Endpoint Protection

After rebooting to complete the upgrade 2 of our VDI hosts will not boot unless SEP is uninstalled in safemode. The others have the update already installed and we cannot reboot them until we figure this out. 

We had upgraded from 12.1.5 to 12.1.6168.6000 Redcued definitions, full install/all modules. 

Here is the BSOD

Log Name:      System

Source:        Microsoft-Windows-WER-SystemErrorReporting

Date:          7/21/2015 10:09:35 PM

Event ID:      1001

Task Category: None

Level:         Error

Keywords:      Classic

User:          N/A

Computer:      HOUVDIHOST01

Description:

The computer has rebooted from a bugcheck.  The bugcheck was: 0x0000009e (0xffffe00104c09900, 0x000000000000003c, 0x000000000000000a, 0x0000000000000000). A dump was saved in: C:\Windows\MEMORY.DMP. Report Id: 072115-45546-01.

Event Xml:

<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">

  <System>

    <Provider Name="Microsoft-Windows-WER-SystemErrorReporting" Guid="{ABCE23E7-DE45-4366-8631-84FA6C525952}" EventSourceName="BugCheck" />

    <EventID Qualifiers="16384">1001</EventID>

    <Version>0</Version>

    <Level>2</Level>

    <Task>0</Task>

    <Opcode>0</Opcode>

    <Keywords>0x80000000000000</Keywords>

    <TimeCreated SystemTime="2015-07-22T03:09:35.000000000Z" />

    <EventRecordID>268697</EventRecordID>

    <Correlation />

    <Execution ProcessID="0" ThreadID="0" />

    <Channel>System</Channel>

    <Computer>HOUVDIHOST01</Computer>

    <Security />

  </System>

  <EventData>

    <Data Name="param1">0x0000009e (0xffffe00104c09900, 0x000000000000003c, 0x000000000000000a, 0x0000000000000000)</Data>

    <Data Name="param2">C:\Windows\MEMORY.DMP</Data>

    <Data Name="param3">072115-45546-01</Data>

  </EventData>

</Event>

What components were installed?

Best to call support, get a case open and submit the BSOD to them. They may also have you run additional logging via symhelp.

All components. I'll open a case, I have just always had much better luck on the forums here. 

Problem is Symantec is best equipped to look at the BSOD and determine root cause.

Aside from that, have you tried to narrow it down to one specific component. Maybe install AV only, see what the result is. If good, install PTP and so on...

it only seemes to be effecting our clustered VDI Hosts. All the others upgraded fine. So, we can't really just see what works on them. Simply rebooting them takes a change order.