Endpoint Protection

Hi everyone,

I am facing a problem in an Rollout from SEP11.0.7 to the latest SEP12 verstion 12.1.4 MP1 (12.1.4100.4126) on clients and Manager on 12.1.4 MP1a.

Its occurring only on my Windows7 clients and it goes just like this:

After Push new packages to the clients, it normally notifies the user about the reboot required to upgrade SEP11.

When users reboot their workstations, SEP12 goes up but the client come up with no network connection (APIPA 169.x.x.x). If another reboot is executed, everything is resolved and SEP12 and network both works fine and no more action is required.

Even so, this situation is creating a lot of impact in our customer and i would really appreciate a way to prevent that.

I´ve already tried to (when the system comes up with no network connection) stop SEP client (smc -stop) and ipconfig release and renew, but no success.

I heard that using a MP1 package usually is not the best way to upgrade SEP11 (instead of RU) but based on the link below this MP1 version is completely good to upgrade all previous versions of SEP.

http://www.symantec.com/connect/blogs/latest-symantec-endpoint-protection-release-sep-12-ru4-mp1-12141004126

Does anybody has a suggestion?    

Yeah You can directly upgrade to MP1. Do you have network threat protection component included in your package? did you check NTP logs?

What components are installed?

I am deploying the SEP12 package with all security modules included and activated (NTP).

Just for your info the old SEP11.0.7 is also installed with NTP.

I will check the logs now, are you refering to the Firewall logs? I mean there are so many blocked traffic by default in there (like broadcasts) that i am not sure what to look for.

any ideas  

Network connection drops won't show in the firewall log. You would need to turn on some debugging to see this

But once its only happening until the second reboot, I guess turn the debuggin on after that won´t help, I am right?

Guys, not sure it helps but here is a installation log (SEP_INST.log) from a client which the network lost ocorried before restarting it again.

Could not find anything wrong in here.

Attachment(s)

SEP_INST_88.zip   133 KB 1 version

Run the cleanwipe and reinstall it again. After installation try to restart for check it.

Clean wipe is available on File Connect.

Hi tech,

Not sure I understand the reason for that test. Coul you please give me some more details?

If I run cleanwipe and remove SEP12, how could I possibly have any problem in re-installing SEP12 again once a simply extra reboot solves my problem when upgrading from SEP11.

My real problem is that the extra reboot, is causing a lot of impact in my customer. 

Support needs to look at this. I would recommend calling ASAP since you're on latest version.

Sure Brian, I do have the case opened already. As soon as we get to any solution I´ll update you...

thanks

Sounds good. thanks

Gentlemen,

I am pretty sure we found the root cause for that. This morning I could replicate the problem in Lab. All systems that experienced the lost of connection after upgrade, have a bank security plugin called GAS Tecnologia Filter Driver from Bank of Brazil (https://seg.bb.com.br/default.html). Just for your info, here in Brazil, there is a stupid law that obligates all internet banking operations to use this plugin called GBPLUGIN (by this GAS company), so all banks uses this sort of "security plugin" from the same vendor but each bank has a different way to install it on computers. In our case, specifically "bank of brazil" uses a creep way to install this plugin by creating a "network driver" on all Windows 7 systems, named "GAS Tecnologia Filter Driver" (print screen below).

If I simply unmark that driver inside users network proprierties (in the attach), before the upgrade, we do not face any lost of connection.

Unfortunatelly knowing the root cause is not enough, once if I unmark that driver for all users, their Internet Banking Operation will fail by the bank website.