Video Screencast Help
Scheduled Maintenance: Symantec Connect is scheduled to be down Saturday, April 19 from 10am to 2pm Pacific Standard Time (GMT: 5pm to 9pm) for server migration and upgrades.
Please accept our apologies in advance for any inconvenience this might cause.

Upgrade of SEP 11.0.7 to 12.1.2 kills network connection

Created: 26 Feb 2013 • Updated: 28 Feb 2013 | 16 comments
This issue has been solved. See solution.

I upgraded a computer from 11.0.7 to 12.1.2 yesterday.  At the end, the installer requested a reboot.  It booted back up fine.  I shut it down at the end of the evening.  Today I come in and the computer could not connect to any wired or wireless network.  When I did a "ipconfig /renew", I got an error:

"The operation has failed as no adapter is in the state permissible for this operation."

I have since tried to remove SEP 12.1.2 but nothing has changed.  Below is a summary of what I've tried so far:

 Disabled Windows Firewall
- Removed antivirus (SEP 12.1.2)
- Removed nics, restarted, rediscovered nics
- Updated nic drivers
- Reset tcp/ip stack (see Microcoft KB 299357)
- Reset winsock (see Microsoft KB 811259)
- Reset winsock, ipv4, ipv6

Reset WINSOCK entries to installation defaults: netsh winsock reset catalog
Reset IPv4 TCP/IP stack to installation defaults. netsh int ipv4 reset reset.log
Reset IPv6 TCP/IP stack to installation defaults. netsh int ipv6 reset reset.log

When I run "netsh int ip dump", I see a mostly empty config with "reset" in the middle.

The network adapter is fine in Device Manager.

I've also looked for registry keys with "teefer" in them after seeing forum discussion https://www-secure.symantec.com/connect/forums/sep-1212-failed-upgrade-and-killed-network-connection

What's troubling is that the HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\NetworkProvider key is missing completely.  I don't know if that's from my "netsh int ip reset" attempt or something else more sinister.

Any advice is GREATLY appreciated.  I cannot upgrade our users until I figure this out.

Operating Systems:

Comments 16 CommentsJump to latest comment

_Brian's picture

What components do you have installed on the client?

Cameron_W's picture

Is this on a Win7 machine? If so I have had a couple of cases regarding this and your issue may be related. I would recommend running the symhelp tool on a affected machine (in broken state) then call into support with the resulting log file and reference KB article TECH202029 as there will be some information the TSE will need to confirm in the tool.

I am not guaranteeing that this is the exact same issue but it is worth following up on.

 

If I was able to help resolve your issue please mark my post as solution.

SebastianZ's picture

So after removing SEP and reinstalling Nics the problem still there?

- Is there any chance to restore the system to previous state

- is your machine using static IP configuration? - if yes try switching to dynamic with auto configuration on the network adapter

- is the DHCP client service running?

- look at following thread :

http://forums.techguy.org/networking/409551-solved...

and try this:

Start regedit - navigate to HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services

Scroll down to the key Winsock, and delete it, then delete the key Winsock2...

This is very important, reboot the pc, after you reboot right click on My Network Places - Properties - right click on Local network connection - Properties - click on the Install button - click to highlight Protocol - click on the Add button - in the Select Network Protocol box click on Have disk - in the Copy Manufactures files from box type in C:\Windows\inf - click to highlight Internet Protocol and OK...

SOLUTION
Mithun Sanghavi's picture

Hello,

I would suggest you to create a Case with the Symantec Technical Support Team and PM me your Case #

How to create a new case in MySupport

http://www.symantec.com/business/support/index?page=content&id=TECH58873

Phone numbers to contact Tech Support:-

Regional Support Telephone Numbers:

  • United States: 800-342-0652 (407-357-7600 from outside the United States)
  • Australia: 1300 365510 (+61 2 8220 7111 from outside Australia)
  • United Kingdom: +44 (0) 870 606 6000
 
Hope that helps!!

Mithun Sanghavi
Senior Consultant
MIM | MCSA | MCTS | STS | SSE | SSE+ | ITIL v3

Don't forget to mark your thread as 'SOLVED' with the answer that best helped you.

RhoSysAdmin's picture

I was able to get SEP removed well enough that my nic's started working again.  I can't be sure what worked b/c I tried so many things, but I think the fact that I recreated the following registry keys (which were missing) might have helped (or just a coincidence):

 

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\NetworkProvider\HwOrder

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\NetworkProvider\Order

Either way, removing SEP 12.1.2 completely seems to have done the trick.  I'll have to due some further testing on upgrading from 11.0.7 to 12.1.2 to see if my situation was a fluke or a sign of things to come.  I've re-installed 11.0.7 for now.

 

 

Andy Scott's picture

I'm experiencing the exact issue as described above, and have tried all the steps listed in this thread without resolution.

Mixture of operating systems Windows XP, Windows 7, Windows 2008 Standard, and 2008 R2.

When I do an ipconfig /all I get the hostname and dns config portion only. No TCP/IP information.

hforman's picture

Did you verify that you are using the correct versions?  32-bit vs. 64-bit?

Andy Scott's picture

Using the correct version 32-bit/64-bit.

NetworkProvider keys exists.

FNB Leigh's picture

We upgraded to 12.1 last week and have been experiencing the same issues decribed here.

So far doing a system restore and uninstalling SEP and reinstalling has been the only sure solution that has helped get the network active again on the system.

We have tried all the TCP/IP stack repair commands, nothing works.

Out of 80+ updates we've had 6 so far this week, seems everytime someone reboots their PC we get another dead network connection.

I'd love to find the fix to this besides restoring a PC. That takes over an hour and annoys the user.

 

Don2's picture

Hi all,

I've just had the same thing happen to two different customers in the last week. Both virtual W2K8 servers. I opened a case and used the newest version of CleanWipe supplied by Support (v5 didn't work) and it seemed to solve the problem. Funny thing is, I have hundreds of other customers (and ourselves) that havent had any problemas at all.

But there definitely seems to be some kind of bug!?

hforman's picture

I don't know if I'd call that a "bug", Don.  My predecessors here really made a mess of many old SAV installations and, to this day, I'm still finding pieces of really old SAV installations in some computers.  I have noticed that SEP 12.x seems a bit sensitive to very old SAV software.  One thing I was going to mention is that there was a change in the Symantec Network drivers (Teefer).  The new teefer is, I think, Teefer 3 while the old 11.0 driver was Teefer 2.  In some cases, due to rights or other network layers thrown in by other products, removing the old teefer is a bit difficult.  Usually, it comes out as part of an uninstall but, sometimes you can't uninstall it easily: Cleanwipe to the rescue!  Of the 60 machines here, I think I needed cleanwipe twice but, looking through registries and file folders, there are more computers that really need to be cleanwiped and reinstalled.  Here, I strongly suspect, previous techs removed SAV (old) versions by ripping out the folders by the roots without regard for the complexity or the manual uninstall procedures.  For example, in an attempt to move SAV from one drive to another.

It would be nice if new versions of SEP would check for old stuff and use some of the Clenwipe techniques to remove such old stuff, especially in the replacement of drivers, such as Teefer.  Just my personal opinion.

So, is this a bug?  or is this just recovering from some "rights issue" or a bad installation in the past?  Hard to tell on this one.

Andy Scott's picture

Any users here confirm at what point they believe the issue arises, e.g reboot or definition, policy update.

Another user in this thread reports the issue after a LiveUpdate or definition update. Which is consistent with what we are seeing.

https://www-secure.symantec.com/connect/forums/sep...

 

 

LucianoPS's picture

Hello RhoSysAdmin

I opened a case to Symantec analyse and it was concluded that is the bug with the version SEP12.1 RU2, only when we make the upgrade on computers that running Windows 7.

They gave me a workaround to run these machines.

Workaround:
This issue may be resolved before the second reboot by running the latest version of CleanWipe. Please contact support for access to the latest download.

Once networking has been lost:

1)Add the firewall component, if it is not present, and reboot.
2)Remove the firewall component, but do not reboot.
3)Back up the registry and delete the following registry keys if present:
a)HKLM\SYSTEM\CurrentControlSet\Control\Network\{4d36e974-e325-11ce-bfc1-08002be10318}\{72891E7B-0A3D-4541-BDCB-3DA62E25B6A8}
b)HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\services\eventlog\System\Teefer3
c)HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\services\Teefer3
d)HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\eventlog\System\Teefer3
3.5)HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Teefer3
4)Reboot the system and networking should be restored

In my case the problem was solved in step 2 but ran the whole process and I had no more troubles

Now I'm waiting Symantec release the new version SEP12 RU2 MP1.

Andy Scott's picture

 

Could you please post your case number that I can share with the engineers currently working on my own.

I have wasted several hours on the phone, repeating myself to a different engineer each time who would like to understand the issue. WebEx sessions running through the exact same troubleshooting steps to demonstrate the issue. (bang head on wall).

Also Symantec must have a documented KB for this internally. Would save me wasting more company time.

 

Also, what version were you upgrading from and to? 

Did you previously have Network Threat Protection installed, and have it included in your upgraded 12.1.2 package?

 

My case ID is 03863483 in case there is an engineer reading this post who knows how to communicate across teams to get my case sorted... I thank you

LucianoPS's picture

Andy, firt of all look my post about this problem: https://www-secure.symantec.com/connect/forums/pro...

I was trying to upgrade from version SEP11 RU7(11.0.7000.975) to SEP12 RU2(12.1.2015.2015)

My case ID is 03910053.