Endpoint Protection

We have just upgraded a number of Windows 2008 and Windows 2008 R2 servers from 11.06 to 12.1.1101.401 (Release), RU1 MP1. These servers are managed by SEPM which was also upgraded to 12.1.1. Ever since the upgrade, every server running SEP 12.1.1101.401 (Release), RU1 MP1 hangs at the "Shutting Down Windows" screen after a Windows Update. None of the 11.06 servers do this. We have halted further deployment of SEP 12.1.1101.401 (Release), RU1 MP1 until we can figure out what is going on. The problem is directly related to the upgrade to SEP 12.1.1101.401 (Release), RU1 MP1. How do we fix this problem. Thanks.

HI,

Check this thread

https://www-secure.symantec.com/connect/forums/endpoint-protection-freezing-laptops

Read through the thread. However, my servers are virtual and not Dell laptops. They were upgraded from 11.06 using the client deployment utility in SEPM 12.1. 

Hi,

Try to Reinstall SEP client

Probably this is due to UphClean

Variants:

- remove UphClean

- add this:

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\UPHClean\Parameters]
"PROCESS_EXCLUSION_LIST"=hex(7):53,00,79,00,73,00,74,00,65,00,6d,00,00,00,63,\
  00,63,00,53,00,76,00,63,00,48,00,73,00,74,00,2e,00,65,00,78,00,65,00,00,00,\
  53,00,6d,00,63,00,2e,00,65,00,78,00,65,00,00,00,00,00
"USER_EXCLUSION_LIST"=hex(7):63,00,63,00,53,00,76,00,63,00,48,00,73,00,74,00,\
  2e,00,65,00,78,00,65,00,00,00,53,00,6d,00,63,00,2e,00,65,00,78,00,65,00,00,\
  00,00,00
 

This helps me with same situation on WinXP

UphClean has never been used on any of our servers.

Hi Will,

Have you reinstall SEP client ?

We have to wait until the next server maintenance cylcle as all servers are currently in production and cannot be taken down. Are you suggesting to remove the existing installed client first or just reinstall over top?

We have to wait until the next server maintenance cylcle as all servers are currently in production and cannot be taken down. Are you suggesting to remove the existing installed client first or just reinstall over top?

Yes,

If you want to temp solution try to disable SEP services.

Yes you would need to a complete uninstall/reinstall.

What components do you have installed on the servers?

Hello,

Could you let us know what was your Upgrade Path?

Did you migrate from SEP 11.0.6 to 12.1.1101.401 directly?

If yes, it is not a supported migration path.

It is always recommended to migrate Symantec Endpoint Protection 12.1.1101.401 (RU1 MP1) over Symantec Endpoint Protection 12.1.1000.157 (RU1).

Secondly, Do you receive any error when the machine shuts down OR it simply freezes?

Incase, of an error please provide us the Error Message.

Hope that helps!!

Yes. We migrated from 11.0.6005.562 to 12.1.1101.401 (RU1 MP1) pushing it from out 12.1.1 SEPM server using the Symantec Migration and Deplyment Wizzard. No problems during the install.

There are no errors when the machines shut down. They just freeze at "Shutting Dowwn..."

I just uninstalled 12.1.1101.401 (RU1 MP1) from one of our servers that is experiencing the problem, rebooted and reinstalled 12.1.1101.401 (RU1 MP1). I'll continue to monitor this server to see if it still experiences the problem. If this is not a recommended solution, please post the next course of action. Thanks. 

If it continues to happen with Ru1  Mp1, your best bet is to rollback to the version that worked. Or you can call support and open a ticket so they can investigate.

Mithun Sanghavi;

Here is what your comments:

"Did you migrate from SEP 11.0.6 to 12.1.1101.401 directly?

If yes, it is not a supported migration path.

It is always recommended to migrate Symantec Endpoint Protection 12.1.1101.401 (RU1 MP1) over Symantec Endpoint Protection 12.1.1000.157 (RU1)."

Where did Symentec document that migration path is not supported?

I think migration from 12.1.1000.157 to 12.1101.401 is seemless upgrade, but all other previous version upgrade are supported by the product and Symantec.

Ashish,

How to actually stop the SEP service completely ?

does stopping the service from services console is good enough ?

To create a new custom client installation configuration

1.     Open the Symantec Endpoint Protection Manager console.

2.     On the Admin Tab, under Tasks, click Install Packages.
The current default client installation packages appear on the right.

3.     Under Install Packages, click Client Install Settings.

4.     Under Tasks, click Add Client Install Settings.

5.     Specify the name you would like the custom Client Install Settings to have.

6.     Give the custom Client Install Settings a description.

7.     Select an installation type from the following:

·         Show progress bar only (Displays notification, but requires no user input)

·         Interactive (User input required)

·         Silent (No user input or display)

8.     Select the installation location (default or custom folder). 

9.     Enable or disable installation logging.

10.  Submit reputation information to Symantec Security Response. 

11.  Select whether or not to add the program to the Start Menu.

12.  Select whether or not to maintain all previous logs, policies, and client-server communication settings

13.  Viewing the 'Schedule Reboot' tab, consider whether to force or schedule a reboot.

14.  Click OK.

To know more about :

Restarting client computers : http://www.symantec.com/docs/HOWTO55111

Please find the attached doc.

Attachment(s)

Change restart setting.docx   194 KB 1 version