Endpoint Protection

HI,

We recently upgraded to SEMP 12.1.6 and since then some clients on our network are having trouble using their network printers.

The printers are all connected to a windows server first and then added to individual clients via "add a printer".

We are facing this on both win 7 and win 8. And also there are other machines on 12.1.6 which do print just fine. So this is just to make sure if it actually is a sepm issue.

What now happens is, when the user gives the print cmd for a doc with ctrl + P usually a dialog box opens asking for the user id and pass and now that same box opens but with a huge delay. And once we do smc -stop the print cmd is executed instantly.

So now I checked the eventvwr logs for the printer and there's no difference there before and after stopping smc.

We use sep manager to manage the clients and I have been trying to disable NTP and even that doesn't trickle down to the client. How do I stop NTP?!!

I right-click the client and disable it as of now and nothing happens.

Have you tried adding the print file that it executes when printing in the SEP exclusion policy? Sounds like autoprotect scanning of the launched file is taking it time which can happen on machines that don't have much resources aviable at the time. 

Try adding it to the exclusion policy with all sub process ticked and exclude all scanning see if this improves performance. 

When i check the network activity i can see this file with the printer's ip, could it be the one?

C:\Windows\System32\ntoskrnl.exe

Also we have upto hundred other same machines which have no issues but just these few ones which have this prob?

Any pointers on how can i further check the logs from sepm for this?

Is disabling NTP really the fix? Are you running 12.1.6 MP5? If so, I'd open a support case.

Otherwise, you need to check the box under location specific settings to allow users to disable the firewall and in the IPS policy, open the lock icon. This should only be a workaround as now end users can affect the client functionality.

Is this a NTP issue or something else? Have you tested disabling NTP? Can you test with rolling back bash defs? Also test with disable insight lookup? Test with both of the above and let us know the results.

Using 12.1.6 as mentioned in the first post.

Disabling NTP is a pain. I keep disabling it on the server for my own pc the change doesnt happened, i guess soon i'll be opening a post for that next.

I checked the view network activity box by right clicking on NTP options in the client and then i hit print and i can see the printer ip using application paths as

C:\Windows\System32\ntoskrnl.exe C:\Windows\System32\spoolsv.exe C:\Windows\System32\explorer.exe I then added these to exceptions for one of my location which is a different city and it seems the prints are not being delayed now, i'll update further after trying this again at some other location.

HI Kimberly,

Could you share some troubleshooting guides and steps for this, some logs which I can check to see what the auto protect is scanning during the printing process?

Regards

You can enable VPDebug Logging:

How to enable "Vpdebug Logging" on Symantec Endpoint Protection 11.0 and 12.1

Or try Process Monitor:

How to Configure Sysinternals' Process Monitor to Record Symantec's Auto-Protect Events