Video Screencast Help

SNAC Network Provider

Created: 20 Feb 2009 • Updated: 21 May 2010 | 3 comments
This issue has been solved. See solution.

I am running SEP 11.0.2000.1567, have been for months. Recently the Win2K clients have stopped updating their defs and they are reporting that virus protection is not running. On checking out these clients I noticed dozens of Symantec SNAC Network Providers listed under "Network Places/Entire Network" Uninstalling SEP completely and reinstalling seems to cleanup the problem for now. I run Antivus and Proactive Threat Protection only on the clients. Why is SNAC showing up? What is it doing and how do I stop it? There doesn't seem to be a problem on the XP machines, so far.

Comments 3 CommentsJump to latest comment

SKlassen's picture

The provider listing is part of the default install.  There should only be one instance of it.  Older versions of SEP had a bug, where an install of SEP (new, upgrade, repair), would cause a new instance of the provider to be written to the registry even if it already existed.


This was fixed in a more recent version of SEP, MR2 MP1 (your running MR2, the version before the fix was implemented).  Heck, while your at it, come on up to the most recent, MR4 MP1.  To do this from your level, you'd have to go from MR2 to MR4, then MR4 MP1.  For a list of fixes that have come out since MR2, please see the release notes available in the knowledgebase.


You don't need to do an uninstall, then reinstall to remove them.  They are simple registry entries.  HKLM\System\CurrentControlSet\Control\NetworkProvider\HWOrder  and  HKLM\System\CurrentControlSet\Control\NetworkProvider\Order


In each of these keys, modify the ProviderOrder String to remove the extra SNAC entries.


That you had dozens of these in each machine is telling me that they've all had the installer run dozens of times on them.  This is much more worrisome.  By what means did you deploy SEP to these machines?  If using group policy software deployment and setup incorrectly, a reinstall can be triggered with every single reboot.  Not just SEP, any software using this means.  It can also be caused by changes to the client feature set, which again triggers the installer.


Network Providers in My Network Places has more than one instance of Symantec SNAC Network Provider
Fix ID:
Symptom: When changing the client set feature from Symantec Endpoint Protection Manager, each change adds another instance of Symantec SNAC Network Provider.
Solution: Updated the code to no longer add unneeded SNAC Network Provider entries to the registry.


Hope this helped.





burningtower's picture

I would love to upgrade to the latest version, if only I had the time. I started out with the original version of SEP then went to MR1 then to MR2 each time investing days and days of time getting everything to run correctly again. On the first upgrade "MR1" I ended up uninstalling everything from the server and starting over, then getting all the clients to check in, and on and on. I'm really not motivated to invest that kind of time "fixing" a system that is mostly working and I have other projects eating into my weekends already.


I installed all these machines with the "Migration and Deployment Wizard" except this last one I did manually from the client.


Were the multiple SNAC Network Providers keeping the client from updating ?


Define "Feature Sets". I make changes to policies and move clients from group to group (domains) relatively often but I don't change the basic install features.


SKlassen's picture

I know that feeling.  Amazing how a 40hr/week IT job takes 80hr/week.  :)



Feature Sets:  Things like Network Threat, Proactive Threat, and the email integration components.  To install or uninstall a component, you'd have to send out a new install package to the client with the change.  Policy changes and group moves wouldn't trigger this.