Video Screencast Help

SEPM 12.1.1101.401 upgrade and client upgrade, application error after upgrade

Created: 06 Nov 2012 • Updated: 08 Nov 2012 | 7 comments
This issue has been solved. See solution.

I have installed SEPM 12.1.1101.401 on a test server and changed the configuration on 2 clients to point to the new test server.  The 2 clients that I am testing are running 11.0.6200.  I configured the server to send the upgraded package to these two clients to test and see excatly what the user will see so that I will know what to expect.  The upgrade went very smooth and fast for just those 2.  After I rebooted those two clients when it prompted, the computers came back up, I logged in and I see a message saying that Symantec Endpoint Protection is not working and I select to close the program.  It seems that SEP is still working but I still recieve this error.  I do have Lotus notes installed but for these two computers I do not have Notes configured.    I have pasted the error event below:  

Log Name:      Application
Source:        Application Error
Date:          11/6/2012 3:24:59 PM
Event ID:      1000
Task Category: (100)
Level:         Error
Keywords:      Classic
User:          N/A
Faulting application name: nlnhook.exe, version: 12.1.1101.401, time stamp: 0x4f8fc534
Faulting module name: nlnvp.dll_unloaded, version:, time stamp: 0x4f8fc639
Exception code: 0xc0000005
Fault offset: 0x6f338a63
Faulting process id: 0x12f8
Faulting application start time: 0x01cdbc652b878a97
Faulting application path: C:\Program Files (x86)\Symantec\Symantec Endpoint Protection\12.1.1101.401.105\Bin\nlnhook.exe
Faulting module path: nlnvp.dll
Report Id: 6aa9cd57-2858-11e2-b5e8-047d7b92315f
Event Xml:
<Event xmlns="">
    <Provider Name="Application Error" />
    <EventID Qualifiers="0">1000</EventID>
    <TimeCreated SystemTime="2012-11-06T21:24:59.000000000Z" />
    <Security />
    <Data>C:\Program Files (x86)\Symantec\Symantec Endpoint Protection\12.1.1101.401.105\Bin\nlnhook.exe</Data>

Comments 7 CommentsJump to latest comment

ᗺrian's picture

A direct upgrade from 11.0.6200 to 12.1 RU1 MP1 is not supported and not recommended. See this KB article:

Supported Upgrade paths to Symantec Endpoint Protection 12.1

The two most common supported migration paths are as follows:
•  SEP 11.x Enterprise Edition --> SEP 12.1 Enterprise Edition
     (SEP 11.x MR1, MR2, MR3, MR4, RU5, RU6 --> SEP 12.1 RTM or Higher (Include RU1 or RU2))
     (SEP 12.1 RTM --> SEP 12.1 RU1 --> SEP 12.1 RU1 MP1)
     (NOTES: MR is Maintenance Release version, RU is Release Update version, but MP is Maintenance Pack. The MP need to be installed to the same version of MR or RU. You can referenceTECH187753.)
•  SEP 11.x Enterprise Edition RU7 --> SEP 12.1 RU1 : Supported

All versions must first be upgraded to 12.1 RU1 before upgrading to 12.1 RU1 MP1

Direct upgrade to 12.1 RU1 MP1 from 11.x or 12.0 is not supported.

Please click the "Mark as solution" link at bottom left on the post that best answers your question. This will benefit admins looking for a solution to the same problem.

Simpson Homer's picture

Do you have Lotus notes installed too on the same machine?

David.H's picture

Yes, I believe that I mentioned that in my post that Lotus notes 8.5.2 is installed on my test machines but not configured as in there is no mail files, or a data folder in any profile.  I am working with our base Win7 64Bit image.

Lotus notes is not installed on the server if that is what you meant.  

For Brian81, does that mean that I should have seen even more errors as in the upgrade path I chose is not supported or just not recommended?  I didn't see any other errors with the upgrade in the way I did it and the program is working just fine.  I am about to test going from 12.1.x to 12.1.1101.401.  

Do I need to upgrade the server with 12.1, then the clients with 12.1, and then upgrade the server again with 12.1.1101.401 and then the clients once more?  

ᗺrian's picture

Yes, should've upgraded to 12.1 RU1 than to 12.1 RU1 MP1

Check your tamper protection logs, is there anything showing in there related to nlnhook?

Please click the "Mark as solution" link at bottom left on the post that best answers your question. This will benefit admins looking for a solution to the same problem.

David.H's picture

Ok, I un-installed the SEPM from the server and rebooted it.  Installed 12.1.1000.0157.  Deployed the client software and upgraded them from 11.0.6200 to 12.1.1000.0157.  

Next I upgraded the server to the 12.1 RU1 MP1 and then I deployed that client and upgraded the client software to 12.1 RU1 MP1.  I have done the upgrade to 2 test clients and now that I have followed the upgrade path correctly, I still get the same error on one of the computers.  (By the way, I re-imaged those computers before I started over with my testing).  

I have found that if you don't configure the server to include the Lotus Notes scanning that I will not have this error.  We do not use it anymore as we have migrated to outlook 2010, but from time to time people do access Notes to view archives and other things.  I don't see any reason to include this in our deployment but I did want to get some feedback on why this happens.

Also, would this have anything to do with the trial license?  Probably not but just asking.

ᗺrian's picture

That was my next question to ask if you use the Notes scanner plugin. If you don't use it than remove it. Especially if you have email scanned at your gateway.

No, trial license should not matter in this case.

Please click the "Mark as solution" link at bottom left on the post that best answers your question. This will benefit admins looking for a solution to the same problem.

David.H's picture

I know that I already marked this as answered but I just wanted to add one more question.  

I have already upgraded our production server to the 12.1 RU1 but I have not upgraded any clients yet.  The server is still running on the trial.  Do I need to go ahead and activate the upgrade license now before I do any clients, or do I go ahead and deploy the clients and then wait until I upgrade the 2nd time to 12.1 RU1MP1 to activate the license?  I am not too clear on how that works.