Endpoint Protection

My environment is running SEP 12.1.1101.401 on Windows 7.  I am receiving numerous reports over the last day or two that users are seeing multiple SEP icons in the systray, and they are getting the following alert:

Symantec Endpoint Protection cannot open because some Symantec services are stopped.  Restart the Symantec services, and then open Symantec Endpoint Protection.  The SEP icon also shows the red circle through it.  Colleagues have told me that rebooting makes the problem go away temporarily.  

I have not seen the issue on my machine but I am running 12.1.5.  Has anyone else seen this?  

Someone posted about this issue yesterday as well. They were running an older version. I've seen this a couple times in the past though but mostly on older versions, RU2 and lower.

Running a repair or a reboot corrected it though.

I haven't seen it though in RU3 and up. I would recommend getting to the latest version though.

Thanks Brian.  I trying to get some users to go with RU5 and will see if that makes a difference.

My colleague is on the phone with Symantec support now.  Sounds like this could be related to bad definition.  I am waiting to see what happens.

According to Symantec support the IPS definiton from January 19 2015.  We were advised to change the LiveUpdate Content policy to use the January 16 definition.  Then if a computer shows the symptoms I described in my post, reboot the computer and let it retrieve the older definition when it connects to the SEPM.  We are going to leave the policy this way until we have confirmed that the environment has stabilized.  

Did they offer a way for us end users to troubleshoot this, perhaps running the symhelp tool? Or looking in a folder or reg key?

Is it version specific? If it was IPS defs, I would expect a lot more users on here asking questions.

Hi Brian

We did not receive any tips for troubleshooting.  It appears that support assumed that the signature was the problem, and my colleague changed the update policy.  At this point, it is not clear that rolling back the IPS definition helped.  Some colleagues said the problem disappeared after a reboot, some said they had to keep rebooting yet the problem persists.  I am reaching out to impacted users to see if they can install 12.1.5.  As I gather more information, I will provide updates.

The common complaint we hear is that "the Internet is slow."  But our network guys confirmed that our network is fine.  When we restart the SEP services or reboot, surfing is fine again.  So all roads seem to lead to SEP.  

Bob

Running SymHelp will provide a report that checks to see if the IPS or any other definitions are corrupted. 

I'm just curious as personally I don't see any issues on my side so is it specific to you or are others having an issue. If it was defs, I would think it would be on more of a global scale.

BzlBob,

Might be this:

http://www.symantec.com/docs/TECH227716

Brian,

This sounds exactly like our problem.  I am going to take this information and try to get our clients updated.

Thanks for finding this.  

By the way, reverting back to an older signature has stablized the environment.

Bob

Quick update - the link Brian provided seems to be spot on.  The error in the Windows application log matches impacted clients.  Also impacted clients are running 12.1.1.  So this seems to be the justification I have sought to get clients updated.