Endpoint Protection

In the security status details page on the top dashboard when i click inside i see 40 machines showing Network Threat Protection Failures adn a red X.

When i check the client manually it says a green sign and everything is ok. Also we have disabled the NTP firewall status centrally on SEPM but the component is installed. (Basically it is turned off).

So how do i fix this incorrect reporting and remove that RED X:

We are using 12.1.2015.2015 on both server and clients.

if you disabled from SEPM it will still show in red..

if you select the group and right click - enable NTP does the count come down?

check the date format as well;

http://www.symantec.com/business/support/index?page=content&id=TECH164272

If you disable NTP, this is the expected behaviour. If you don't use NTP than you can either remove the component or withdraw the policies for it

Basically my firewall policy is not enabled, the check box is not ticked so that policy is off.

But the NTP component is installed on all machines.

So, I have these questions:

1. If this is expected behaviour then why only 40 machines are showing that, all 400 machines should come as disabled.

2. Normally if there is any problem on client it will not show that green check, if any component has issue it will show red and even that green communication dot becomes yellow.

@Rafeeq: Yes is ran those commands on the client from SEP and clicked on Enable Auto Protect / NTP and Download Insight protection and the number did come down.

So what is happening here?

For the 40 machines showing this, did you right click the SEP icon and select "Disable SEP"?

Update:

After running those commands on all the pcs my Computers with Network Threat Protection Disabled: has become 0.

So i want to understand what was happening here? Is this some kind of SEPM database issue? It was reporting incorrect info?

Next step is some of my clients show SONAR status - Component is Malfunctioning , why is that happening now? These are fresh installations.

No, i did not disable them, they were fine and showing green on the client.

Disable SEP is disabled, users cannot disable any component. I have clicked those locks against the settings in SEPM so users cant change anything.

My understanding is .If a user disables the NTP from the console, it will show in RED as disabled.

If admin disables it , It should not show as disabled so the count has come down.

the info is for past 12 / 24 hours on how you select under home page preferences tab.

once client communicate with SEPM. the results all turned green. Update command updates the DB will all relevent info. 

Hello,

Your Issue is very similar to one of the known defects with SEP 12.1 RU2.

To confirm if this is the same issue, I would request you to Create a case with with Symantec Technical Support Team.

How to create a new case in MySupport http://www.symantec.com/docs/TECH58873

Phone numbers to contact Tech Support:-

Regional Support Telephone Numbers:

• United States: https://support.broadcom.com (407-357-7600 from outside the United States)
• Australia: 1300 365510 (+61 2 8220 7111 from outside Australia)
• United Kingdom: +44 (0) 870 606 6000

Hi,

I would also suggest to contact Symantec Technical Support team.

Either create a web case or call to the support.

How to create a new case in MySupport

http://www.symantec.com/docs/TECH58873

OR

Regional Support Telephone Numbers:

• United States: https://support.broadcom.com (407-357-7600 from outside the United States)
• Australia: 1300 365510 (+61 2 8220 7111 from outside Australia)
• United Kingdom: +44 (0) 870 606 6000