Endpoint Protection

We have been expierencing issues with W2K8 shares becoming unreponsive to our XP desktops. It appears from the perfmon data as well as the dmps that this issue may be related to SAV 10.2.1. According to Microsoft there have been others expierencing the same issue until they un-install SAV. Are others having the same issue?

The problem may be in SMB2, Symantec has problems with that.
SMB2 is used in 2008 and Vista so when you are using XP you won't lose any improvements that were introduced in SMB2 (you need both sides to be able to use v2).

Since installing Symantec Corporate Anti-Virus 10.2 on one of our Windows Server 2008 x64 servers, it has been completely freezing (even the console doesn't respond) every 3-5 days. Another one of our 2008 servers has not shown this problem, and has been using Symantec Corporate Anti-Virus 10.2 for half a year.

 

I'm going to try SEP 11 MR2 .... *fingers crossed*

Windows Server 2008 *is* listed as being supported by SCAV 10.2 though ....
http://eval.symantec.com/mktginfo/enterprise/fact_sheets/b-datasheet_antivirus_ce_3-2008_11280731-1.en-us.pdf

Good luck with that. I'm downgrading from SEP 11MR2 to AV Corp 10.2 because of this issue - after a day or 2, my clients workstations freeze up when trying to access any network shares on the server. The server is 2008 x64.

From what I have been told by SAV as well as Microsoft at this time there is no resolution. Around the end of Sept there will be MR3 for Endpoint 11 that should resolve the issue. Also around the end of the year there should be an update to SAV 10.2.1 that is supposed to resolve it as well.  Good Luck. We went back to W2K3R2 until issues are resolved.

Follow-up on my previous post: the freezing was resolved a while back and may have been due to conflicting multi-vendor-teaming network drivers from Intel and Broadcom. SAV 10.2 was *probably* not the cause.

However, since last week another 2008 x64 server started freezing for no clear reason ...

Currently I've got about a dozen systems running SEP11 MR2/MR3 (WinXP and Vista x86/x64) without any noticeable problems.

We're using SAV Corporate Edition (SAVCE) v. 10.2.0.276 and could really use the SMBv2 fix if it's availible.  Is there any new information regarding that issue?  Otherwise, does anyone know if the Windows 2008, SMBv2 & SAV CE issue persists with SAVCE v. 11?

 

We're at the point where upgrading to 11 or moving to a differnet vendor is an option since it's affecting our DFS migration plans.

 

TIA

 

Dux

I can confirm the exact same issue with SAV 10.2.0.276 on Sever 2008. Reading through other forums lead me to disable Auto-Protect and reboot. This seems to have alleviated the symptoms for now. I'm going to let things continue for a while to make sure no symptoms return with Auto-Protect disabled.

 

Does anyone know if MP1 fixes this? I seem to remember seeing another forum that indicated the issues persist with MP1, but for the life of me cannot dig this back up. Also, the release notes for MP1 don't mention this issue at all.  http://service1.symantec.com/support/ent-security.nsf/docid/2007080911252448

I am having the exact same issue with server 2008 SP1 64 BIT and 10.2.0.298.

 

Can you guys tell me which installer you used? I could only get the SAVWin64VISTA one to install, and then got all the disconnect issues mentioned in this thread.

 

The server is a DC/File/Print and WSUS replica server.

 

Thanks,

Gary

Just got off the phone with Symantec Support. They had me re-enable auto protect, but disable the Network Scanning. The tech admitted that there was an incompatibility that Symantec was still working on, but didn't give any more details.

 

I will post back after a few days to let everyone know if my SMB shares are still accessible.

 

@Garyf I think you have to use the vista installers. I'm running 32 bit, and had to use the Vista install.

Well, that lasted for 4 hours. Samba shares started locking up again. Had to turn auto-protect completely off again and reboot.

Hi Paul,

 

Thats a pity, I had to actually completely remove the software from the server in question, just stopping the services would not do the job, it appeared to, but after time the shares became unavailable again.

 

My 2 cents...

 

Gary

Just been sent this from our reseller...

 

http://service1.symantec.com/SUPPORT/ent-security.nsf/docid/2008061812370848

 

Gary