Endpoint Protection

After creating an installation package for clients (Windows XP) as per instructions given in

 

Check the client and server communication ports.

follow these link's... You will get more info...

http://service1.symantec.com/SUPPORT/ent-security.nsf/docid/2008091215040048

https://www-secure.symantec.com/connect/articles/how-capture-sep-sepm-communication-logs-sylinkmonitor-mr3-onwards-troubleshooting-communica

https://www-secure.symantec.com/connect/forums/troubleshooting-how-articles-created-technical-support-trusted-advisors-and-others-you

Try these option's given in above links.. u will find out the cause..

Thanks aravind1984 and shp for your guidance. After creating an exception for port 8014, the green button on the clients appeared. However, the clients are not showing the same in the Symantec Manager Console.

seems like you are not checkign in the right group

go to clients , open the sep interface

click on help and support

click on troubleshooting

here you will see the groups

check that particular group in the manager u wil find the clients with green dot


if not , then click on servers options click on domain options check if you have single domain or multiple
if multiple you need to administer that domain and click on clients tab and u wil find the clients.

Can u give more details about ur problem....

Hi shp. after adding the exception for port 8014 on the server firewal, the green button in the systray icon of SEP in the clients came up. However, as per your link http://service1.symantec.com/SUPPORT/ent-security.nsf/docid/2008091215040048, the second icon in Table 2-3 is seen against all the clients rather then the first one in the Manager Console. The link http://<management server IP address>/reporting/index.php and http://<management server name>:9090 are not working. I am inserting the snap shots of the Manager for both the default group and the server group showing the icons.

Thanks for your patient hearing.

For me it looks like u have added computer accounts.

once the installation is done the client will show up here with green dot and logged on client
make sure that you have installed the software
and port 8014 is open on clients and servers

Check this link for list of ports used by SEP...

http://service1.symantec.com/SUPPORT/ent-security.nsf/docid/2007090614430148

Try to replace sylink.xml file and see whether clients wil communicate or not...

sylinkdrop.exe located on CD2 under "Tools\NoSupport\SylinkDrop\"





 

Since pc in server group showing green icon server side its working properly..

check this from client side...
http://<Server IP>:8014/secars/secars.dll?hello,secars

U should get a OK response... If this comes client should communicate...

Create a new sylink.xml file and update it in one client and see....

 

There are lot of disscussion on the same tocpic in the site... 
u can seach and find out more about communication issue...

Thanks for the links. http://<server ip>/secars/secars.dll?hello,secars is giving ok from the client. There is communication between the client and the server but the SEP Manager Console is not showing the green button on the client computer icon as it is showing on the server computer icon as can be seen from the snapshots enclosed in the earlier post. If it is ok then fine otherwise I may be missing out on some thing.

Delet the client from the manager
right click the client and delete it
on the client
follow this
go to start - run
type smc -stop
now type smc -start

wait for a min
open the client interface
click on help and support
click on troubleshooting
check the group, even in the manager u should have the green dot.:)

Hi Rafeeq,

Followed your instructions but nothing comes up on the Manager Consiole..

You still have green dot on the clients?

click on admin tab in the manger
click on domain

do u see 2 domains or just the default one?

Go to E:\Program Files\Symantec\Symantec Endpoint Protection Manager\data\outbox\agent

open the number folder ,u will see 2 coz u have 2 groups
find the sylink.xml file
go to clients
start - run
type smc-stop
go to c: \program files \symantec \symantec endponint
paste the sylink.xml file
it will ask do u want to replace, click yest

start  - run
smc -start

click if green dot is there

now you should find the clinet inside the manager, with green dot,chekck both the groups..

should be here now

U can use the method said by Rafeeq or u can use sylinkdroper..

Did u try replacing the sylink.xml file..?

hi
try to add smc.exe and rtvscan.exe to firewall exceptions on client computer

also tell me if firewall is enabled on server where SEPM is installed

Hi Rafeeq, thanks for the detailed post. I see three folders and not two and each contains the sylink.xml file. All the folders have the same date and time stamp. So which sylink.xml file needs to be copied and pasted on the clients.

As there are three folders, do you suggest that I uninstall the SEP clients from the client computer; recreate a new client install package and then push it?

Thanks for your patience,

Click on clients tab in SEPM
click on default group

on the right hand side u have 4 tabs
clients , policies, detaisl install  packages
click on details tab
note down the first 4 numbers of policy serial number

now go to E:\Program Files\Symantec\Symantec Endpoint Protection Manager\data\outbox\agent
look for the folder starting with first 4 numbers you noted down above
open the folder
take the sylink.xml fine
replace as mentioned above
you should have the green dot now

Hi Rafeeq,

Followed your advice but there is no change. The interesting fact is that the client and the SEPM show different poicy numbers.

Before going further, how many domains do u have
admin
servers
domains?

just one ? or multiple

you have the green dot on clients right?

I have the same problem , added question if the windows firewall is disable in the workstation it mean it allow all traffic from the network right? then Why SEP client cannot communicate in the SEPM server even though we are using the right sylink.xml, I tried to reinstall the SEP client but it wont help is it the same, before the sep client is communicating in SEPM lately we found out the communication has been lost, any idea why it is happening?

Peter there are lot of reasons for client not communicating with the manager

check the secars test

on the client try this
http://sepm server ip: 8014 ( port)/secars/secars?hello,secars


ex

http://srv09:8114/secars/secars?hello,secars

it should return OK

hi Peterpan,
do you have syncronization with AD?

Hi Rafeeq,

I have only one domain residing on my SBS 2008 with 5 client nodes running Windows XP. The client nodes started showing the green dot after I added an exception of port 8014 on the Server Firewall. However the clients are not showing up on the SEPM as you can make out on the screen shots provided earlier.

If you approve then kindly let me know how to remove the policies so that I can take the following steps:
1. Remove the created policies
2. Remove the client installations from the client nodes
3. Recreate client packages
4. Push them to the clients.

I dont have an AD synchronization

Rafeeq

The client is communicating before with no problem but suddenly we found out that the communcation is lost, I am confused why was happened? I am using MR4 MP2 version, Even I resintall the SEP it is the same problem, on the other workstation behind the SEP having no problem, some kind of a weird scenario, I disable the Firewall but it wont help. the PC who are encountering this issue have increase in to two workstation I just worrying I might encounter this in our environment

By domain ,i mentioned in the SEPM
going to admin tab
below u find option of Domain
do u have just default :??

not sure , why we are getting this
if you agree, then we can remove
SEPM.. Uninstall / reinstall.

replace the sylink file after that to all the 5 clients it should work fine.

===========

try to disable firewall on server (temporary)
if it will work - you need to open more ports

You mean uninstall SEPM or create a new client install package and push it after unistalling the client SEP from the clients.

Unistall SEPM

Install SEPM

Disable firewall on SERver 2008 or create port excetpion for 8014

Click on clients tab in SEPM
click on default group

on the right hand side u have 4 tabs
clients , policies, detaisl install  packages
click on details tab
note down the first 4 numbers of policy serial number

now go to E:\Program Files\Symantec\Symantec Endpoint Protection Manager\data\outbox\agent
look for the folder starting with first 4 numbers you noted down above
open the folder
take the sylink.xml fine
replace as mentioned above ( by stopping smc -stop ) 
you should have the green dot now

You said that the clients have green dot but the SEPM is not showing them with Green dot.

When you try to make any policy changes on the SEPM or issue any command from the SEPM will that changes or commands reflects on the client side?

Thanks Rafeeq for all the guidance. Uninstalling SEPM was a problem as the security settings for one file had to be changed to uninstall it. Thereafter everything was a smooth process.

This has left me wondiering what went wrong initially. Even after all the help provided it did not resolve till the programme had to be uninstalled and then re-installed.

I am marking it as a solution.