All,

I've  upgraded SEP from 12.1.1 to 12.1.4, retaining existing settings, however all the clients are showing as offline in SEPM. I can log into SEPM fine, and see all the previous settings, but all clients are offline. The server itself is showing as online.

SEP 12.1.4 is on the same server as before, with the same IP and name - I'm guessing the existing sylink file on the clients wouldnt need to be upgraded? Or would a new sylink file need to be deployed?

Checked the troubleshooting tool on a client and it says "Could not connect to the server". Port 8014 isn't blocked & windows firewall is also disabled.

Any help towards identifying what the issue may be would be appreciated.

Thanks,

Evren

Did the clients heartbeat in yet? Force one to check in.

How long has it been since the upgrade and what is the heartbeat?

During upgrade you need to turn off the SEPM service so everything goes offline (clients won't be able to reach the SEPM and will go offline). Give it time, they should be checking back in based on their heartbeat.

no change need to be made on client unless you have messed up with the certificate.

wait for sometime and check if the client is  showing online.

It's been about 2-3 hours - if i force an update nothing seems to happen. 

I didnt do anythign regarding the certificates, is that something that will need checking?

Was it just a straight upgrade of the same server? no IP or hostname change or anything like that?

Is the SEPM service started on the server? Please verify.

Also, did you get any errors messages during the upgrade or did it complete successfully?

You can enable sylink debugging on an affected client to see the communication between client/SEPM

How to enable Sylink debugging for the Symantec Endpoint Protection 11.x and 12.1 client in the Windows Registry

can you enable sylink logging and pass on the log.

also check this article

Symantec Endpoint Protection Manager 12.1 Communication Troubleshooting

http://www.symantec.com/docs/TECH160964

Did you try replace sylink.xml for affected one or two client ?

Restoring client-server communications with Communication Update Package Deployment

Thanks all I'l try these and get back to you. Just to confirm:

It was a straight upgrade on same server, same IP, hostname MAC etc. All services are also running ok.

That's good news than.

Best bet here is to enable sylnk debugging to see the communication which should show what is going on.

If you want to, you can try replacing the sylink file on an affected client to what happens

Restoring client-server communications with Communication Update Package Deployment

Hi,

Thank you for posting in Symantec community.

If possible could you please reboot the SEPM machine?

1. Is SPEM sync with AD ?
2. If yes then you have to purge the data and there is a utility with support to remove duplicate entries
3. If these machines are cloned then check below
4. http://www.symantec.com/business/support/index?page=content&id=TECH163349
5. if above fails then create a test group put the server client in that group and see if comes online
6. if fails delete that client and replace sylink manually only on 1 machine of this test group
7. With cloned machine there can be an issue with hardware id try deletining hardware id from one mahcine and check if that client report to sepm.

Decrease the communication and set it as push mode.

restart the sepm services.

Guys, thanks for your help. I was carrying out a manual sylink push from the server to a client, and noticed that the clients have started checking in. This is before I carried out the steps you mentioned above so I'm not sure whether it just needed time or something kicked in. 3.4 hours seems a long time, though  this morning i have  27 machines connected so far which looks fine.

Good to hear After replace sylink.xml client will showing on SEPM console.

I suggest you can reduse Heartbeat setting 2-3 hours to 10 to 15 min.

It all depends on your heartbeat setting, I believe default is 4 hours. You can lower this if you wish, However, that sounds like why it was taking awhile to check in