Endpoint Protection

Hi All,

In my project we are currently using SEP 14.0.2415.0200. For the past 2-3 months we are encountering an issue that was never there before.

A few of the desktops are losing network connectivity after we install SEP in them. The network works fine up until SEP asks for restart (let's call it Re1) after the installation. After the installation the desktop stays on network for a few seconds and then the connectivity drops. We have to physically go the affected desktop and give a restart (let's call it Re2). After just 1 restart the desktop comes back on the network. One common thing i have observed in the affected desktops is this : After the SEP takes Re1 i will login into the the desktop and try to open SEP from start menu and it always gives the error saying symantec services cannot be started (attached the screenshot for that). After Re2 the same installation works like normal. 

The issue is happening to a few desktops (say 2-3 out of 10). There is no recurring pattern here as well. Seems like a completely random thing that can happen to any desktop. We have tried installing symantec by manually logging into the desktop as well as tried installing it using PushDeploymentWizard. Tried taking new packages for SEP Client, still the same issue comes up.

We have not made any changes to the SEP server so i have no clue how this problem popped up. I have looked up this issue but the solutions are for Windows 10. This issue is becoming a nuance for us now because we used to push symantec and leave it to update overnight but now we do not have that peace of mind. I am worried this issue might spread to a point where we have to manually interfere in every SEP installation.

Kindly provide any solutions/inputs on this.

Reboot the box and what is the result?

Also, run SymDiag on an affected client for additional error checking.

Hi Brian,

The problem i face is that once i restart the desktop it starts working normally so it is getting extremely difficult to diagnose the issue. If you could just point me to specific log files to start checking that would be of great help. I will run the SymDiag tool and have a check on it as well. 

This isn't logged somewhere on the Symantec client. You'd need to be able to run SymDiag while re-producing the issue so it can collect all of the logs it needs for support to review.

Additionally, SEP 14.2 just came out and this is listed as a fix:

http://www.symantec.com/docs/INFO5072

Clients intermittently lose network connectivity after reboot

Fix ID: 4170825

Symptoms: Network connectivity fails and the Teefer process quits with exit code 31.

Solution: Updated the root certificate cross-signing for the Teefer file based on Microsoft’s recently changed signing requirements.