Endpoint Protection

I have server 2012R2 and workstation W7, both with SEP 12.1.4100.4126. On W7 mapping drive from server using net use command and executing exe file from this new mapped drive. Launching the exe file starting about 15-20 seconds. When I try it same on 2003 server with SEP 11.0.4202.75, launching exe file starting 1-2 seconds. Both servers using the same sep politics from sepm.

I tryed make special politics for server2012R2, disabled firewall, disabled auto-protect, disabled intrusion prevention, made exceptions for exe file- nothing did not fix my problem. But when I turn sep off on 2012R2, exe file launch immediately.

Do you have some idea, how fix the problem? 

Thanks.

Have you disabled only the SEP firewall to see what the result is? Do you have AV, PTP, and NTP all installed? Or which components?

Aside from that it sounds like you've disabled everything, you may want to call support to work on this.

You will need to turn on advanced logging and take packet captures for them when re-producing the issue.

How to use the advanced debug logging options for the Symantec Endpoint Protection client in SymHelp

I'd personally suggest you try adding in the server hosting the execuatable as an exception under "Trusted Web Domain" type, and see if that helps.  You can do this by IP address or URL.

#EDIT#

Incidentally, the reason I suggest this is because it sounds to me like SONAR is performing an Insight Lookup on your executable when run on a SEP12.1 machine.

The exception above is to exclude it from that lookup, and (hopefully) speed it up.

More info below:
http://www.symantec.com/docs/HOWTO80926

Than you for you reply. 

I tryed make exception under "Trusted Web Domain" type and it did not work.

I made log from SymHelp. Is some body who analyze log here, or i have to send in to support?

Thanks.

Attachment(s)

VWSPEMISE__2014_04_24__23_08_40.zip   2.10 MB 1 version

The Symantec support tool exports everything in a proprietary format, us mere mortals can't view the stuff inside :( Either a tech support who uses the forum will help you look at that or you will have to create a case if you want it analysed.

To be honest, if you posted the logs, there are much more people here who can look at those 

I was only able to see basic info, you will need to get in contact with support for them to really take a deep dive.

Check this article for a good start:

How to use the Symantec Help Tool to collect data for Support.