Endpoint Protection

I have several users that are experiencing an issue with their systems that I believe I have narrowed it down to SEP.  

Dell Desktops and Laptops with Seagate Self Encrypting Drives (SED) either 250gb or 320gb.  All of the issues, seem to occur with the 320gb drives.  I originally thought a bad batch of drives, but the group is very random on when the Dell's were ordered.  The users will experience a severe slow down and the hard drive light is constantly on, but when looking at the process utilization, there is none.  I have disabled the encryption, and tested, and the issue still occurs.  Sometimes a rebuild from scratch will resolve, but it usually re-occurs.  The issue is temporarily resolved after a hard shut down and restart, but only for about a week or so.

Any suggestions at all??  Thank you in advance!!!

What version of SEP?

Also, what components do you have installed?

Similar thread with some different suggestions:

https://www-secure.symantec.com/connect/forums/sep-121-causing-most-computers-dramatically-slow

I would start by disabling Insight Lookup and see what the result is.

How the Insight Lookup process works

http://www.symantec.com/business/support/index?page=content&id=TECH169282

We are running: 12.1.671.4971

We have the following components:

Virus and Spyware Protection

Proactive Threat Protection

Network Threat Protection
 

Also, that is first version of SEP 12.1. Latest is 12.1 RU1 MP1. Are you able to upgrade one client as a test?

Hello,

As Brian asked, the version and the modules of SEP are so important. At least 12.1 versions must be for better performance. And it's better to start troubleshooting from installing modules one by one. I think only AV module can solve your problem.

Regards,

Oykun

See what happens if you disable NTP.

This is a shot in the dark, but try disabling Insight lookups for a test and see if this has any impact on performance.

How does Insight Lookup work? - http://www.symantec.com/business/support/index?page=content&id=TECH169282

I am testing with disabling Insight Lookups and see if there is a difference on the clients.  Thank you, I will report back what I find.

HI

Any good luck :)

I would suggest check from Seagate if they have have any Recommendation on Antivirus Exclusion of their Software, Encryption software does slow down you machine is a bit, I would also suggest taking it up with Seagate once.

Disabling Insight Lookups does not seem to have solved the issue.  Once of the users reported that his system exhibited the issue Monday morning.

Vikram, I am not sure I understand what you mean contact Seagate.  They are the manufacturer of the hard drive, there is no seagate software running.  Do you mean Wave encryption?  If so, this is hardware based encyrption, not software based encryption.  The software based encryption can cause slow system performance, but the hardware based does not due to how it works.

I will play with the NTP settings some more and see what I come up with it.  Any other suggestions???  Thanks for all your help thus far.

HI,

Could you please let us know what Process is taking the highest CPU & memory usage and how much?

Better you can stop Active scan on startup...for better performance.

Go to SEPM-->Policy-->Virus and spyware policy-->edit the scan policy and disable the active scan on windows start up.

Check these articles for more info.

https://www-secure.symantec.com/connect/forums/rtvscanexe-scaning-all-cusersxxxntuserdat-endlessly

https://www-secure.symantec.com/connect/forums/how-stop-scanning-ntuserdat

There is no process taking up any utilization during this time.  Everything is normal.  But the hard drive is pegged, the light is on continually.  Anything you try to click or do, is extremely slow.  These systems are developer  machines, core i7, 16GB of RAM, they should not have an issue running.  Even if we close all programs running, the system is extremely slow.  If the users reboots, it is slow to come up, slow to login, still completely slow, until a hard shut down is performed.

HI,

Try to disabled SEP and checked ?

Yes, we tested this with one machine and the user didn't have the issue.

The problem with this is that the issue does not happen daily.  It usually takes a few days to a week to occur.  I hate to leave a system unprotected for that long.

HI,

Have you check when system running slow any scanning progress are running or not ?

Try setting the scheduled scan for a different time during the day.  If the machines are never shut off, schedule the scan for in the evening or early morning.  If the machines are shut off at night and on weekends you could try setting the scan time for when the least amount of people would notice it, like when most people are on lunch. 

Or

1. Open the SEP window
2. Go to Scan for threats tab
3. Edit  your scheduled scan
4. Go to advanced scan options
5. Go to tuning options
6. In scan tuning options,either choose Best Application Performance or Balanced Performance.Test each configuration and choose what suits you best.
7. You could also consider scanning up to a maximum of 3 compression levels.

Check this thread Also

https://www-secure.symantec.com/connect/forums/scanning-1

We have checked and there are no scans running during the times that this is occuring.  I am currently trying disabling heuristic scanning and see if that changes anything.  Our scheduled scans only occur on Saturdays at 12:30am.