Endpoint Protection

 View Only
  • 1.  Weird Things running amok on some of my terminal servers.

    Posted Jul 28, 2009 10:03 AM
    We are primarily a thin client network with upwards of 300 client computers.
    Each thin client connects to one of our 5 terminal servers through a farm configuration.
    Each server is roughly the same configuration hardware and software wise.
    Dell boxes running Server 2003 SP2. Intel Xeon 1.60GHz, 4 Gig Ram.
    I have loaded the SEPM onto one of our File and Print severs. Again pretty much same configuration as the TS servers. 
    Currently running SEP Version 11.0.4202.75
    Now I have been getting errors with the SMC on my Terminal Servers

    Application popup: Smc.exe - Application Error : The instruction at "0x61473225" referenced memory at "0x4c65aa5d". The memory could not be "read".

    The memory address will change from time to time.  This happens on every server that I have.  It does not appear every day, as a matter of fact, since I have downloaded and install the 11.0.4202.75 it has happen less, however it still is happening.

    I have called support and they were the ones the asked me to update to the 4202.75 build. 

    What happens is when the SMC.exe error appears, my users no longer can use said server until I reboot and clear the error.  This causes a major downtime for us and I need to be able to find someway to prevent this from happening.

    If any of you gurus out in WWW land can lend a hand, I would forever be in your debt.
    Thanks
    Jon


  • 2.  RE: Weird Things running amok on some of my terminal servers.

    Posted Jul 28, 2009 10:13 AM
    Disable The tamper protection on the server.

    Login to SEPM .

    Click on Clients Tab

    High light the group to whcih the Terminal server belongs

    Click on Policy

    Click the General settings

    Uncheck Tamper Protection


  • 3.  RE: Weird Things running amok on some of my terminal servers.

    Posted Jul 28, 2009 10:14 AM
    SmcGui must be disabled (to avoid multiple instances of that process and the SEP tray icon) by adding the following DWORD registry value on the Terminal Server:

    HKLM\SOFTWARE\Symantec\Symantec Endpoint Protection\SMC\LaunchSmcGui = 0


  • 4.  RE: Weird Things running amok on some of my terminal servers.
    Best Answer

    Posted Jul 28, 2009 10:15 AM
    Best Practices for Symantec Endpoint Protection on Citrix and Terminal Servers


    http://service1.symantec.com/SUPPORT/ent-security.nsf/docid/2008112414453348?Open&seg=w


  • 5.  RE: Weird Things running amok on some of my terminal servers.

    Posted Jul 28, 2009 10:40 AM
    But being the way that I am and questioning everything,
    Why would I want to disable the tampering protection?
    How does this cause an issue with SMC?
    Thanks for your help Prachand


  • 6.  RE: Weird Things running amok on some of my terminal servers.

    Posted Jul 28, 2009 10:49 AM
    May be its tamper protection or full scan or anything
    SMC is the main enginee for clients
    (Symantec Management Client)
    for autoprotect , rtvscan.exe would be scanning everything in real time and send it to smc.exe
    most of the times you get this pop up when two process are fighting.
    if some one is fighting with symantec, you will disable tamper protection.and theerrors go away
    i would like to know , do u  suspect any one fighting with our process?


  • 7.  RE: Weird Things running amok on some of my terminal servers.

    Posted Jul 29, 2009 12:17 PM
    Looking to delpoy SEP11 MR 4 on Citrix  4.5 (No Current Installs of either SEP or CSP on Servers)

    Questions:
    What is the latest levels to SEP and CSP ?

    Will these newer Levels correct All the past issues in Citrix Envorinment  as identified in Best Practice for SEP on Ctrix and TS ?

    If not, when will we have the levels bumped to correct all these issues?

    Any other options Symantecs products for Citrix and TS, e.i. CSP, other...instead ?

    Pros and Cons to SEP vs. CSP options for Citrix and TS.

    Thanks in Advance !