Endpoint Protection

Please HEELLLLPPPPP!!!

I have a case opened for several days now and it seems the technician is still unable to resolve my issue. I even had it escalated, however, I have yet to hear from the next technician/engineer...so I thought I'd post my issue here and see anyone can help.

Here are my issues:

1. When deploying the SEP Client through the "Find Unmanaged Computers" the configuration that was configured during the SEP installation does not stick. For example, the "preferred mode" always defer to "User Mode" instead of "Computer Mode." It also puts the client in a different group.

2. I realized that replication between by SEPM servers are not replicating. I have 2 SEPM servers with their own databases on two different sites. When I try to delete replication, I get a message that says "This feature is not supported for remote sites." When i try to delete the remote site, I get "You cannot delete the remote site. Some replicated groups us a management server list that is associated with this site. Configure the groups to use a different management server list. Then delete the remote site."  Well guess what, we followed a KB article on how to switch/remove management server list and we still couldn't delete the remote site.

I suspect that if i get my replication working, that it would also fix my issue on #1 above.

Any help is appreciated!

I'm running the latest version of SEP on both sites.

Hello,

Few Questions.

1) What version are you carrying for SEPM and SEP clients?

2) Have you sync SEPM with AD?

Suggestions:

1) It would sound odd, however, Could you try turning off a server and then try deleting the replication partner?

2) You could also, Try to delete the whole "remote sites" tree from the main SEPM.

If it is not possible I think you should apply the Disaster Recovery procedure without the backup of the DB. You will lose your settings (stored in the DB) but you will restore the communication with your clients. You can export/import your policies to save them.

The second SEPM should be useless in this moment.

Right on! I get a Sr. to answer my question.

1. All SEPM are running the latest version, 11.0.6300.803. I'm deploying the new version of SEP to systems that do not have antivirus installed. I do have older versions of SEP on other clients.

2. I do have SEPM sync with AD, but only for admin accounts that have access to SEPM. We do not sync SEPM with AD as it relates to OU/containers for populating the GROUP folders  under the "CLIENTS" tab.

I have tried stopping the SEPM service on the server that i was deleting, but it didn't work.

Performing any type of task will not such as deleting the WHOLE TREE under Remote Sites.

I don't understand what you mean by performing a Disaster Recovery without the backup of the DB. Could you elaborate?

Yes, i agree that the remote site is useless from the local site perspective because it's not even replicating and can't see any new/modified changes at that site.

Hello,

Change the MSL for all groups at the primary server to the default MSL of the primary.

Follow the Process as shown below:

NOTE: Make sure you Assign the Default Policy to all the Groups and Sub-groups.

HOPE THAT WORKS FOR YOU.

Unfortunately, that was first thing that we did and it didn't work.

Mithun,

So I went back and followed the process again, but this time I expanded all of the group to make sure that there was no "lingering" configuration of the remote SEPM server.  Low and behold there was a group using the SEPM server from the remote site. Once I applied a local SEPM, I was able to delete the remote site.

I also performed the same task on the other SEPM server.

Fixing replication also fixed the other issue that i had. Since i have had so much issues with our SEP environment, i think will not use the replication again. personally, i think it caused more harm than good.

thanks again for your assistance...it allowed me re-evaluate if there were steps that were missed. I wished the symantec technician would have figured this out from day 1 since he and i have spent several days trying to get this resolved.