Endpoint Protection

I installed this on a few of our servers and the tray icon is no longer showing.  I also noticed that the user-level ccSvcHst.exe is not starting.  If I try to manually start it, it quickly exists.  LaunchSmcGui is set to 1 and I have tried running repair from Programs and Features.  This is occurring on all servers that have been upgraded while the servers still on12.1.6 MP5 correctly display the icon.

What is the server OS? Has anything recently changed on these boxes such as patching? Or are these in the same configuration as the ones correctly running 12.1.6 MP5? Are you able to reboot one of the servers to see what the result is?

I would suggest getting a case open as they will want to enable advanced logging, most likely.

Client User Interface Control Settings > Customize > Display the notification area icon is also checked.

This is occurring on the servers running Server 2008 R2 and is not occurring on those running Server 2012 R2.  It is also not occurring on Server 2008. 

So, it looks like just 2008 R2 of what have installed it on.

Rebooting doesn't help.  The only other thing that has changed, except SEP, is that the October Windows Updates were installed this weekend.  The SEP update was installed a day or two earlier.

I uninstalled SEP from one of the 2008 R2 servers, rebooted it and then pushed out the package.  The try icon is now showing and ccSvcHst.exe is running for me.

I also had a test Windows 7 box that had no AV installed on it.  I pushed ou a package and the tray icon is showing there.  So, it looks like this is affecting 2008 R2 systems that were upgraded from MP5.

So it could be a bug with the upgrade or something not agreeing with a specific patch. Symantec will need to take a look at this one way or the other.

Have the same problem on my W7 machines.

In the SEPM the policies are ok.

Found out that after installing Microsoft KB 3125574 the tray icon dissapears.

After un-installing this KB the icon comes back again.

The weird part is: when I re-install this KB again, the tray icon stays.

I have not found a solution to this yet but reported it in a case with Symantec.

I happened to find this problem on one of the 2008 R2 servers that is running 12.1.6 MP5.  So I wonder if this came in with the MP5 update or the Windows updates.

But then I have 2 other 2008 R2 servers on 12.1.6 MP5 that do not have the problem.

Hello,

We are on MP6.

At our site the problem did not occur after upgrading from MP5 to MP6 but I can replicate the problem by removing the KB 3125574.

As soon as I remove this update the icon is back again.

Has anyone gotten a case open so Symantec can be made aware?

Yes, I have opened a case with Symantec.

They have no workarround available so I went troubleshooting myself.

Recap:

No problem with SEP 12.1 RU5 and RU6 until I installed microsoft update KB 3125547.

After the install of KB 3125574 the SEP icon in no logner showing on the taskbar.

After Un-installing KB 3125547 the SEP icon is back on the taskbar.

AS KB 3125547 is a security update we need to install it.

So far a workarround is not available so I went looking for a workarround myself:

I found out that, after installing KB 3125547 you can edit the registry to make sure the SEP icon will show on the taskbar.

Registry setting adjustment:

First, make sure you CAN edit the registry as an administrator by changing the Tamper Protection setting in the SEP client:

Start the SEP client.

Goto change Settings – Client Management – choose the tab Tamper Protection – remove the mark at “Protect Symantec security software …”

Go into the registery (regedit) and goto:

HKLM\SOFTWARE\Symantec\Symantec Endpoint Protection\SMC\

Add DWORD registry value: LaunchSmcGui and set it to “1”

Don’t forget to mark the Tamper Protection again.

The SEP icon will be back on the taskbar.

Addition to latest information:

Clearing or marking the Tamper Protection option has influence on the icon showing or not showing on the taskbar.

I have reported this in the open case at symantec.

Hans,

Have you tried removing SEP and then reinstalling it on one of the impacted systems?  This brought back the tray icon for me when I tried it.

Note that on my systems LaunchSmcGui was already set to 1 and the icon was still missing.

I have confirmed on one of my affected systems that if Tramper Protection is off, the tray icon shows.  If it is on, then the icon does not show. 

There seems to be a connection between the MS KB 3125574 and Tamper Protecion.

Even without adding the registry key for LaunchSmcGui I can make sure the icon returns to the taskbar by disabeling Tamper Protection.

Action: disable Tamper protection - Reboot the machine - Icon is back.

Enable Tamper Protection: after reboot the icon is gone.

Created case is still "Under Investigation" at Symantec. No workarround posted by Symantec.

SEP v14 has been released - might be worth giving this a try on the test enviornment?

Has there been any advancement on the case?

I had hopes that installing 12.1.6 MP7 would fix the issue, but it did not. 

And I considered trying v14, but it looks like there are quite a few stability issues.  This is not something I want coming near our systems right now.

It looks like this may be fixed in 12.1.6 MP8.  I deployed MP8 to one of the systems experiencing the problem and the tray icon came back.