Hey Guys

I have the following issue: we have an environment with different virtualised clients, half of the machines are Windows 7 (64bit) and the other virtual machines are Windows 10 (64 bit). They are in the same group and use the same policies.

But every 5 minutes, the Windows 10-Clients log a connection with the SEPM in the System Protocols and the CPU spikes to about 70% for about 30 seconds and then stops. The Windows 7 Machines are fine. They're running the same version.

What can i do to troubleshoot this issue?

Thanks for your help.

Kind regards

Gabe

Could you please post details of your SEPM server (including operating system & 32/64 bit) and what else are running on it?

Thanks.

Not related but give this a try

Adjusting the Symantec Endpoint Protection early launch anti-malware (ELAM) options

https://support.symantec.com/us/en/article.HOWTO81106.html

It's a Windows 2016 64-Bit Server ander there are no other services running on it.

Thanks. You mention that both Windows 7 and 10 are virtual machines. What platform are they on? (i.e. Vmware, Virtualbox, etc?)

Thanks. Now on Vmware settings, under the Networking, are you using the E1000 or vmxnet network adapter?

It's a customer of mine, so i'll have to check this afternoon. But all machines are using the same Network adapter, so would there be a difference between the Windwos 7 and Windows 10 machines?

Assuming E1000, I believe it's an issue with performance if using newer operating system (we see similiar issue here too). If you can change it to the vmxnet adapter on only one machine (install using Vmware tool), monitor it and see if it resolves the issue.

Okay, thanks, I'll check this afternoon. Otherwise I'll check the debug-logs on the clients itself and will check if there are any other issues.

They're not using E1000, they're using VMXNET3.

Do you may have another suggestion?

Afraid not, the E1000 issue is what we have found on my site and changing it to VMXNET3 resolved the issue for us..

The next step is to run SymDiag on Windows 10 machines, have it to gather the logs and then send it to Support - they will be able to investigate the logs to see if they could spot the CPU spike issue.

https://support.symantec.com/us/en/article.tech170752.html

I hope you will be able to track this down soon.