How to scan in safe mode with Symantec Endpoint Protection 12.1 RU1 MP1 and earlier.

Article:TECH176971  |  Created: 2011-12-14  |  Updated: 2013-05-03  |  Article URL
Article Type
Technical Solution


Cannot open Symantec Endpoint Protection (SEP) from program list. Following error appears:
“Symantec  Endpoint Protection cannot open because some Symantec services are stopped. Restart
the Symantec services, and then open Symantec Endpoint Protection.”


Following error appears while starting SEP service from Services.msc (start>run> Services.msc):
“Could not start the Symantec Endpoint Protection service on Local Computer.
Error 1084: This service cannot be started in Safe Mode”


The services necessary to run a scan do not operate in safe mode.  


By default, Symantec Endpoint Protection 12.1 cannot scan in safe mode.  However, the following workaround exists for 12.1 RU1 MP1 and earlier.

Note: Before trying the following steps please take full backup of the registry.

1. Start the system in Safe Mode with Networking.

2. Open a command prompt. 

Click start, click run, type cmd

3. Type the following command to add the SepMasterService to the list of allowed services in safe mode:
REG ADD HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\SafeBoot\Minimal\SepMasterService

4. Type the following command to start the SepMasterService:
net start SepMasterService

5. Browse to the SEP folder from the command line (C:\Program Files (x86)\Symantec\Symantec Endpoint Protection)
6. Type - Doscan /List
7. Type – Doscan /ScanName “ScanName” as shown in step 5.

For a full list of Doscan features, please see the following document:

How to run a scan from a command line using Symantec Endpoint Protection using DoScan.exe

Article URL

Terms of use for this information are found in Legal Notices