Endpoint Protection

Hello All,

I am trying to install SEP client on windows 7 ent SP1 and after the install when I reboot the system the SMC service does not start automatically and when I manually start it, it starts and stop immidiately.

I have tried enabling the SMC debug log and found this error

" StartEngine: FAILED to ImportIDS config "

can any one from symantec help me on this

Thanks.

Run the SymHelp tool on it:

Troubleshooting computer issues with the Symantec Help support tool

http://www.symantec.com/docs/HOWTO80839

Also, what's the exact version you're trying to install?

Fresh install or upgrade?

You can turn on SMC debugging as well:

http://www.symantec.com/docs/TECH102412

did this machine had any other AV installed before SEP?Whats the error message you see in the event viewer?

run the cleanwipe tool which is found in CD2 tools folder of the download

then install a fresh copy, 

its a fresh install if I do the auto upgrade the package it works fine.

Only in case of a fresh install its giving issue. The version I am using in 12.1.4

This is some part of the debug logs

14/01/09 11:30:35.209 [4644:4232] changing heartbeat for location Default
2014/01/09 11:30:35.209 [4644:4232] changed heartbeat status to  1
2014/01/09 11:30:35.209 [4644:5464] CProfileMgrManPlugin::Enable: enter
2014/01/09 11:30:35.209 [4644:5464] enable=true
2014/01/09 11:30:35.209 [4644:5464] CProfileMgrManPlugin::Enable: exit
2014/01/09 11:30:35.209 [4644:5464] AVMan: Entering Enable -- enable=true
2014/01/09 11:30:35.209 [4644:5464] AVMan: Entering ExportUseNewConfig
2014/01/09 11:30:35.209 [4644:5464] AVMan: Entering UseNewConfig()
2014/01/09 11:30:35.209 [4644:5464] AVMan: Leaving UseNewConfig()
2014/01/09 11:30:35.209 [4644:5464] AVMan: Leaving ExportUseNewConfig
2014/01/09 11:30:35.209 [4644:5464] AVMan: Disabled event forwarding.
2014/01/09 11:30:35.209 [4644:5464] GUProxy: Enable called.
2014/01/09 11:30:35.209 [4644:5464] GUProxy: Enable
2014/01/09 11:30:35.209 [4644:5464] AtpiMan: Entering Enable -- enable=true
2014/01/09 11:30:35.209 [4644:5464] BashMan: Entering Enable -- enable=true
2014/01/09 11:30:35.209 [4644:5464] CidsMan: Entering Enable -- enable=true
2014/01/09 11:30:35.209 [4644:5464] RebootMgrMan: Entering Enable -- enable=true
2014/01/09 11:30:35.209 [4644:5464] RepMgtMan: Entering Enable -- enable=true
2014/01/09 11:30:35.209 [4644:5464] SubmissionsMan: Entering Enable -- enable=true
2014/01/09 11:30:35.210 [4644:5964] <NacManger@383> pipe listening 997
2014/01/09 11:30:35.212 [4644:4232] StartEngine: FAILED to ImportIDS config
2014/01/09 11:30:35.212 [4644:4232] Service Start Initialize() Failed!
2014/01/09 11:30:35.212 [4644:4232] Service is shutting down
2014/01/09 11:30:35.212 [4644:4232] CProfileMgrManPlugin::ReceiveMessage: enter
2014/01/09 11:30:35.212 [4644:4232] ProfileMgrMan: ReceiveMessage with msg id 458754
2014/01/09 11:30:35.212 [4644:4232] CProfileMgrManPlugin::ReceiveMessage: exit
2014/01/09 11:30:35.212 [4644:4232] AVMan: Entering ReceiveMessage with msg id 458754
2014/01/09 11:30:35.212 [4644:4232] AVMan: Leaving ReceiveMessage
2014/01/09 11:30:35.212 [4644:4232] LUMan: Entering ReceiveMessage with id 0x70002
2014/01/09 11:30:35.212 [4644:4232] LUMan: SMC notified LuMan that it is stopping
2014/01/09 11:30:35.212 [4644:4232] AtpiMan: Entering ReceiveMessage with msg id 458754

Event viewer is showing this

"The Symantec Management Client service entered the stopped state " event ID 7036

Run a repair on the client first to see if it fixes it.

If not, remove the NTP component to see what the result is (just to test it).

I also tried running the clean wipe tool but no go... :(

If we remove the Firewall component from NTP through Add and remove programs the service starts normally and everything is good. Even after restoring the Firewall component it continues to work fine.

When you initially installed and service started/stopped, did it function normally after a reboot? Or, was it only when you removed the NTP component and than re-installed it?

Since you're on the latest version, this could be a bug of some sort. Support will likely need to look at this to determine what is going on.

You will need to collect some logs for them:

How to use the Symantec Help Tool to collect data for Support

http://www.symantec.com/docs/TECH203599

How to create a new case in MySymantec

http://www.symantec.com/docs/TECH58873

Phone numbers to contact Tech Support:

Regional Support Telephone Numbers:

    United States: https://support.broadcom.com (407-357-7600 from outside the United States)
    Australia: 1300 365510 (+61 2 8220 7111 from outside Australia)
    United Kingdom: +44 (0) 870 606 6000

Additional contact numbers: http://www.symantec.com/support/contact_techsupp_static.jsp

copy the cltdef.dat and serdef.dat from a working client and replace it on the problamatic machine, that should fix it

https://www-secure.symantec.com/connect/forums/smcservice-failing-start

@Brian:

After installation it asks to reboot, and when i do that, it will not start again, and i am not able to open the symantec shield. Where as if i remove the firewall component from the ntp through add and remove programs, it starts well. And even i can add back the firewall component, and the SMC works fine as before.

@Rafeeq

My problem is not limited to one client, if i do deployment an any client result is the same,

and problem is i cannot able to replace those files. its not allowing me to replace.

I have even tried to disable tamper protection and do it.

I am facing this problem since 12.1.3 release. and already have support case with symantec.

Is it only Win7 or does the OS type not matter?

Its happening on windows 7, windows 8, windows xp as well

Hello,

Check the steps provided in these Articles below: 

SEP client SMC service cannot start

http://www.symantec.com/docs/TECH195546

SMC service will not start. Error 0x80070102

http://www.symantec.com/docs/TECH195222

Hope that helps!!

Hi,

Could you please PM me the case number. 

Hi Chetan,

The case number is 05768610, and can i get symhelp viewer

thanks

Kavin

Hi Mithun,

We are using 12.1.4, and your docs are meant for lower versions

thanks

Hello,

The steps would also work for the Latest versions.

I am sure it's worth a try.

It was an issue with custom IPS signatures that we were using, Modified the custom IPS signatures and the issue resolved.

Thanks to Symantec Support :)

Out of curiosity, did they provide support on how to fix the custom signatures? In the past, I've been told custom IPS signatures were not supported. If this has changed, I would love to know.

Thanks for following up.