Video Screencast Help

SEP makes the computer very slow.

Created: 02 Aug 2012 | 74 comments

On some computer SEP 12.1.1 use alot of resources and makes the computer very slow.
At this moment we have 20 computers that have this isseu. And with slow i mean very slow. 30-40 minutes you have to wait when you log in. And when your work you have to wait 2-5 minutes for opening a document. When we remove the SEP client, everything is back to normal. We did a reinstal of two computers but that didn't help alot.  

The computers al have 2+GB RAM, other computers with the same spec doesn't have this problems...

And when we install a client with only Anti-virus and Anti-spyware. Its better but it still take 15 minutes to login.

Someone have experience with this issue?

Comments 74 CommentsJump to latest comment

Swapnil khare's picture

Check this might help if this was something known there must be Fix released by Symc check Symantec in article below for know issue's

http://social.technet.microsoft.com/wiki/contents/articles/10130.root-causes-for-slow-boots-and-logons-sbsl.aspx

 

Don't forget to mark your thread as 'SOLVED' with the answer that best helped you.

 

Glenn Jacobs's picture

It is not really the login thats the problem but after you login the computers hangs a while before you can do something.

After a few tweaks this problem is solved i think but the computer is stil very slow when you work with it.

Swapnil khare's picture

Glenn ,

Could you please check the event log i guess there should be event mentioning event id 10xxx something

and the solution is to change the dcom settings i had dealt with similar issue earlier and had helped fixing issue after changing permission on machine , try this on 1 machine only ie workstation as a test you might have to login as Admin to make change ,

Note do not make changes on SEPM server try giving affective dcom permission on Client first and then check if it works .

http://answers.microsoft.com/en-us/windows/forum/windows_xp-performance/dcom-error-10010-very-slow-login-very-slow-desktop/4614ae6d-93cd-45e6-b66a-cbde1db13f90

 

Don't forget to mark your thread as 'SOLVED' with the answer that best helped you.

 

Thomas K's picture

Are you running any other security products on these systems? What is the operating system used?

Glenn Jacobs's picture

We don't run any other security products on the system. We have other computers with same hardware s and the same software but they don't have any issue.

 

We have Windows XP.

K33's picture

 

Kindly verify...............

have you check reinstall window ?

This issue is rendomly or some specify system  ?

Virus defination are up to date ?

Some time this issue occured when lot of user profile are exit in System and low space in c drive.

kindly change one system pagefile location.(Only for Troubleshooting)

Glenn Jacobs's picture

This issue is randomly or some specify system?
It's More randomly, but at this moment 70 % of the computers that are affected by this issue are computer from the IT department.

Virus defination are up to date?
yes

Some time this issue occured when lot of user profile are exit in System and low space in c drive.
Alot of profiles isn't possible. Will check low space...

Kindly change one system pagefile location.(Only for Troubleshooting).
On the list to try this.

 

 

K33's picture

hi,

Thanks for update..

Kindly verify more ..

Slowness problem occure one time in day ?

Kindly check when your system are slow can you check virus defination folder created date.

Locations of Virus Definitions for SAV or SEP Client only:

  • Windows 9.x\Windows XP\Windows Server 2003:  \Program Files\Common Files\Symantec Shared\VirusDefs\ or \Program Files (x86)\Common Files\Symantec Shared\VirusDefs

 

Same problem occure in my company when system start system goes slow after 25 to 30 min.this problem occure every 8 hours,when we have check virus defination folder Created date and time are same.

hforman's picture

On just a few systems, we had to first:

1) Uninstall SEP 11

2) Remove everything symantec from folders (program files, common files, profiles - especially "all Users")

3) do reboots after each step

4) Check disk space

5) Make sure we didn't touch anything relating to other Symantec products, such as NetBackup

6) Perorma clean push install using the wizard.

 

The reason is that we still had pieces of very OLD SAV software on some machines.

Glenn Jacobs's picture

We reinstalled the system so just cleaning up will not work for us. Its even on new systems.

hforman's picture

Excuse me:  also--

We had turned on Isight and SONAR.  No problem except we needed to have exclusions, especially in Blue Coat for some of the new Symantec websites, such as:

 

ent-shasta-mr-clean.symantec.com and

ent-shasta-rrs.symantec.com

 

I would check the following logs (most under Network Threat Protection):

 

SONAR

TRAFFIC

PACKET

 

and see if anything new is getting stopped.

 

Glenn Jacobs's picture

I don't know if we have thos exclusions in our bluecoat will check this. I don't think this will solve our problem but i'm out of idea right now so i gonna try those exclusions if they aren't already there.

 

I found a list of Proxy exclusions here: http://www.symantec.com/business/support/index?page=content&id=TECH162286

 

Do i need to add all of them for everyone or just from our SEPM server?

hforman's picture

You need to add them for everyone.  We have *.symantec.com whitelisted.  You may want to note that most of these are https: sites (not port 80).  Each computer, when it scans, will be accessing those sites.

Dushan Gomez's picture

Yes, I guess I'm not alone in this too, my WIndows XP SP3 user report the same thing when opening their Outlook 2007 after upgrading to SEP v12.1 RU1

Dushan Gomez
IT Manager
VCP 4 and 5 | MCITP Exchange Server | MCTS SharePoint Server | MCP Windows XP

 

Glenn Jacobs's picture

We didn't get alot of complains from the users, so we don't really know how many PC are affected by this problem. But there are some ppl in our IT Department taht have this issue and it isn't only related to Outlook. Startup is very slow, We know that SEP will slow down the boot process.But this is to much.

We don't really care if the systems takes a little more time to boot but when we start software (Local installed software and APP-V) It takes up to 5 minutes to open. We can have 2 system (Same hardware and software) but one does have the problem and the other doesn't have it. The only differences are the MAC/IP and systemname.

Ashish-Sharma's picture

This is a shot in the dark, but try disabling Insight lookups for a test and see if this has any impact on performance.

How does Insight Lookup work? - http://www.symantec.com/business/support/index?page=content&id=TECH169282

 

Thanks In Advance

Ashish Sharma

 

 

Dushan Gomez's picture

Hm.. didn't think about that before :-0

Thanks for the advice Ashish

Dushan Gomez
IT Manager
VCP 4 and 5 | MCITP Exchange Server | MCTS SharePoint Server | MCP Windows XP

 

Glenn Jacobs's picture

Ok turned it off. Will check those system ASAP.

Ashish-Sharma's picture

have you check system speed after setting ?

Thanks In Advance

Ashish Sharma

 

 

Glenn Jacobs's picture

It gave maybe a 15% extra speed on those computer. I'm  happy is 15% so our user know we are trying to fix it... 

sagar pansare's picture

Check this might help

Go to: C:\Program FIles\Symantec\Symantec Endpoint Protection Manager\Inetpub\Content (Default Location of SEPM) 

 Check

- {535CB6A4-441F-4e8a-A897-804CD859100E} for 32 Bit

- {07B590B3-9282-482f-BBAA-6D515D385869} for 64 Bit

Note: These two folders take more disk space, compared to other folders which are used to store the Virus definitions

 Once the number of content revisions has been decreased, then this would be reflected on the number of revision folders. See TECH96214 for recommendations.

 To reduce the size of the database transaction log file

 Log in to the Symantec Endpoint Protection Manager.

 Click Admin and select Servers.

 Select the localhost under Servers.. Under Tasks, Select Edit Database Properties.

.In the General tab under Database Maintenance Tasks.

 Select the checkboxes next to Truncate the database transaction logs and Rebuild Indexes.

 Click OK to apply the changes.

 

 

 

Glenn Jacobs's picture

We keep 25 revisions (we have 2100+ clients). I don't know this will fix the problems on the clients because this is server related and we only have a problem with a few clients. But will try this later when i checked the system speed after the change we did last week. But i didn't have alot of time to check this now.

Glenn Jacobs's picture

Another strange thing:

next year we will roll out Win 7 instead of XP we are doing tests now and i changed one of those systems to Windows 7. Problem is gone. Change back to Win XP problem back....

hforman's picture

Is there any difference in your Windows firewall settings?  I set SEP 12 to disable the Windows firewall since having two firewalls running could slow down things.  You also would need to check out the difference between your XP and Win 7 images.  They are probably not exactly the same.  Also, make sure you don't have duplicate SIDs in your envirnment.  There is a lot of software we have seen that is sensitive to that (mostly patching systems).

Ashish-Sharma's picture

Does your XP computers meet the minimum system requirements?

Processor
  • 32-bit: 1-GHz Intel Pentium III or equivalent minimum (Intel Pentium 4 or equivalent recommended)
  • 64-bit: 2-GHz Pentium 4 with x86-64 support or equivalent minimum
    Note: Intel Itanium IA-64 and PowerPC processors are not supported.
Physical RAM
  • 1 GB of RAM for 32-bit operating systems, 2 GB of RAM for 64-bit operating systems, or higher if required by the operating system

http://www.symantec.com/products/sysreq.jsp?pcid=p...

 

Thanks In Advance

Ashish Sharma

 

 

Glenn Jacobs's picture

We have Dell systems and they all have 2gb ram+ and Dual core processors (I think 1.8Ghz+)

Ashish-Sharma's picture

 

SEP 12.1 lot of new feature are available that cause windows xp OS are slow working.

Try on import SEP 11.x client package on SEPM 12.1 and check 1 or 2 system performance.

How to import SEP 11.x package in SEPM 12.1

https://www-secure.symantec.com/connect/articles/how-import-sep-11x-package-sepm-121

Thanks In Advance

Ashish Sharma

 

 

Glenn Jacobs's picture

We already imported SEP 11 packages (there are some problems with Thinapp).

Installed it and the problem is gone with SEP 11...

williamzhong's picture

we have the same problem on some windows2003 server enterprise edition sp2 system,but when i dial the symantec support line ,they don't have any idea about this issue.

well,finally ,we had to reboot the server and uninstall the sep 12.1 client.

i think ,this problem must be caused by sep client.

Glenn Jacobs's picture

We think its more a combination of different software.

like there are some user that have a standard but with alot of extra software. And with alot I am talking about 15+, most of them are from our IT department.

But the problem is also there but alot of other user but tey are spread over our company. But if we see how many per department. IT has more then the other department (3 x more).

hforman's picture

Please make sure that you are not blocking access to any sites, http(s):// *.symantec.com.  SEP 12 does a lot of checking on reputation and the sites are all listed somewhere.  They don't use liveupdate, exactly for this.  We don't have any performance issues with 12.1.1.

 

You may also want to look at the different logs to make sure nothing is being blocked, such as SVCHOST.EXE.  You must create an exclusion for that as it tries to access the hosts file.

 

Glenn Jacobs's picture

https domains aren't blocked in our company.

http://*symantec.com is whitelisted on our proxy and it doesn't need any authentication to reach it.

hforman's picture

Thanks, without seeing all of your logs I was just checking.  For what it is worth, we are running XP SP3 and Windows 7 mixed and are not seeing any issue.  I check the logs every day and find all sorts of new things that we never knew were going on.  We are using both SONAR and Insight and it is dramatically reducing scanning here.  Since some of the "policies" have new things in them, my only suggestion at this point would be to go over yours carefully (between 11.x and 12.x).  (Especially Firewall rules).  Good luck.

poly15's picture

Are these all at one site or at a remote site?  Are you going back to a server for updates or out to the internet?  Are your proxies transparent or static?

Glenn Jacobs's picture

Both most part is on a remote site but we also have this problem on the site were our server is located.

We use our server for updates.

 

What is the difference between transparent and static proxy?

John Santana's picture

Hi,

Is this still the issue with SEP client version 12.1 RU1 MP1 deployed to WIndows XP SP3 ?

Kind regards,

John Santana
IT Professional

--------------------------------------------------

Please be nice to me as I'm newbie in this forum.

Glenn Jacobs's picture

Its still an issue, and we even think it got a little bit worser but we only think it smiley We can't deny it or prove it....

With the latest version we got more computer that have this issue but we need this version. Other version has problem with APP-V and 75% is APP-V

 

On Win7 we see alot of improvements, we didn't had a chance to check it on an 'clean' win XP SP3

Reinstal the computer have a little succes (it will speed up those computers but not enough).
We already have a case by symantec but we also know its a high chance that this problem is a configuration thing (OS- third party software in combination with SEP.)

John Santana's picture

Ah that's sounds great Glenn, because my company will soon migrate to Windows 7Pro next year.

Kind regards,

John Santana
IT Professional

--------------------------------------------------

Please be nice to me as I'm newbie in this forum.

.Brian's picture

What processes are utilizing the most CPU?

Please click the "Mark as solution" link at bottom left on the post that best answers your question. This will benefit admins looking for a solution to the same problem.

Glenn Jacobs's picture

Non active system processes are 99%

other processes are around 0-1%

Mohan Babu's picture

Hope the slow logon issue might because of SEP scanning NTUSER.DAT file..

So users will be facing this slowness prroblem

Try to add a exlusion for one user profile and check if tat works...

Bot we don't have a option so set wildcard for this 

Better you can stop Active scan on startup...for better performance.

Go to SEPM-->Policy-->Virus and spyware policy-->edit the scan policy and disable the active scan on windows start up.

 

 

Check these articles for more info.

https://www-secure.symantec.com/connect/forums/rtvscanexe-scaning-all-cusersxxxntuserdat-endlessly

https://www-secure.symantec.com/connect/forums/how-stop-scanning-ntuserdat

 

Mohan Babu

moglie20@gmail.com

+91 9884382160

Your satisfaction is very important to us.If you find above information helpful or it has resolved your issue...please mark it accordingly :)

John Santana's picture

Mohan, what are the tweaking method to make SEP runs faster and safer in the WIndows XP client ?

Kind regards,

John Santana
IT Professional

--------------------------------------------------

Please be nice to me as I'm newbie in this forum.

Zebbelin's picture

We had a similar Problem with the long logon times on:

  • Windows XP
  • Sites with no Domain Controller

We fixed it by adding the "BufferPolicyReads" Reg Key described in this Blog:

http://blogs.technet.com/b/instan/archive/2011/08/...

 

But I have no idea where that slow open documents thing could come from.

Hope the info helps you!

 

Have you tried to uninstall the Network Threat Protection part to see if the Network Performance is still bad?

Mohan Babu's picture

Hi John Santana

 

If you install all components you need to make sure your environment need all the features. You can avoid the some features that you may not use on your environment.

Scan suggestions:

Antivirus & Antispyware:

Settings need to configure:

  • You can schedule the scan frequency and Scan randomization out of productivity hours.
  • Scan settings should be selected as Better performance for other applications
  • Scan when a file is modified
  • Set exclusions for legitimate files 

PTP [Proactive threat protection]  

TrueScan : It will scan all the process that runnin on your Memory. You can set the Heuristic level to medium or low to avoid False  Positives and better performance.

Appplication & Device control: Block or monitor the applications and devices.

If you dont' USe you can remove them.

NTP [Network threat protection]

Firewall: Works based on rules block allow or log the inbound or outbond traffic

Configure the firewall according to the enivronment

IPS: Works based on signatures.

 

 

Adjusting scans to improve computer performance
 
 
Randomizing scans to improve computer performance in virtualized environments
 
 
Improving client and server performance
 

Hope this helps,........

Mohan Babu

moglie20@gmail.com

+91 9884382160

Your satisfaction is very important to us.If you find above information helpful or it has resolved your issue...please mark it accordingly :)

John Santana's picture

Many thanks Babu !

Kind regards,

John Santana
IT Professional

--------------------------------------------------

Please be nice to me as I'm newbie in this forum.

Mohan Babu's picture

 

Welcome always.........John Santana

Hope you got the required information............

Is there anything else i can help you with...........

Mohan Babu

moglie20@gmail.com

+91 9884382160

Your satisfaction is very important to us.If you find above information helpful or it has resolved your issue...please mark it accordingly :)

tcibils's picture

Hy we have same problem after upgrade our clients to SEP 12 RU1 MP1, some cliente with WinXP SP3, was very slow, and now We identify that all clients who updated from WSUS, was slow too.

So, you can resolve the problem? Any Idea??

Dushan Gomez's picture

@tcbilis, so what is the issue exactly ?

is that only for several random users or consistently acrosss all of the upgraded users ?

Dushan Gomez
IT Manager
VCP 4 and 5 | MCITP Exchange Server | MCTS SharePoint Server | MCP Windows XP

 

tcibils's picture

Dushan,

It´s a random users, becouse the first case We reinstall all machine and again machine is very slow, after install SEP 12 RU1 MP1.

So we install version 11 in this machine to resolve at this moment.

Today, We have 40 machines, and 3 have this issue.

Dushan Gomez's picture

Hm.. that is scary :-| please let us updated with your solution as well.

Dushan Gomez
IT Manager
VCP 4 and 5 | MCITP Exchange Server | MCTS SharePoint Server | MCP Windows XP

 

outrunred's picture

this all sounds similar to my issue - problem identified with only machines running XP with solid state hard disks....

 

remove the network cable whilst it's going slow - does the problem go away?

hforman's picture

I had a computer running VERY slow with an SSD.  Fixed it by updating the SSD firmware to current levels.  Many of the older (this was a 64 GB SSD) have this issue because they did not handle deletions the way you would expect.  In any case, a firmware refresh fixed the issue.

John Santana's picture

Hi man, may I know what is the model / manufacturer of the SSD and your workstation ?

Kind regards,

John Santana
IT Professional

--------------------------------------------------

Please be nice to me as I'm newbie in this forum.

SameerU's picture

Hi

I am also facing the same issue.

Regards

 

 

 

Dushan Gomez's picture

So what's the update on this issue then ?

Dushan Gomez
IT Manager
VCP 4 and 5 | MCITP Exchange Server | MCTS SharePoint Server | MCP Windows XP

 

Mohan Babu's picture

 

Try new version it has lot of enhanced features with improved performance scale. Updated most of the drivers.

 

SEP 12.1.2 has been released finally..

https://www-secure.symantec.com/connect/forums/sep...

Mohan Babu

moglie20@gmail.com

+91 9884382160

Your satisfaction is very important to us.If you find above information helpful or it has resolved your issue...please mark it accordingly :)

Dushan Gomez's picture

Yes I have tried that so far and no issue encountered.

 

Dushan Gomez
IT Manager
VCP 4 and 5 | MCITP Exchange Server | MCTS SharePoint Server | MCP Windows XP

 

Glenn Jacobs's picture

I can say after a lot of testing that the performance is betetr with the new version, but starting up some applictaies is still slow (a lot less then before).

Glenn Jacobs's picture

A small update on this, i know it took a few months 

We upgraded our server to RU2 (Before we only used the RU2 Clients). We tweaked alot of stuff in the manager. (So many i don't even know what is changed smiley ) We disabled everything on the client that we don't use. We created a new feature set for this.

I'm proud to say that we have solved 80% of the slowspeed problems. The other 20% is just a combination between some software and SEP (Like ThinAPP still take 10+ second to startup).

Some numbers:

APP-V packages comes down from 1min+ to a few seconds
Booting is now between 2min and 5 min.
Opening documents is almost instantly.

It was alot of trial and error and patience but in the end it was it worth :-)

I just want to thank everyone here cause we used alot of stuff from this thread and other threads  to tweak our clients and server.

 

SameerU's picture

Hi

What are the components installed ?

Regards

 

Glenn Jacobs's picture

SameerU,

This is wat we use:

We have a own AV on exchange, we also have a proxyAV. 

We also have a second feature set we are testing for those system that are still slow.
There Advanced downlaod protection and sonar is also disabled but this isn't final yet.

The firewall Policy has only a blank rule for now and alot of stuff isn't enabled in the settings. But in the future this will change.

We used the rule: What we don't use we don't want to install.

 

 

AjinBabu's picture

Hi,

It does not look to a Symantec Problem, could you check on Task manager which process it taking these much recourses.

We had also same issue while inspecting our clients we found that it is not because of Symantec, because of some HDD issues.

Regards

Ajin

Bulbous's picture

I have noticed a major performance crash in moving from version 12.1.2015.2015 to version 12.1.2100.2093, particularly in accessing databases on a network server from a Windows XP workstation.

Network scanning is disabled.

.Brian's picture

It's a known issue. If you disable the firewall only, it should work as normal.

Multiple cases have been opened, including one for myself.

Please click the "Mark as solution" link at bottom left on the post that best answers your question. This will benefit admins looking for a solution to the same problem.

Bulbous's picture

Thanks. I always disable the Firewall by policy, but I'm going to try adding a new Feature Set with the Firewall component deselected.

.Brian's picture

Withdrawing the policy will not work, you need exclude the firewall component for it to work normally. Sorry should've mentioned that.

Please click the "Mark as solution" link at bottom left on the post that best answers your question. This will benefit admins looking for a solution to the same problem.

Bulbous's picture

Thanks. If I just create a new Install Feature Set (with Firewall deselected), and modify the existing Install Package - will the clients automatically uninstall the Firewall feature?

.Brian's picture

It should. Follow this:

How to add or remove features to existing Symantec Endpoint Protection (SEP) client installations

Article:TECH90936  |  Created: 2008-01-18  |  Updated: 2012-05-11  |  Article URL http://www.symantec.com/docs/TECH90936

 

Please click the "Mark as solution" link at bottom left on the post that best answers your question. This will benefit admins looking for a solution to the same problem.

AlleninAuburn's picture

We've noticed the same thing. We spent an entire day trying to troubleshoot this and did find that disabling the firewall helped, adding rules to the firewall didn't. I'm not keen on disabling the firewall and have rolled back to 12.1.2015.2015 for the workstations that are accessing the database. 

.Brian's picture

Modifying the rules won't help. It has to do with an update to the teefer driver in the latest version. Has been a very large lag in monitoring the traffic going thru the SEP firewall.

The only workarounds right now are to disable/remove the firewall component or roll back to 12.1 RU2.

My case has been escalated to the advanced team.

Please click the "Mark as solution" link at bottom left on the post that best answers your question. This will benefit admins looking for a solution to the same problem.

John Santana's picture

Yes Allen, that's true, 12.1.2 RU2 is the most stable so far.

Kind regards,

John Santana
IT Professional

--------------------------------------------------

Please be nice to me as I'm newbie in this forum.

Glenn Jacobs's picture

I tried the newest version on a few computers and after a day i just rolled it back.
12.1.2 RU2 is better if you still have alot of XP systems.

 

SMBgurus's picture

Rollback?

I missing something here, but when I imported the old package and created separate groups for the XP workstations and ensured they are not inheriting from the parent, they seem to reject the older package due to the newer client installed.

I have found searching for the client by IP and redeploying a package in the past works on the same verision, but do not know if it does for going back a verision, is there a specific tech doc that points to rolling back local clients?

Or are you going to the workstation itself and doing this?