Endpoint Protection

Hello,

Not sure if this is the right forum to post in (first time posting).

After upgrading our clients to Endpoint Protection 12.1.3 there is an issue where users will hit cntrl+alt+del at the welcome screen, and the password prompt won't appear, their system will stop there. Sometimes they are able to get the password prompt, then log in and only get a black screen with a functioning mouse cursor. The third thing we've seen is they get logged in and see their task bar (no pinned icons, just the start button) but no desktop icons. They won't be able to open anything.

I've tried a reg fix for some event viewer errors, which seem to work in some cases. Support had me disable NTP which we're still testing now. This isn't ideal as it's the client firewall. They also acknowledged this is a known issue. Has anyone had this issue before? Is there a known fix? This has been going on since upgrading clients to v 12.1.3 over a month ago, and seems to be getting worse everyday.

Thanks,

Sam

I've never seen or heard this before and I have thousands on 12.1.3. But if support knows about it...did they point you to a KB article?

Did disabling NTP fix it?

What OS?

No they haven't pointed me to a KB. I've searched through the SEP site trying to find a KB on it, that's why I'm posting here hoping to find something. SEP is the only change on the system when the issue started. I've also tried uninstalling SEP and the issue seems to stop.

Disabling NTP seemed to fix it. Support asked to update the NIC and turn NTP back on which worked for a couple days, and now today the issue returned on this specific laptop I'm testing with. The problem is most systems get in after 2-3 hard boots. Only a select few require 10+ reboots to get back in, so troubleshooting is hit and miss to see if a fix works. It could be days before the issue returns.

Windows 7 OS, majority on SP1.

Since you're on the latest version, it still may be a little known issue. Hopefully a Symantec employee on the forums here can shed more light if they have some info on it.

Instead of disabling NTP (fw and IPS), have you tried just disabling the firewall?

Is there anything "special" about these machines or just the normal user?

I just tried turning IPS back on and had the blank screen after hitting cntrl alt del to log in. I'm going to try turning the FW on and IPS off and see if the issue happens agian.

These are all normal workstations, nothing special. Turns out it's about 80-90% of users who were upgraded are having this issue.

I'd be more surprised if it was the IPS than the firewall.

Out of curiosity, is anything out of the ordinary showing in either the Security or Traffic log at the time the login occurs/is attempted?

Hello,

Would you please assist me with the KB article?

Secondly, is this issue reported to the Symantec Technical Suppoort? If yes, please provide me with the Case #.

If not, I would appreciate you to Create a case with with Symantec Technical Support Team and PM me your Case #.

How to create a new case in MySupport

http://www.symantec.com/docs/TECH58873

Phone numbers to contact Tech Support:-

Regional Support Telephone Numbers:

• United States: https://support.broadcom.com (407-357-7600 from outside the United States)
• Australia: 1300 365510 (+61 2 8220 7111 from outside Australia)
• United Kingdom: +44 (0) 870 606 6000

Additional contact numbers: http://www.symantec.com/business/support/contact_techsupp_static.jsp

Hope that helps!!