Endpoint Protection

Hi all,

My clients OS are MS Windows Server 2003 R2 SP2, and they are getting the well known error  “The Extend WG Protocol Driver service failed to start due to the following error: The system cannot find the file specified.” caused by SEP when they restart. At least 4 other treads in this forum about it.

SEP installation on the clients is only with Antivirus and Antispyware Protection, and the service Symantec Network Access Control is set to Manual Startup Type and is not started.

SEP clients was upgraded to MR4 MP2 (11.0.4202.75) in August and is getting the error after that upgrade when they restart.

Does enybody know if this is fixed in RU5?
If it's fixed, will an UPGRADE to RU5 fix it or is it necessary to go the "usual Symantec way" through Cleanwipe with several restarts and a new fresh installation?


Thanks in advance
NL

There is no mention of Extend WG Protocol Driver  issue in the Release notes.
However i remember this issue is related to Tamper Protection so you can disable tamper Protection so fix this issue.
The SNAC service remains manual and turned off even if you install full feature set of SEP it will automatically start once you have applied license for SNAC.

Pleae read what I wrote above:
"SEP installation on the clients is only with Antivirus and Antispyware Protection,"

 Yes i know..it doesn't matter what features you select the SNAC service will always be there..even if you remove Antivirus n antispyware n just install core components the SNAC service will still be here..

Tamper Protection is NOT the problem because it's not installed!
Once again: As I wrote above:
"SEP installation on the clients is only with Antivirus and Antispyware Protection,"

The information I gave in the second paragraph about my installation was to inform people who got curious about other treads in this forum about the same problem and checked some of them, cause there you'll find statements about SNAC service.

The reason why I gave this information was to try to avoid answers about things that can't be relevant to my problem and in that way could "hide" my case and make the tread "go wild", but I didn't succeed.

Did you read this thread? https://www-secure.symantec.com/connect/forums/windows-errors-reboot-extend-wg-protocol-driver-also-event-2510-server-service

See the Extend WG Protocol Driver/Service Resolution post.

Hi...


However, we dont have things written in the MR5 Release notes, here are the various solutions for the same....

Verify whether the file exists either by navigating to

For 32-bit computers, the driver is WGX.SYS

For 64-bit computers, the driver is WGX64.SYS

Next, search the registry for references to that driver to see if the file path in the registry matches the actual file path.

If the actual file path differs from the path in the registry, edit the path in the registry to match the actual file path. Note: Always back up your registry prior to making changes.

C:\Program Files\Symantec\Symantec Endpoint Protection\ or C:\WINDOWS\System32\drivers\.
OR

1. Open Device Manager

2. Click View > Show hidden devices

3. Expand Non-Plug and Play Drivers and uninstall the Extend WG Protocol Driver

4. Open a command prompt, and type the following command and hit Enter:

sc delete "wgx"


OR

Check the Forums Thread...

https://forums.symantec.com/syment/board/message?board.id=endpoint_protection11&message.id=18623


OR

Uninstalling the reinstalling the client resolves this issue as well.

 Yes, I've read both thread's mentioned by Cycletech and Mithun Sanghavi, and the conclusion is that it's not fixed in RU5. And I'm afraid it will not be fixed by Symantec. But there are workarounds and one of them is, I'm sorry to say, "the usual Symantec way".