Endpoint Protection

I upgraded the SEP manager server to RU5 with no problems.  I tested the client install on my Windows XP test machines using GUP, no issues.  I then deployed to all of my groups.  Within 15 minutes 150 computers were reporting back to the server that they had been updated.  Shortly after that I started receiving calls and emails that users PC were receiving BSODs.  The error was in sysplant.sys.  Most users new enought to just write down the error and push the button and restart the computer.  Some emailed us and others waited and emailed us once the computer restarted.  I stopped the deployment by removing the install package from the group, but what is going to happen when I put it back. 

Are the users who have ru5 going to continue to have BSODs?  Do I need to disable sysplant.sys throughout the entire company and if so what does that do to other system functionality?

 Sysplant.sys is the driver for Application and Device Control 

TZ, You should really open a case with Symantec Support. Get the dump to the Symantec engineers for analysis ASAP so that we can get to the root cause of your issue. PM me your case number once you have a support case open.

Thomas

I tried to open a support case yesterday as soon as this happened.  Seems I have forgotten my password and now my account is locked.  I receive this message when I try to reset my password - 

You have exceeded the maximum number of failed login attempts. For your protection, this account will be locked for 24 hours.

So I have a few hours left.  I have tried to open a case in the past over the phone, but it takes two days for anyone to call me back.  Online is usually the fastest.

my support case number 320-230-322

TZ,

I just pulled up your case number. Can you provide a full dump to this case ? This will really help our engineers get to the root cause.

Thanks,
Thomas

Anything new on this case?

Today i upgraded few machines, some of them had 11.2 version of SEP, some had 11.4 version.
 
No problems when upgrading from 11.4 to RU5 (11.5), but when upgrading from 11.2 to RU5, sysplant.sys BSOD error. After restarting BSOD computers, everything's fine and SEP works.

Tomorrow i'll do some more testing with 11.2 version clients, try to do a "clean" upgrade without Application and Device Control feature. And after all 11.2 version clients are upgraded to RU5, i'll just add a different install package which also contains Application and Device Control feature, and after a while all computers in that group will have also Application and Device Control feature installed?

The full dump file submitted by TZ was corrupt, support is still waiting for that to be resubmitted by the customer.
I would recommend you open a case with support to get your issue to the engineers for analysis ASAP.

Best,
Thomas

I'll try to get dump files from our customer tomorrow if that's ok for them.

I might not open the support case if our workaround resolves our upgrade issue, because the infra where i noticed this issue is one of our so called one time customer's environment, who might not give me the needed access for handling support case.

But of course if there's something i can do to help with this problem, i'll do my best.

If you do not open a case, then PM me once you have the dump. I will give you an FTP location to upload the file. I can then send that dump on up for analysis.

Best,
Thomas

Cycletech, just to be sure, we are talking about Windows memory dump files or something else?

I'll get those and post to you, still considering to open a support case as i'm a Symantec TAPP Partner and do have an access and necessary rights to open support cases via Mysupport or phone, just dont have the access to customer's infra after tomorrow. 

I'll get back to you later, and just tell me if there's something else i can do.

Br,
JT

Yes, the full Windows memory dump is what we need to analyze.

Thanks,
Thomas

Unfortunately i only got minidump file and had only one 11.2 version client computer to test with it, couldn't reproduce the BSOD problem with that computer.

If you think that this minidump could help, just tell me where to send it, i created a log file (.txt) from minidump with Windows debug tools.

Br,

JT

@ JT_T, we really need a full dump to get an understanding of what is causing the BSOD.

Best,
Thomas

Finally got a full memory dump.  I have sent it off to Symantec support. Will post more as I hear back from them.

Has there been any resolution to this I am also having the same issue on a specific subset of laptops. I have an enviroment of about 600 units 450 laptops 150 desk tops, the desktops work fine a subset of 20 laptops seem to always bsod with the sysplant error on a regular basis.

Interested to hear if there was any resolution to this problem as we have start to see BSOD from sysplant.sys in our environment?

@ TZ,

The sysplant.sys issue was fixed in RU6. We had the same issue here with RU5. I've upgraded and haven't seen the issue since.

Random system crashes implicating sysplant.sys
Fix ID: 1743080
Symptom: A system crash occurs when sysplant is attempting to access another application that is only partially loaded into memory
Solution: Improved error handling for this situation.

Mike

Also, if your not using application device control, disabling sysplant.sys on the RU5 clients will not adversely effect other SEP components.

You can do this by enabling hidden devices in device manager (view>show hidden devices), sysplant.sys should be in "Non-Plug and Play Drivers" and is labeled Sysplant for NT. Right click to disable.

Mike

Works fine now in RU6

I openned a technical support case on Friday and was advised to upgrade to RU5 and not RU6 because RU6 has its own Application and device Control issue apparently if the SEPM is RU6 and the clients are of a lessor version (i.e. <RU6) Applcation and Deivce control will turn on blocking all devices. We have Application and Device enabled to control access to USB Mass Storage devices and we really don't want to turn off.

I was told by the Tech that RU6 MP1 would be released in July which would address the BSOD issue in RU6.

 

To Jamit,

Jamit, is there any published articles regarding the issue you talking about? RU6 SEPM and RU6 less clients will turn on blocking all devices.

Thanks

Hi mssym, I have asked the Technician to provide me more information on the problem as we would prefer to deploy RU6 or RU6a as RU6 has a fix that we need for our wireless network.

Details on the Application and Device control problem for RU6 and RU6a

http://service1.symantec.com/SUPPORT/ent-security.nsf/docid/2010050612450248