Endpoint Protection

Hello,

I am unable to delete contents of a shared update folder on  a  GUP, even as local admin and after stopping smc.  Any idea? SEP 12

Because they're an integral part, you would need to disable SEP altogether. The files may be in use from clients or SEP has them "locked"

Another quick way to do it is to stop the machine from being a GUP.

Any reason why you need to delete?

Actually turn off the SEP service under services.msc section. Also, you can stop the machine from being a GUP, just remove the policy from it.

Disable as in uninstall?

Withdraw the GUP policy and again try to delete folder.

you cannot with with draw  a LU policy, however, I made this guy a non gup machine, updated the policy and sitll unable to delete

Appears to still be in use. Did the policy take affect?

Otherwise, reboot the machine and try again or do it from safemode

its a production multi purpose server, rebooting is not an option,  yes the policy took in effect

Check to see if any clients are connecting to it and grabbing updates...the clients may still be connected thinking its a GUP until they get a new policy telling them to go somewhere else for updates.

wouldn't smc -stop kill those connections?

Please try below P_K_ Comments

1. Stop Symantec Endpoint Protection Manager Service

2. Stop SMC ( Start => Run => smc -stop )

3. Delete old content in C:\Program Files\Symantec\Symantec Endpoint Protection\Shared Update folder

4. Restart Symantec Endpoint Protection Manager Service

5. Restart SMC ( Start => Run => smc -start )

https://www-secure.symantec.com/connect/forums/sharedupdates

Don't believe so...once the folder becomes unlocked it should be able to be deleted. Verify it's not locked or clients are not connected to it.

You can use process explorer to see if a process has this folder or a file in it locked

James, I have tried that already.

Brian,

I still dig deeper into this with process explorer.

Thanks for your help guys.  I just wanted to understand if this is behavior is normal SEP / GUP behavior.

Yes this is normal SEP / GUP behavior.

Ehhh kinda, depends on the circumstance. Once you remove the GUP policy for it and clients aren't connected and nothing has it locked, the folder should delete..otherwise you run into a problem.

process explorer will tell you what has it locked though