Endpoint Protection Small Business Edition

Hello,

Recently, I uninstalled SEP 12.1 from one of my servers and after the reboot I could no longer RDP to the server.

I also found that AD replication traffic was being blocked among others.

We disable the Windows Firewall service as a default configuration and are not doing so via GPO.

I found the only way to restore traffic flow was to enable the Windows firewall service again.

As soon as I disable it, the traffic is blocked again.

I have run Symantec's Cleanwipe utility and have tried restoring the defaults on the Windows Firewall but still don't have a remedy.

Does anyone have information on what SEP does to the Windows firewall config and how to restore it to it's default/previous configuration?

I was running SEP 12.1 <12.1.1000.157> on Windows 2003 R2 SP2 64bit. 

Thank you.

Per this KB article, SEP installer will auto detect and disable Windows firewall if it is enabled.

About Windows Firewall and Symantec Endpoint Protection's NTP

Now since you don't have it enabled to begin with, it shouldn't be an issue. It seems like the installer will enable the FW after it removes SEP.

per this thread:

https://www-secure.symantec.com/connect/forums/sep-upgrade-11x-121-ru1-enables-windows-firewall

Check the post from Mithun Sanghavi

The way I read it is if the Windows fw is disabled via GPO, the SEP uninstall process would not enable the firewall but if it is disabled manually than it may re-enable, which is what happened in your case.

I'm not sure if this the intended behaviour but it seems it may be. You may need to call support to confirm.

Hello,

Look this discussion how to restore windows firewall setting

https://www-secure.symantec.com/connect/forums/windows-7-endpoint-client-take-over-control-sepm