Endpoint Protection

Hi,

We seem to be experiencing slow booting and shutting down of Windows 7 PC's, the same characteristics as i posted here

https://www-secure.symantec.com/connect/forums/bhdrvx64-and-bhdrvx86-causing-slow-boot-and-shutdown

Upgrading the client to 12.1.5 seemed to fix the issue initially, but now it has raised its head again.

Can anyone please assist?

Regards

Leon

 

Is the full component suite installed? You'll need to test by disabling each one to see which it is casuing the issue.

When does slowness start? All the time? certain times?

Yes all components are installed.

The slowness seems to be either at the "Please Wait" prompt before the "Ctrl Alt Delete" screen, or at the "Shutting Down" prompt before the device turns off.

It is worse for some users than others - it sometimes takes over an hour to shut down.

I have also found the same issue in this post

https://www-secure.symantec.com/connect/forums/windows-7-hangs-shutdown-1215#comment-10999301

Sounds like Symantec do not have a fix for this yet?....

I will test with the component suite as suggested.

Your best bet here is to get a case open. They will have you enable advanced logging to help troubleshoot. They may have a workaround in place as well.

Have you applied High Security AV policy ? You can see that under polices

When you go into your antivirus and antispyware policy > Administrator Defined Scans > Advanced at the bottom is "Allow startup scans to run when user logs on" On? If so try turning that off. System could try to be running a full scan everytime a user logs on. 

Also how much resorces has the machine got? Although SEP 12.1 RU5 will run on a machine with 1/2GB memory it will run very slow Symantec recommends 2GB memory. Some of the older versions of SEP are more resource hungry. 

No we are using the Balanced Policy

Many thanks, though most of the devices that are affected with this have at least 8GB RAM. This issue is occurring before logging into windows so i would not expect it to be this.

Brian

Will do thanks.

This is just a nightmare to troubleshoot! Also it would appear that removing all AD Group policies from the affected device, or booting it without being connected to the network seems to resolve the issue. sometimes when i remove all GPO's then reinstall the SEP client it temporarily resolves the issue.

Regards

Leon

Brian,

Have just tested and it would appear that the component which seems to be causing the problem is PTP.

Regards

Leon

What type of hardware? Dell?

anything in the quaratine folder?

Mostly Dell, but also a HP has an issue. Dell E5440's and a HP 6460b

Brian,

I am trying to continue troubleshooting with this and was wondering how to disable each feature at a time? Is disabling it from the option within the gui on the SEP client sufficient?

I have tried disabling specific drivers using the Autoruns tool but keep getting an access denied error...

Regards

Leon

disable tamper protection and then try to disable the drivers.

Many thanks - how is this acheived?

Here is the doc for it

http://www.symantec.com/business/support/index?page=content&id=TECH192023

That's because tamper protection is enabled. It needs to be disabled first.

Were you able to get something back from support? We are having the same issue in our environment.