Video Screencast Help
Symantec to Separate Into Two Focused, Industry-Leading Technology Companies. Learn more.

SEP shows disabled even when client is working fine

Created: 28 May 2013 | 10 comments

In the security status details page on the top dashboard when i click inside i see 40 machines showing Network Threat Protection Failures adn a red X.

 

When i check the client manually it says a green sign and everything is ok. Also we have disabled the NTP firewall status centrally on SEPM but the component is installed. (Basically it is turned off).

 

So how do i fix this incorrect reporting and remove that RED X:

 

Computers with Network Threat Protection Disabled: 32
Total Computers with Network Threat Protection Installed: 244
Failure Ratio: 13.11%
Maximum Acceptable Failure Ratio: 10%

We are using 12.1.2015.2015 on both server and clients.

Operating Systems:

Comments 10 CommentsJump to latest comment

Rafeeq's picture

if you disabled from SEPM it will still show in red..

if you select the group and right click - enable NTP does the count come down?

check the date format as well;

http://www.symantec.com/business/support/index?page=content&id=TECH164272

 

.Brian's picture

If you disable NTP, this is the expected behaviour. If you don't use NTP than you can either remove the component or withdraw the policies for it

Please click the "Mark as solution" link at bottom left on the post that best answers your question. This will benefit admins looking for a solution to the same problem.

pandher's picture

Basically my firewall policy is not enabled, the check box is not ticked so that policy is off.

But the NTP component is installed on all machines.

 

So, I have these questions:

 

1. If this is expected behaviour then why only 40 machines are showing that, all 400 machines should come as disabled.

 

2. Normally if there is any problem on client it will not show that green check, if any component has issue it will show red and even that green communication dot becomes yellow.

 

@Rafeeq: Yes is ran those commands on the client from SEP and clicked on Enable Auto Protect / NTP and Download Insight protection and the number did come down.

 

So what is happening here?

.Brian's picture

For the 40 machines showing this, did you right click the SEP icon and select "Disable SEP"?

Please click the "Mark as solution" link at bottom left on the post that best answers your question. This will benefit admins looking for a solution to the same problem.

pandher's picture

No, i did not disable them, they were fine and showing green on the client.

pandher's picture

Disable SEP is disabled, users cannot disable any component. I have clicked those locks against the settings in SEPM so users cant change anything.

pandher's picture

Update:

After running those commands on all the pcs my Computers with Network Threat Protection Disabled: has become 0.

 

So i want to understand what was happening here? Is this some kind of SEPM database issue? It was reporting incorrect info?

 

Next step is some of my clients show SONAR status - Component is Malfunctioning , why is that happening now? These are fresh installations.

Mithun Sanghavi's picture

Hello,

Your Issue is very similar to one of the known defects with SEP 12.1 RU2.

To confirm if this is the same issue, I would request you to Create a case with with Symantec Technical Support Team.

How to create a new case in MySupport http://www.symantec.com/docs/TECH58873

Phone numbers to contact Tech Support:-

Regional Support Telephone Numbers:

  • United States: 800-342-0652 (407-357-7600 from outside the United States)
  • Australia: 1300 365510 (+61 2 8220 7111 from outside Australia)
  • United Kingdom: +44 (0) 870 606 6000
 
Hope that helps!!

Mithun Sanghavi
Senior Consultant
MIM | MCSA | MCTS | STS | SSE | SSE+ | ITIL v3

Don't forget to mark your thread as 'SOLVED' with the answer that best helped you.

Rafeeq's picture

My understanding is .If a user disables the NTP from the console, it will show in RED as disabled.

If admin disables it , It should not show as disabled so the count has come down.

the info is for past 12 / 24 hours on how you select under home page preferences tab.

once client communicate with SEPM. the results all turned green. Update command updates the DB will all relevent info. 

Chetan Savade's picture

Hi,

I would also suggest to contact Symantec Technical Support team.

Either create a web case or call to the support.

How to create a new case in MySupport

http://www.symantec.com/docs/TECH58873

OR

Regional Support Telephone Numbers:

  • United States: 800-342-0652 (407-357-7600 from outside the United States)
  • Australia: 1300 365510 (+61 2 8220 7111 from outside Australia)
  • United Kingdom: +44 (0) 870 606 6000

Chetan Savade
Sr.Technical Support Engineer, Endpoint Security
Enterprise Technical Support
CCNA | CCNP | MCSE | SCTS |

Don't forget to mark your thread as 'SOLVED' with the answer that best helps you.<