Endpoint Protection

Hi All,

I am using Symantec Endpoint Protection Manager 12.1.3001.165 and I am currently having an issue. As shown in this screen shot, I have a all clients that are showing the Early Launch Anti-Malware driver status as Disabled and Security Virtual Appliance not enable.This is causing my home page to show as something is wrong. The thing is, I disabled the Early Launch Anti-Malware in the policy that effects this group. It should show disabled by policy. I am using all machine having Windows 7 Professional.

How do I resolved this issue???

Did the clients pickup the policy change?

Is there some other component on here showing a problem?

No chnages on client status after policy change.

and also showing the Security Virtual Appliance not enable in the clients tab where show all users and computers, when the select view type of protection technology.

Thanks for the fast reply

Hello,

If it is Windows 8 / 2012, then I believe the Early Launch Anti-Malware Settings were disabled from the client machine and that is why we see as "Disabled"

If you have disabled from SEPM, then try disabling and then locking the policy.

Early Launch Anti-Malware Settings are supported on computers that run Microsoft Windows 8 or Later.

I checked this by Disabling the Policy on the SEPM and that affected the Windows 8 and 2012 and I receive the Status as "Disabled by Policy" on the SEPM.

However, In your case, since all the clients are Windows 7, this driver would not get installed at all. So, if you are disabling the Early Launch Anti-Malware Settings, these does not get effect on SEP client as this policy either way.

Check this Thread with similar issue:

https://www-secure.symantec.com/connect/forums/early-launch-anti-mailware-status-issue

Hope that helps!!

This sounds the same as the current Firewall bug that got introduced in RU2:

http://www.symantec.com/docs/TECH204587

Essentially, log a support case and wait for Symantec to fix it in the next release.  Considering the FW bug has been present since RU2 was released 11 months ago though, we might be waiting a while.

If it's bugging you, you can either edit your Security Status preferences to not alert on disabled components.  Or you can amend your policy to enable the Early Launch Anti-Malware component.  As you have no Win8 machines, it won't make any difference to the endpoints themselves, but may resolve your reporting issue.

You can log a support case as below:

http://www.symantec.com/support/techsupp_contact_phone.jsp

Hi

Have you tried upgrading to SEP 12.1.3

Regards

yes I have already used upgrade version 12.1.3