Endpoint Protection

Hi all,

I'm facing with a new problem.
In SEP console, some of my clients appear as not up to date and with an old scan date and the others client appear with the new definition and the correct scan date 
When I check these clients locally, the definition is up to date.

The client are sending correctly the logs to the server.  When I run a last scan report all the clients appear in the report with the correct last scan time

I'm running Ver 11.0.6a

Could you help me ???

Thanks
Fabrice

Can you check any duplicate entries are present in SEPM?

Can you please paste the sylink.log from any of these machines? Use the sylink toggle for the same.

https://www-secure.symantec.com/connect/downloads/sylink-toggle

check if the SEPM Is able to process the client information to the DB.

Restart the service of Symantec Endpoint Portection Manager and the Database

There is no duplicate entries in SEPM.

Where can I find the sylink.log ?

Thanks

FYI  : The DB is on a SQL 2008 R2 server.

I think SEPM is able to process this information, because for some clients this information is up to date

Run the sylink toggle,and it will craete a file called sylink.log on the root of C.

I've found some difference between the client up to date in the console and the others.

When go on the troubleshooting tab on the client, the client that are not up to date in the console doesn't have a eraser engine and the definition pattern is empty.

Try by repairing one problematic client from add/remove programs...

Also tell us us are you used any images any time for re-imaging these systems?

I've uninstall/reinstall some defective clients.  I'll see tomorrow if they are correctly updated in the console...

None of these has been re-imaged.

Regards

I have the same problem and the definition date in console is 2009/12/29.

Hi Prachand,

Sorry for the delay...
I'll run this tool on monday and I'll try to upload the log. 

Regards

Problem still not solved.

Clients are shown as not up to date.
Uninstall/reinstall did not solve the issue

It seems to be a reporting problem, scans appear with an old date in the "client" tab but when I run a scan report, it shows the correct scanning time...
Is it possible ?

Regards

Do you have an GPO acting on the Symantec services

No GPO on Symantec services, but only access restrictions by GPO on install folder.

Any idea ?

What i've noticed...
on the correctly updated clients I have an eraser version : 7208961.78 and a definition pattern : 3278850 r2 and on the client who have problems, they don't have an eraser version and a definition pattern.

In client GUI > helpde & support > troubleshoot > versions

First you check this

Edit AV/AS policy and go to miscellaneous--->log handling and assure that you are selected following
New virus definition assigned
virus definition rollback
client running without virus definitions

If not helps try this also
In SEPM go to Clients---><<corresponding group>>--->policies--->client log setting.Select all types of logs...

Check if the system time on the server is the same as the time on the clients.
The best practice to syncronize the clients and server time is to use an NTP. Just define an NTP for them, change the SEPM time (which should be done automaticly anfter defining NTP) and then restart the SEPM server, otherwise the server will show all the clients offline.

I've made the changes you suggested but the problem is still there

The time is well synchronized between clients and servers

No other idea ? for my problem ?

All the clients are up to date but some of them appear as not up to date in the console ...

No solution from symantec support

Let me resume :

Uninstall/reinstall Client => same problem (with cleanswipe or normal uninstall)
Restart SEPM servers => same problem

DB on sql 2008
Servers = 2008 R2
Clients = XP

Clients are updated from AV 10.1.6 to 11.0.6a

I think I'm going to reuse my old scripts to check the virus defs on each computer...

Just for testing disable UAC and firewall in your SEPM server....

There might be issue with corrupted log files. As a workaround try clearing existing log files, wait for a day for clients to send logs to SEPM.

To clear logs

Admin -> Servers -> Local site(right click) -> Edit properties -> Log settings -> Change the Expiry date to 1
Admin -> Servers -> Local site(right click) -> Edit properties ->Database -> Change the Expiry date to 1

The firewall was already turned off and now I have also turned off the UAC...
Now, wait and see...

I've tried, but no luck, always the same problem

Try by upgrading to Ru6MP1.It will be released by tomorrow as per another post.In the release notes there is a fix related to this issue.

Ref:Release Notes for Symantec Endpoint Protection 11.0.x and Symantec Network Access Control 11.0.x

As soon as it'll be available, I'll make the upgrade

Thanks for the information

The problem is still there and no solution provide by symantec support.

Case N° 412-615-123

Version 11.06a

Delete one problematic client in the console,restart smc service in the client and try....

Already done but it doesn't work :(

Repair SEPM from add/remove programs...

Just check those clients firewall is on if ON then port is allowed to communicate with the SEPM server.

I have arround 100PC with windows xp pro sp3

The sepm server is a windows 2003 server

All the clients have green dots and at first for about 2 weeks everything was ok but now i have arroung 50clients with old definitions, it seems that despite they are connected to SEPM server they don't update policy and the definitions. Also if I run a command on clients they don't execute that command.

Please answer quick!

Best Regards,

Dragos Zarnescu

Hi all,

Finally found a solution.

There was a policy who configure bad authorization on Symantec services.

I change to "not configured" (default choice) for each of the symantec services and now it works.

 

Thanks all for your help

Fabrice

Dear Sir,

Can you explain where exactly to change this policy?

Or exactly what have you done to resolve this problem?

 

Best Regards,

Dragos Zarnescu

Dear Sir,

Using rsop.msc I can see all the policies for symantec services...but all of them are set to "not configured"

so it seems that is not the solution for me..

Best Regards,

Dragos Zarnescu