Endpoint Protection

When the SEPM service is enable the system will BSOD every other reboot.  We have also had systems BSOD after starting the service after the server has been running for more than 3 days.  The server will run with no issue prior to the SEPM service starting.  Has anyone else encounted similar problems with the SEPM 12.1.6

What process is causing the BSOD? What type of hardware is it running on? Have you tried the latest version, 12.1.6 MP2?

You'll need to open a case with Symantec and submit the full dump to them for review/RCA.

What type of hardware is it running on?

Its not running on hardware from a big manufacture (eg Dell or HP)

CPU Intel-Core duo 2.4GHZ

RAM: 4GB

OS Windows Server 2008

What process is causing the BSOD?

SEMSRV (symantec endpoint protection manager)

I ran test with SEPM web service and SEMP launcer services enabled and the SEPM service disabled.  We had a system run for weeks with those 2 services enabled and SEPM service disabled and the system ran with no problems.  I enabled the SEPM service and it BSOD is seconds.

Have you tried the latest version, 12.1.6 MP2?

No, I didn't know that there was an update until a few minutes ago.  I have to figure out how I can get it for testing.  I looked at the release notes for it and there no mention of a BSOD fix in that release.

It can be downloaded from https://fileconnect.symantec.com using your serial number.

But, correct, nothing is in the release notes.

Best bet is to submit to Symantec for RCA and they should be able to provide next steps. Could be a compatability issue with a driver/patch.

I was able to download 12.1.6 MP2.  I'll let you know how that goes.  I also create a case with Symantec so lets see if find something good.

Sounds good.

Just wanted to post an update.  We are still having the issue and symantec has just escalated it.

Did you upgrade the SEP on the SEPM? if so, when you upgraded, did you "Maintain existing client features when updating"? if not, see if some components were added:

read this about IPS and servers:

https://support.symantec.com/en_US/article.TECH162135.html

When the SEP manager service would start it would cause cause our CPU to spike over 100% and bluescreen.  To fix the the issue we had to do the following

• Create a user account for the SEP manager services to run under and set the SEPM services to run under that account
• Followed the step in the link to create a CPU quoata for the SEP manager service accounts https://technet.microsoft.com/en-us/library/ff384148(v=ws.10).aspx

We havent had a bluescreen in over 30 days.

What error message is displayed when your system bluescreens?

When the SEP manager service would start it would cause cause our CPU to spike over 100% and bluescreen.  To fix the the issue we had to do the following

• Create a user account for the SEP manager services to run under and set the SEPM services to run under that account
• Followed the step in the link to create a CPU quoata for the SEP manager service accounts https://technet.microsoft.com/en-us/library/ff384148(v=ws.10).aspx

We havent had a bluescreen in over 30 days.

What error message is displayed when your system bluescreens?

hi,

apply changes

BSOD disappeared, but the server is now just hangs

changes,

reinstall sepm 12.1.6 mp3

install java 1.7.-75

all sep services run on account "network service"

login to java admin console

add .slf file license

go to "client section" and server is hangs  to BSOD 0x000000101

in tomcat log folder any log files in attach

Attachment(s)

tomcat_2.zip   2 KB 1 version

hi,

find a solution

open folder "c:\Program Files (x86)\Symantec\Symantec Endpoint Protection Manager\tomcat\etc\"

open file "conf.properties"

add optinon "scm.delta.cpu.usage=0.xx", where xx is a number from 0 to 99 percent CPU utilization

By default, this option is set to 1.

I set this option to 0.5 and BSOD is disappeared