Endpoint Protection

I have about 50 Win XP SP3 machines that I have been able to remote deploy the client SEP to.  None of the clients register in the SEPM.  ONE TIME did I get this to work but had to blow away the server and start again because of other issues and I have not been able to get them to connect again.  I have re-installed and re-installed the client software over and over.  Remote deploy the packages and creating the package and installing it by hand to each machine but nothing works.  The SEPM is running in Win SVR 2008 Strd containing DHCP and DNS only.  I do not have AD.  What can I do to get my clients to connect to the SEPM to get updates?

Do you have a green dot on the SEP icon on the system tray?

Please check these KB's regarding troubleshooting communication issues with SEP

http://service1.symantec.com/SUPPORT/ent-security.nsf/docid/2008091215040048
http://service1.symantec.com/support/ent-security.nsf/docid/2009020909321648

Grab the sylinkmonitor tool and enabling debugging.
You can then see exactly how the client is communicating with the server.

http://service1.symantec.com/support/ent-security.nsf/854fa02b4f5013678825731a007d06af/4be077e14183395388257348007a2472?OpenDocument

I will try using the debug tool as soon as I get back to the office.  I can remote desktop into all my clients and ping them.  The clients are not registered in the Management Server even after the server installs the client remotely.  How is the server supposed to register the clients?

Two reasons 
1. Sylink.xml mismatch
2.IIS Permission or authentication failure for IUSR account

How do I make sure the Sylink.xml is correct?

Check if it has the correct  servername, the ip address of the server and the port on which it is communicating

Compare both these sylink files.

In SEPM every group has its own sylink and Group ID
Program Files\Symantec:\Symantec Endpoint Protection Manager\data\outbox\agent\0F4C825779F74C7000A2E19EBC385AA7 --(the first 4 digit represent the group id)

symantec endpoint protection\sylink.xml --on the clent.

One more thing to do Open the SEP Clients-- Help and Support -Troubleshooting -check the policy serial number ( 4 digits)
Then check if you have a folder in the above location on sepm computer starting with that number..

Is any client communication ? Have you tried re-creating a package and pushing it again.
Is the firewall turned off on the server ? and on the clients as well.

No clients are communicating.  I have recreated the package several times and pushed it to the client remotely and also taking the package on a thumbdrive and using the created installer.  I have tried to use the comms viewer mentioned above but I do not see any traffic at all.  I turned off both firewalls on the server and the clients.  I will look at the xml files.

Can you enable logging on IIS for Secars and enable IIS Logging or can Paste the sylinkmonitor logs.
service1.symantec.com/SUPPORT/ent-security.nsf/383ed085ad1ed2c6882571500069b34d/4be077e14183395388257348007a2472 

Which of the two EXE should I use?  I have the monitor running and nothing shows up on teh screen on the server or client.

Important Note regarding SEP 11 MR3:

The behavior of Sylink debug logging and SylinkMonitor tool has changed in SEP 11 MR3. With MR3, a debug value has to be manually set in the registry.

- Set registry key: HKLM\Software\Symantec\Symantec Endpoint Protection\SMC - smc_debuglog_on = 1
- Stop SMC: START > RUN > smc –stop
- Start SMC: START > RUN > smc –start
- Run SylinkMonitor

***[0x674]:[2009-07-20 21:34:31:207]***SylinkMonitor Started 07/20 21:34:53 [2304] ~~~Sylink log started. (SEP Product Version in registry: 11.0.4202.75, Sylink File Version: 11.0.4202.51) 07/20 21:34:53 [2304] Stored HostGUID=; outlen=0 07/20 21:34:53 [2304] <RestoreSettings>Stored UserGuid=0; outlen=2 07/20 21:34:53 [2304] <mfn_DecodeSSN>Sygate-SSN=0 07/20 21:34:53 [2304] <mfn_DecodeSSN>Read CSN=1 07/20 21:34:53 [2304] <mfn_DecodeSSN>Sygate-SSN=16 07/20 21:34:53 [2304] <mfn_DecodeSSN>Read CSN=17 07/20 21:34:53 [2304] Product Type=1,Major Ver=5,Minor Ver=1,Platform ID=2,OSType=17105154 07/20 21:34:53 [2304] OS=Windows XP Professional ; number=5.1.2600 07/20 21:34:53 [2304] SyLinkCreateInstance => Instance created: 018B2AE8 Registry path: SOFTWARE\Symantec\Symantec Endpoint Protection\SMC\SYLINK 07/20 21:34:53 [2304] <GetOnlineNicInfo>:Netport Count=1 07/20 21:34:53 [2304] <GetOnlineNicInfo>:NicInfo<SSANICs><SSANIC Ip="192.168.1.29" Mac="00-0e-8c-80-50-ea" Gateway="192.168.1.1" SubnetMask="0.0.0.0"/></SSANICs> 07/20 21:34:53 [2304] SyLinkCreateConfig => Created instance: 01898148 07/20 21:34:53 [2304] UseNewConfig => Created m_hNewConfig: 01898148 07/20 21:34:53 [2304] Importing ConfigObject: 0185DFC0 into: 01898148 07/20 21:34:53 [2304] Importing ConfigObject: 0185DFC0 into: 01896EA0 07/20 21:34:53 [2304] <PostEvent>stopping...ignore event ID=EVENT_SYLINK_CONFIG_SETTING_CHANGED 07/20 21:34:53 [2304] SSA packageType is set as 105 07/20 21:34:53 [2304] SyLinkDeleteConfig => Deleting instance: 0185DFC0 07/20 21:34:53 [2304] <SetHiStatus>HI status is changed to=3; reason=0; rule=Host Integrity check is disabled. Host Integrity policy has been disabled by the administrator. 07/20 21:34:54 [2304] SyLinkCreateConfig => Created instance: 04222D08 07/20 21:34:54 [2304] SetCurLocationName: Name is set to - Default 07/20 21:34:54 [2304] SetCurLocationID: ID is set to - 2F2493E4C0A801020098F9C27169FE14 07/20 21:34:54 [2304] SyLinkCreateConfig => Created instance: 042178B0 07/20 21:34:54 [2304] Importing ConfigObject: 042178B0 into: 01898148 07/20 21:34:54 [2304] Importing ConfigObject: 042178B0 into: 01896EA0 07/20 21:34:54 [2304] <PostEvent>stopping...ignore event ID=EVENT_SYLINK_CONFIG_SETTING_CHANGED 07/20 21:34:54 [2304] SyLinkDeleteConfig => Deleting instance: 042178B0 07/20 21:34:55 [2304] SyLinkDeleteConfig => Deleting instance: 04222D08 07/20 21:34:55 [2316] <ScheduleNextUpdate>Manually assigned heartbeat=1 seconds 07/20 21:34:55 [2352] <ScheduleNextUpdate>Manually assigned heartbeat=1 seconds 07/20 21:34:55 [2304] <CSyLink::Start()> 07/20 21:34:55 [2304] <CSyLink::ImportConfigFile()> 07/20 21:34:55 [2304] </CSyLink::ImportConfigFile()> 07/20 21:34:55 [2304] <GetDomainHostName>msz_DomainName is taken from szDomainName 07/20 21:34:55 [2304] <GetDomainHostName>DomainName (Final)=lab.com 07/20 21:34:55 [2304] *********Netport Count=1 07/20 21:34:55 [2304] Physical: Local Area Connection::00-0e-8c-80-50-ea::via rhine ii fast ethernet adapter 07/20 21:34:55 [2304] MAC=00-0e-8c-80-50-ea# Wireless= 07/20 21:34:55 [2304] Hardwire String=00-0e-8c-80-50-ea# 07/20 21:34:55 [3392] <HeartbeatThreadProc:>Thread is about to begin.. 07/20 21:34:55 [3384] Successfully created the heartbeat thread 07/20 21:34:55 [2304] <Start>Started, contact SMS every 300 seconds 07/20 21:34:55 [2304] <PostEvent>going to post event=EVENT_SYLINK_CONFIG_SETTING_CHANGED 07/20 21:34:55 [2304] <PostEvent>done post event=EVENT_SYLINK_CONFIG_SETTING_CHANGED, return=0 07/20 21:34:55 [2304] </CSyLink::Start()> 07/20 21:34:55 [3380] <CExpBackoff::CExpBackoff()> 07/20 21:34:55 [3380] </CExpBackoff::CExpBackoff()> 07/20 21:34:55 [3392] <CheckHeartbeatTimer>====== Heartbeat loop starts at 21:34:55 ====== 07/20 21:34:56 [3392] <GetOnlineNicInfo>:Netport Count=1 07/20 21:34:56 [3392] <GetOnlineNicInfo>:NicInfo<SSANICs><SSANIC Ip="192.168.1.29" Mac="00-0e-8c-80-50-ea" Gateway="0.0.0.0" SubnetMask="0.0.0.0"/></SSANICs> 07/20 21:34:56 [2304] <SetClientAuth>Received new User/Domain from SMC.. User: Administrator User Domain: lab 07/20 21:34:56 [2304] <SetClientAuth>Getting RDNS Domain Name (user domain in AD setup).. 07/20 21:34:56 [2304] <GetLoginRdnsDomain>DNS domain=lab.COM 07/20 21:34:56 [2304] <SetClientAuth>Setting the User Domain to RDNS Domain .. 07/20 21:34:56 [2304] <SetClientAuth>Logged in user info set to: lab.COM/Administrator 07/20 21:34:56 [2304] <SetClientAuth>Marking User Change Notify to redo registration.. 07/20 21:34:57 [2316] SyLinkCreateConfig => Created instance: 01827F68 07/20 21:34:57 [2316] Importing ConfigObject: 01896EA0 into: 01827F68 07/20 21:34:57 [2316] SyLinkDeleteConfig => Deleting instance: 01827F68 07/20 21:34:58 [2304] <ScheduleNextUpdate>Manually assigned heartbeat=1 seconds 07/20 21:35:02 [3392] <CalcAgentHashKey>:CH=703AEE4DC0A801020128ED5F3AF8A0B71desktoplab.comDB7472BE86A2E88CE7C8945F85C45808 07/20 21:35:02 [3392] <CalcAgentHashKey>:CHKey=13EAAA8B2077724AC782487C668C1CD6 07/20 21:35:02 [3392] <CalcAgentHashKey>:C=703AEE4DC0A801020128ED5F3AF8A0B71desktoplab.com 07/20 21:35:02 [3392] <CalcAgentHashKey>:CKey=B6D76B7D1C91252B9DB41EC9DDAA3F75 07/20 21:35:02 [3392] <CalcAgentHashKey>:UCH=703AEE4DC0A801020128ED5F3AF8A0B70Administratorlab.COMdesktoplab.comDB7472BE86A2E88CE7C8945F85C45808 07/20 21:35:02 [3392] <CalcAgentHashKey>:UCHKey=DE86EB32724AF533AECCE11E72F43101 07/20 21:35:02 [3392] <CalcAgentHashKey>:UC=703AEE4DC0A801020128ED5F3AF8A0B70Administratorlab.COMdesktoplab.com 07/20 21:35:02 [3392] <CalcAgentHashKey>:UCKey=52697D130DC39F095DB7651CDCC431F7 07/20 21:35:02 [3392] <DoHeartbeat>HardwareID=DB7472BE86A2E88CE7C8945F85C45808 07/20 21:35:02 [3392] <DoHeartbeat>CHKey=13EAAA8B2077724AC782487C668C1CD6 07/20 21:35:02 [3392] <DoHeartbeat>CKey=B6D76B7D1C91252B9DB41EC9DDAA3F75 07/20 21:35:02 [3392] <DoHeartbeat>UCHKey=DE86EB32724AF533AECCE11E72F43101 07/20 21:35:02 [3392] <DoHeartbeat>UCKey=52697D130DC39F095DB7651CDCC431F7 07/20 21:35:02 [3392] <DoHeartbeat> Set heartbeat event 07/20 21:35:02 [3392] Use new configuration 07/20 21:35:02 [3392] <RegHeartbeatProc>====== Reg Heartbeat loop starts at 21:35:02 ====== 07/20 21:35:03 [3392] HEARTBEAT: Check Point 1 07/20 21:35:03 [3392] <GetFirstSEMServer> Selecting a random server 07/20 21:35:03 [3392] <GetFirstServer> Using server '192.168.1.2' 07/20 21:35:03 [3392] HEARTBEAT: Check Point 2 07/20 21:35:03 [3392] <PostEvent>going to post event=EVENT_SERVER_CONNECTING 07/20 21:35:03 [3392] <PostEvent>done post event=EVENT_SERVER_CONNECTING, return=0 07/20 21:35:03 [3392] HEARTBEAT: Check Point 3 07/20 21:35:03 [3392] <RegHeartbeatProc>Setting the session timeout on Profile Session (Registration) to 30000 07/20 21:35:03 [3392] HEARTBEAT: Check Point 4 07/20 21:35:03 [3392] <RegHeartbeatProc>===Registration STAGE=== 07/20 21:35:03 [3392] <MakeRegisterData:>logon id (domain/user)=lab.COM/Administrator 07/20 21:35:03 [3392] <MakeRegisterData:>XML data: <SSARegData NameSpace="rpc"><AgentInfo DomainID="703AEE4DC0A801020128ED5F3AF8A0B7" AgentType="105" UserDomain="lab.COM" LoginUser="Administrator" ComputerDomain="lab.com" ComputerName="desktop" PreferredGroup="Myompany ‹lab" PreferredMode="1" HardwareKey="DB7472BE86A2E88CE7C8945F85C45808" SiteDomainName=""/> <SSAHostInfo><NetworkIdentity UserDomain="lab.COM" LogonUser="Administrator" HostDomain="lab.com" HostName="desktop" HostDesc="" /> <SSAProduct Version="11.0.4202.75" /> <SSAOS Version="5.1.2600" Desc="Windows 4B8BB98PProfessional" Type="17105154" ServicePack="ServicePack"/> <Processor ProcessorType="x86 0x1.8bcb80p-948mily%20Model%20Stepping" ProcessorClock="2801" ProcessorNum="1"/> <Memory Size="2112315392"/> <BIOS Version="PTLTD%20-"/> <TpmDevice Id="0"/> <SSAProfile Version="5.0.0" SerialNumber="2977-07225253415978041430000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000.000000200.0000002009%3a160x0.707d90p-102240"/> <SSAIDS Version="" SerialNumber=""/> <SSAUTC Bias="-60" /> <DNSs><DNS Address="192.168.1.2"/></DNSs> <DHCPServer Address="192.168.1.2"/><SSANICs><SSANIC Ip="192.168.1.29" Mac="00-0e-8c-80-50-ea" Gateway="0.0.0.0" SubnetMask="0.0.0.0"/></SSANICs> </SSAHostInfo> </SSARegData> 07/20 21:35:03 [3392] <SyLink>[MakeRegisterData] registration Hardware Key=DB7472BE86A2E88CE7C8945F85C45808 07/20 21:35:03 [3392] ************Reg CSN=18 07/20 21:35:03 [3392] <mfn_GenPostData (for Registration):>Request is: s_origin_length: 1225 s_session_id: DB7472BE86A2E88CE7C8945F85C45808 Sygate-SSN: 18 <SSARegData NameSpace="rpc"><AgentInfo DomainID="703AEE4DC0A801020128ED5F3AF8A0B7" AgentType="105" UserDomain="lab.COM" LoginUser="Administrator" ComputerDomain="lab.com" ComputerName="desktop" PreferredGroup="Myompany ‹lab" PreferredMode="1" HardwareKey="DB7472BE86A2E88CE7C8945F85C45808" SiteDomainName=""/> <SSAHostInfo><NetworkIdentity UserDomain="lab.COM" LogonUser="Administrator" HostDomain="lab.com" HostName="desktop" HostDesc="" /> <SSAProduct Version="11.0.4202.75" /> <SSAOS Version="5.1.2600" Desc="Windows 4B8A8A0PProfessional" Type="17105154" ServicePack="ServicePack"/> <Processor ProcessorType="x86 0x1.8a9c00p-948mily%20Model%20Stepping" ProcessorClock="2801" ProcessorNum="1"/> <Memory Size="2112315392"/> <BIOS Version="PTLTD%20-"/> <TpmDevice Id="0"/> <SSAProfile Version="5.0.0" SerialNumber="2977-07225764370727131160000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000.000000200.0000002009%3a160x0.707d90p-102240"/> <SSAIDS Version="" SerialNumber=""/> <SSAUTC Bias="-60" /> <DNSs><DNS Address="192.168.1.2"/></DNSs> <DHCPServer Address="192.168.1.2"/><SSANICs><SSANIC Ip="192.168.1.29" Mac="00-0e-8c-80-50-ea" Gateway="0.0.0.0" SubnetMask="0.0.0.0"/></SSANICs> </SSAHostInfo> </SSARegData> 07/20 21:35:03 [3392] <SendRegistrationRequest:>http://192.168.1.2:8014 [encrypted data] 07/20 21:35:24 [3392] <ParseErrorCode:>12029=>The attempt to connect to the server failed. 07/20 21:35:24 [3392] <SendRegistrationRequest:>SMS return=0 07/20 21:35:24 [3392] <ParseHTTPStatusCode:>0=>Uninterpreted Status 07/20 21:35:24 [3392] <SendRegistrationRequest:>ERR to query content length 07/20 21:35:24 [3392] <SendRegistrationRequest:>Content Lenght => 07/20 21:35:24 [3392] HTTP returns status code=0 07/20 21:35:24 [3392] <SendRegistrationRequest:>RECEIVE STAGE COMPLETED 07/20 21:35:24 [3392] <SendRegistrationRequest:>COMPLETED, returned 5 07/20 21:35:24 [3392] HEARTBEAT: Check Point 5.1 07/20 21:35:24 [3392] <RegHeartbeatProc>switch to another server 07/20 21:35:24 [3392] HEARTBEAT: Check Point 9 07/20 21:35:24 [3392] HEARTBEAT: Check Point 8 07/20 21:35:24 [3392] <PostEvent>going to post event=EVENT_SERVER_DISCONNECTED 07/20 21:35:24 [3392] <PostEvent>done post event=EVENT_SERVER_DISCONNECTED, return=0 07/20 21:35:24 [3392] HEARTBEAT: Check Point 1 07/20 21:35:24 [3392] HEARTBEAT: Check Point 2 07/20 21:35:24 [3392] <PostEvent>going to post event=EVENT_SERVER_CONNECTING 07/20 21:35:24 [3392] <PostEvent>done post event=EVENT_SERVER_CONNECTING, return=0 07/20 21:35:24 [3392] HEARTBEAT: Check Point 3 07/20 21:35:24 [3392] <RegHeartbeatProc>Setting the session timeout on Profile Session (Registration) to 30000 07/20 21:35:24 [3392] HEARTBEAT: Check Point 4 07/20 21:35:24 [3392] <RegHeartbeatProc>===Registration STAGE=== 07/20 21:35:24 [3392] <MakeRegisterData:>logon id (domain/user)=lab.COM/Administrator 07/20 21:35:24 [3392] <MakeRegisterData:>XML data: <SSARegData NameSpace="rpc"><AgentInfo DomainID="703AEE4DC0A801020128ED5F3AF8A0B7" AgentType="105" UserDomain="lab.COM" LoginUser="Administrator" ComputerDomain="lab.com" ComputerName="desktop" PreferredGroup="Myompany ‹lab" PreferredMode="1" HardwareKey="DB7472BE86A2E88CE7C8945F85C45808" SiteDomainName=""/> <SSAHostInfo><NetworkIdentity UserDomain="lab.COM" LogonUser="Administrator" HostDomain="lab.com" HostName="desktop" HostDesc="" /> <SSAProduct Version="11.0.4202.75" /> <SSAOS Version="5.1.2600" Desc="Windows 4B8BB98PProfessional" Type="17105154" ServicePack="ServicePack"/> <Processor ProcessorType="x86 0x1.8bcb80p-948mily%20Model%20Stepping" ProcessorClock="2801" ProcessorNum="1"/> <Memory Size="2112315392"/> <BIOS Version="PTLTD%20-"/> <TpmDevice Id="0"/> <SSAProfile Version="5.0.0" SerialNumber="2977-07225253415978041430000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000.000000200.0000002009%3a160x0.707d90p-102240"/> <SSAIDS Version="" SerialNumber=""/> <SSAUTC Bias="-60" /> <DNSs><DNS Address="192.168.1.2"/></DNSs> <DHCPServer Address="192.168.1.2"/><SSANICs><SSANIC Ip="192.168.1.29" Mac="00-0e-8c-80-50-ea" Gateway="0.0.0.0" SubnetMask="0.0.0.0"/></SSANICs> </SSAHostInfo> </SSARegData> 07/20 21:35:24 [3392] <SyLink>[MakeRegisterData] registration Hardware Key=DB7472BE86A2E88CE7C8945F85C45808 07/20 21:35:24 [3392] ************Reg CSN=19 07/20 21:35:24 [3392] <mfn_GenPostData (for Registration):>Request is: s_origin_length: 1225 s_session_id: DB7472BE86A2E88CE7C8945F85C45808 Sygate-SSN: 19 <SSARegData NameSpace="rpc"><AgentInfo DomainID="703AEE4DC0A801020128ED5F3AF8A0B7" AgentType="105" UserDomain="lab.COM" LoginUser="Administrator" ComputerDomain="lab.com" ComputerName="desktop" PreferredGroup="Myompany ‹lab" PreferredMode="1" HardwareKey="DB7472BE86A2E88CE7C8945F85C45808" SiteDomainName=""/> <SSAHostInfo><NetworkIdentity UserDomain="lab.COM" LogonUser="Administrator" HostDomain="lab.com" HostName="desktop" HostDesc="" /> <SSAProduct Version="11.0.4202.75" /> <SSAOS Version="5.1.2600" Desc="Windows 4B8A8A0PProfessional" Type="17105154" ServicePack="ServicePack"/> <Processor ProcessorType="x86 0x1.8a9c00p-948mily%20Model%20Stepping" ProcessorClock="2801" ProcessorNum="1"/> <Memory Size="2112315392"/> <BIOS Version="PTLTD%20-"/> <TpmDevice Id="0"/> <SSAProfile Version="5.0.0" SerialNumber="2977-07225764370727131160000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000.000000200.0000002009%3a160x0.707d90p-102240"/> <SSAIDS Version="" SerialNumber=""/> <SSAUTC Bias="-60" /> <DNSs><DNS Address="192.168.1.2"/></DNSs> <DHCPServer Address="192.168.1.2"/><SSANICs><SSANIC Ip="192.168.1.29" Mac="00-0e-8c-80-50-ea" Gateway="0.0.0.0" SubnetMask="0.0.0.0"/></SSANICs> </SSAHostInfo> </SSARegData> 07/20 21:35:24 [3392] <SendRegistrationRequest:>http://server:8014 [encrypted data] 07/20 21:35:45 [3392] <ParseErrorCode:>12029=>The attempt to connect to the server failed. 07/20 21:35:45 [3392] <SendRegistrationRequest:>SMS return=0 07/20 21:35:45 [3392] <ParseHTTPStatusCode:>0=>Uninterpreted Status 07/20 21:35:45 [3392] <SendRegistrationRequest:>ERR to query content length 07/20 21:35:45 [3392] <SendRegistrationRequest:>Content Lenght => 07/20 21:35:46 [3392] HTTP returns status code=0 07/20 21:35:46 [3392] <SendRegistrationRequest:>RECEIVE STAGE COMPLETED 07/20 21:35:46 [3392] <SendRegistrationRequest:>COMPLETED, returned 5 07/20 21:35:46 [3392] HEARTBEAT: Check Point 5.1 07/20 21:35:46 [3392] <ScheduleNextUpdate>new scheduled heartbeat=32 seconds 07/20 21:35:46 [3392] HEARTBEAT: Check Point 8 07/20 21:35:46 [3392] <PostEvent>going to post event=EVENT_SERVER_DISCONNECTED 07/20 21:35:46 [3392] <PostEvent>done post event=EVENT_SERVER_DISCONNECTED, return=0 07/20 21:35:46 [3392] <RegHeartbeatProc>====== Registration Procedure stops at 21:35:46 ====== 07/20 21:35:46 [3392] HEARTBEAT: Check Point 10 07/20 21:35:46 [3392] HEARTBEAT: Check Point Complete 07/20 21:35:46 [3392] <RegHeartbeatProc>Done, Heartbeat=32seconds 07/20 21:35:46 [3392] HeartbeatProcFailed to get profile with proxy setting 1 07/20 21:35:46 [3392] <CheckHeartbeatTimer>====== Heartbeat loop stops at 21:35:46 ======

Make sure that port used by SEPM on IIS is the same, that port listed into sylink.xml file

If you don`t find the HttpPort="port" it means that sylink contains default port 80.

Also if it is SVR 2008

Check the Firewall and create an exception for port 8014

That should take care of the communication issue

I will double check to make sure Windows did not decide what is best for me and turn the firewall back on knowing that is exactly what I want.

Are you using proxy server ?
Can put exception of http://servername:8014 in the proxy 

Checked and the firewall is still off on both the clients and server.  No proxy server here.  I know I have normal communication between the server and clients.  I will try to uninstall the software from all computers and try again.

As i said earlier check the sylink.xml file @ C:\Prog Files\Symantec\Symantec Endpoint protection

Make sure that the port in that file is correct.

Also you may try to replace the sylink.xml

Hi,

lets find where the problem is at the server or at the clients.

If you pushed the package and do not find any clients ( not even a single one ) that means the problem is on your server SEPM, on one machine where you have installed SEP, try this test
open a internet browser and type this

http://192.168.1.2:8014 /secars/secars?hello,secars

press enter

this should give you OK on the page
if its okay then the browser is able to communicate or talk to the IIS on your 2008

if not check if you have any ip address restrictions in your IIS ( i think this is the problem)

let me know what happens and lets go further after that, waiting for your reply

Checked the xml file and the port is correct.  I tried to enter the webaddress into IE and firefox both did not work.  I looked and do not see any ip restrictions.

What error do you get when you did the secars test by the following command

http://localhost:8014 /secars/secars?hello,secars

Also did u try to replace the sylink.xml

I have notice that even if we disable the firewall on win 2008 & server it will not allow  communication over port 8014 as it is not excluded the in the firewall..  I would suggested you create a exclusion on the win 2008 server firewall to allow the communication on port 8014 then start the firewall..

Hope this will help you.

Hi,

Please let us know what did u get when u tried the above command, its not necessary that you need to run it on a installed SEP client, you may run it on your server as well. Its a firewall or any other application blocking the communication. let us know what you got after entering the secars test

May I ask if your SEP client installed in your Server has a green dot?

if so, copy the sylink.xml from program files>>symantec> syamantec endpoint protection, after copying then transfer to one of your client then go to run type smc -stop then copy and paste to the same folder as mentioned above.

You guys will not believe this but my server just finished doing an update and it all works.  I haven't changed any settings or copied any files.  Not sure which update it was that it installed but it works.  You guys have been the best in helping me through this.  Better than any other help forum I have been at.  Thank you everyone!!!!

Thanks guys,Good day

Nice to here you that, It our pleasure to help for those needs help

Always there to help for any Symantec Issue.