Ghost Solution Suite

Symantec Ghost Solution Suite (GSS)and Symantec Endpoint Protection Manager (SEPM) share SYBASE ports for their database functions. For SEPM, these ports can be changed upon installation; for GSS, these ports are hard-coded and cannot be changed. Typically, for both applications to run on a single machine, Ghost Solution Suite must be installed prior to SEPM. The latest update for Ghost brings it to Ghost Solution Suite 2.5.1 (Ghost version 11.5.1.2266). This update is very comprehensive and the update process first removes portions of Ghost and effectively reinstalls them. We are seeing that when this happens, SEPM may be claiming these common ports and the installation then fails as if SEPM were installed prior to Ghost.

NOTE: This DOES NOT impair the antivirus functionality on the server; the only portion impacted is the SYBASE database which governs the management of clients. The machine will not be more susceptible to threats as a result of this.

The solution for this is to manually backup the Ghost Database, uninstall Ghost, configure the SEPM ports manually and reinstall Ghost. Here are the instructions necessary for this:

1. Follow these steps to manually backup the Ghost Console database:
   1. Run the command

      ngserver -export 
      

      
      and export the registry key:
      

      HKLM\Software\Symantec\Ghost\NGserver.
      

2. Uninstall Ghost via Add/Remove Programs.
3. Configure the Symantec Endpoint Protection Manager to use a different port:
   

   Title: 'How to configure the Symantec Endpoint Protection Manager to run with a custom HTTP port'
   Document ID: 2007111212591048
   Web URL: http://service1.symantec.com/SUPPORT/ent-security.nsf/docid/2007111212591048?Open&seg=ent

4. Reinstall Ghost. In most cases, the update will leave a file called update.exe in the C:\Program Files\Symantec\Ghost folder. You can perform a full install from that file alone.
5. Restore the Ghost Console database according to these steps:
   1. Stop the "ngtray.exe" process in the Task Manager.
   2. Click Start > Run and type: c:\program files\symantec\ghost\ngserver -stop
   3. Click Start > Run and type: c:\program files\symantec\ghost\ngserver -uninstall
   4. Import the registry key from step 1b above by double-clicking it.
   5. Restore the symantecghost.db to the c:\program files\symantec\ghost\db folder
   6. Restore the pubkey.crt (NOT the privkey.crt) to the c:\program files\symantec\ghost folder
   7. Click Start > Run and type: c:\program files\symantec\ghost\ngserver -install
   8. Restart the Ghost server.

This will restore functionality to both components.

1. Back up the following files:
   

   C:\Program Files\Symantec\Ghost\db\SymantecGhost.db
   C:\Program Files\Symantec\Ghost\Pubkey.crt
   C:\Program Files\Symantec\Ghost\Privkey.crt