependence list in the dependenices tab

SameerU, I completely removed the client with clean-wipe and it didn't help

GeoGeo, Tamper protection is already on.

Hi

Do you see any other errors in the event viewer application logs on the machines in question ?

No, I saw that the Symantec Endpoint Protection service entered to stopped mode in event viewer when the machine startup. If I manually start the service, it will start successfully and the icon will start showing up in the task bar.

Hello,

Is this issue occurying on all machines or certain machines only?

Try deleting the entry in Image File Executation Option:

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ccSvcHst.exe

(Please take a backup of registry entry before deleting it.)

and Restart the client machine and check.

If that does not help, please create a Symantec Technical Support Case.

How to create a new case in MySupport

http://www.symantec.com/business/support/index?page=content&id=TECH58873

Phone numbers to contact Tech Support:-

Regional Support Telephone Numbers:

Thanks, I have contacted Symantec support about this issue.