Remove the email component and check again

Can you capture the memory dump and work with symantec support?

Even Dr Watson logs and Windows Event Logs would be a good start.

Hello Bekir,

plese look eventviewer for errors. something stops it automaticaly. and please change antivirus policy and lock the "Enable Auto protect" 

Best Regards.

Fatih

Hi,

Is it a managed client or unmanaged client ?

If it's a managed client check whether he is receiving correct policy or not ?

Hello,

I am sure the Clients may be managed (still assuming)

However, I have some Questions.

1) Is this Happening on All machines or only on 1 machine?

2) What version of SEP is this?

3) On what OS this has been Installed?

Incase, if this is happening on all machines, please follow the steps below and check.

1) Login to the SEPM

2) Click on Clients, Highlight the Group the machine is reporting to.

3) Click on Policies Tab, Click on Antivirus and Antispyware Policy,

4) Click on File System Auto-Protect

5) Check if the Policy is enable or Disabled.

If in case, it is disabled, the AV/AS policy would turn it self off.

Thanks guys,

Here are the answers.

This is a 20.000 client network. They are all centrally managed and the issue is experienced on a few computers. Versions are RU6 and RU6 MP2. Auto-protect is enabled and locked. E-mail component is not installed.

I'll check the logs and will be back...

Hello Bekir,

By the way please check your windows updates. Maybe your client need to update. Therefore virus can infected that machine and can stop your sep client as like sality etc.

Best Regards.

Fatih