Endpoint Protection

I had to do a DR restore of my SEPM v12.

All I had was a database backup.  The certificate I was unable to backup.

I acquired a copy of the Sylink replacer tool from Symantec Support.

I can discover the clients just fine, but they still end up not being updated.

Under C:\sylinkreplacer\logs\client, I see all my clients in the SMC_STOP_FAIL txt document.

Anything I'm missing?  I have close to 500 clients and it will be a pain to replace all of them manually.

Hi

If iam right i think from whatever you have mentioned ,the Server private key is not backed up and when you try sylink replacer the clients are not communicating back to sepm.

If that is the exact scenario try the following.

In the sylink file that you exported from sepm initially  edit the value Verifysignature from 1 to 0.You will find 2 entries.Edit both and then replace it on the clients using sylink replacer..This should work.If you have any password for your client console then enter it in the sylink replacer tool when prompted.

No, the clients are discovered during the discovery phase of the Sylink replacer tool.

It goes thru the motions, but when I inspect the log all my clients are in the SMC_STOP_FAIL txt document.

Are you using the new 12.1 sylinkreplacer tool? What most likely is happening is the tool is discovering the clients but with 12.1 tamper protection will not allow sylinkreplacer.exe to stop SMC because sylinkreplacer.exe in not signed, thus all the clients showing in the SMC_STOP_FAIL.txt. With the new tool sylinkreplacer.exe calls sylinkdrop.exe (which is installed with all 12.1 installations) to perform the actual replacement of the sylink and because sylinkdrop is signed tamper protection will allow it to stop SMC. You can contact support and request the 12.1 sylinkreplacer tool.

Thanks,

The Discovery process normally discovers clients that are online and are responding to the machine from which the sylink replacer is ran.You can even select no for discovery and it would replace the sylink file directly to the clinets that are online and it would be faster too.

The reason why i suggested to change the  verifysignature value to 0 is ,as you have mentioned the Server private key backup is not restored the clients wont be able tocommunicate with SEPM even after replacing sylink as there would be a mismatch in the certificate.When the  verifysignature value is set to 0 the certifictae wont be checked and clients would communicate with SEPM .

As far as I know, the only tool able to successfully replace the SyLink files on SEP12.1 clients is the SyLinkDrop.exe tool that is part of the media package (that's the "Tools and Document" download from fileconnect).

If your clients are SEP12.1, then you should be using that tool for changing the SyLink file around.  I don't know if the SyLinkReplacer tool has even been updated for SEP12.1.  If not, it will only work on SEP11 clients.

Cameron and SMLatCST,

My SEPM and SyLink replacer is version 12.1.

My clients on the other hand are at 11.6 MR2.

Would Sylink Replacer tool work with the above mentioned configuration?

I just tried to Sylink Replace a client with v12 and it updated successfully. So I know that it's not a permissions thing.

Should I be using the v 11 Sylink replacer?

For  version 11 cleints use Sylink 11.0

Folder Structure is different in Ver 12.

I downloaded Sylink 11.0 v 1.3 and it worked perfectly.

Thanks so much all.