Endpoint Protection

I have installed Symantec Endpoint Protection v11.0.5 on a Windows 2003 Standard SP2 server. The Symantec Endpoint Protection Manager service will not start. When I try to start the service it will stop after a while and give an Event ID 4096 with the error 'The Java Virtual Machine has exited with a code of -1, the service is being stopped.' in the event viewer. I have went through all the steps listed in the link below:

http://service1.symantec.com/support/ent-security.nsf/854fa02b4f5013678825731a007d06af/86368136366e1ad78025734e004734d9?OpenDocument\

But the problem still occurs with the same error. I have tried several times uninstalling and reinstalling Symantec Endpoint Protection Manager. Still getting the same results. Attached are the catalina.out and scm-server-0.log log files. Also this is an issue regarding this specific version of SEPM. We were having the same problems with the two earlier version of SEPM.

 Is this system a 64 bit system ? if yes then follow this doc:http://service1.symantec.com/support/ent-security.nsf/854fa02b4f5013678825731a007d06af/387a93f58eb98c39882573ed007b50f3?OpenDocument

Title: 'Java -1 Errors and HTTP 500 errors when connecting to the Symantec Endpoint Protection Manager'
Document ID: 2009081309264148
> Web URL: http://service1.symantec.com/support/ent-security.nsf/docid/2009081309264148?Open&seg=ent

 Hi First thing is this server 32 bit or 64 bit ?

If 32 bit you may try repairing the manager from Add / remove program. if you still face the same then follow the steps below. 

Thank you for your reply. The server is 32 bit. I have done the repair install several times with no luck. I just finished following the steps you provided and I still receive the same error when trying to log in and I get the same even id in event viewer.

 Re-install IIS then do a repair of SEPM from add/remove programs.

I have done this but still no luck. Getting same errors.

On the SEPM folder add Everyone , Autenticated User  and give them full permsion

is your SEPM is a fresh install or an upgrade version? how many clients are currently reporting to this SEPM?

The Secars.dll is throwing an error. You can't tell much about it from the scm-server-0.log file, but you may be able to find more information by enabling Secars debug log files.

1. Run Regedit.exe
2. Browse to HKEY_LOCAL_MACHINE\SOFTWARE\Symantec\Symantec Endpoint Protection\SPC
3. Edit the item labeled "DebugLevel", set the value to 4
4. Restart IIS
5. Start SEPM
6. View the Secars log file which is located at: C:\Program Files\Symantec\Symantec Endpoint Protection Manager\data\inbox\log\exsecars.log

I doubt this single post will solve your problem, but hopefully this will get us close to the root cause.

By the way, thanks for posting the scm-server-0.log file in your first post!

It's a fresh install and we have only 20 clients.

I have done this and stil get the same error.

I got to step 2 and did not see SPC under Symantec Endpoint Protection. The only subkeys under there are LiveUpdate and SEPM. In the SEPM subkey I do see the DebugLevel. So I went ahead and set that value to 4. Under C:\Program Files\Symantec\Symantec Endpoint Protection Manager\data\inbox\log\ I couldn't find exsecars.log but there was a log file called ersecreg.log that was just created. So I will attach that for your review, not sure how helpful it will be to you.

!!!!Contents of ersecreg.log!!!!

10/14 13:29:03 [4420:1384] secreg initailized. Kcs=F71C628E893AE53F2416834B3F3B1C37

10/14 13:29:03 [4420:1384] 4 Bad format.

10/14 13:29:03 [4420:1384] 192.168.1.57--FAILED

10/14 13:29:04 [4420:1384] 4 Bad format.

10/14 13:29:04 [4420:1384] 192.168.1.57--FAILED

10/15 07:50:50 [3848:3880] secreg initailized. Kcs=F71C628E893AE53F2416834B3F3B1C37

10/15 07:50:50 [3848:3880] 4 Bad format.

10/15 07:50:50 [3848:3880] 192.168.1.62--FAILED

10/15 07:50:51 [3848:3884] 4 Bad format.

10/15 07:50:51 [3848:3884] 192.168.1.62--FAILED

10/15 07:54:49 [3848:3892] 4 Bad format.

10/15 07:54:49 [3848:3892] 192.168.1.67--FAILED

10/15 07:54:50 [3848:3884] 4 Bad format.

10/15 07:54:50 [3848:3884] 192.168.1.67--FAILED

10/15 08:07:34 [3848:3880] 4 Bad format.

10/15 08:07:34 [3848:3880] 192.168.1.59--FAILED

10/15 08:07:35 [3848:3880] 4 Bad format.

10/15 08:07:35 [3848:3880] 192.168.1.59--FAILED

10/15 08:19:03 [3848:3888] 4 Bad format.

10/15 08:19:03 [3848:3888] 192.168.1.51--FAILED

10/15 08:19:05 [3848:3888] 4 Bad format.

10/15 08:19:05 [3848:3888] 192.168.1.51--FAILED

10/15 08:29:09 [3848:3888] 4 Bad format.

10/15 08:29:09 [3848:3888] 192.168.1.60--FAILED

10/15 08:29:10 [3848:3888] 4 Bad format.

10/15 08:29:10 [3848:3888] 192.168.1.60--FAILED

10/15 08:29:35 [3848:3888] 4 Bad format.

10/15 08:29:35 [3848:3888] 192.168.1.57--FAILED

10/15 08:29:36 [3848:3888] 4 Bad format.

10/15 08:29:36 [3848:3888] 192.168.1.57--FAILED

10/15 08:32:01 [3848:3880] 4 Bad format.

10/15 08:32:01 [3848:3880] 192.168.1.74--FAILED

10/15 08:32:02 [3848:3880] 4 Bad format.

10/15 08:32:02 [3848:3880] 192.168.1.74--FAILED

10/15 08:34:18 [3848:3880] 4 Bad format.

10/15 08:34:18 [3848:3880] 192.168.1.50--FAILED

10/15 08:34:19 [3848:3888] 4 Bad format.

10/15 08:34:19 [3848:3888] 192.168.1.50--FAILED

10/15 08:44:12 [3848:3880] 4 Bad format.

10/15 08:44:12 [3848:3880] 192.168.1.63--FAILED

10/15 08:44:12 [3848:3880] 4 Bad format.

10/15 08:44:12 [3848:3880] 192.168.1.63--FAILED

10/15 08:49:21 [2728:4168] secreg initailized. Kcs=F71C628E893AE53F2416834B3F3B1C37

10/15 08:49:21 [2728:4168] 4 Bad format.

10/15 08:49:21 [2728:4168] 192.168.1.74--FAILED

10/15 08:49:22 [2728:4168] 4 Bad format.

10/15 08:49:22 [2728:4168] 192.168.1.74--FAILED

 

What version of Java RTE should I have installed?

You can check the same from add remove program or

You can check the same from C:\Program Files\Symantec\Symantec Endpoint Protection Manager\tomcat\webapps\scm\clientpkg

Thanks for the reply. But I know that I have version 6 update 16. I just wasn't sure if there were any issues with that version.

You got the right registry key, I accidently posted the one for SBE - but you did the steps correctly.
If there is no exSecars.log file (only erSecReg logs) then Secars compontent must not be starting -- which I would interperate to be an IIS related issue.
First, IIS is suppose to start with Secars and SecReg. After both of these are running only then is the Symantec Endpoint Protection Manager suppose to start. So if Secars is not leaving any log files, then perhaps it is not starting. So the root problem is not, "I can't start the manager", the root problem would be, "Secars won't start".
2 suggestions.

1) Look at the IIS log file for errors. You should see a 500 error for secars.dll?action=34. Sometimes the IIS log will have an extra digit such as a 500.3 error. You can use than number to search the Microsoft Support site for clues.
2) I suggest running the Symantec Support tool. It tests your system for common IIS related issues and if a known issue is found it will point you to a related KB article for that issue. You can find information about the support tool at this location:
http://service1.symantec.com/support/ent-security.nsf/854fa02b4f5013678825731a007d06af/e0c11a9f4dfd72458825751900667e70?OpenDocument

I've been using that version with RU5 without difficulties.  Others on the forum have reported success as well.  If I recall correctly, the release notes mention Java 6 Update 14.

Thanks for your suggestions. But where exactly can I find the IIS logs? Also I tried running the Symantec Support tool, but I don't think it worked. I think it gave me some false info.

you can find the IIS logs here
for every website you have in IIS
you will have a folder here.
C:\WINDOWS\system32\LogFiles

a) uninstall IIS (safe or normal mode)
> b) Remove files and folders
> %windir%/system32/inetsvr/
> /inetpub/
> %windir%/iisx.log (x=5 for w2k, 6 for XP, Win03)
> (use safe mode to delete)
> c) reboot, reinstall IIS, repatch machines

Do a repair of SEPM from ADD/remove programs will put back the virutual directories, try to log in now, should work fine.

SEPM generates an amazing amount of IIS logs, so they are disabled by default.
You can re-enabled them in your IIS manager.
Open up your IIS manager (Which is inside Administrative ToolS), open "Web Sites" (The plus sign) --> open the Symantec Site.
Right click on  on the "secars" virtual Directory and select Properties
Under the "Web Site" tab, select "Enabled logging".
Click the Properties... button next to logging option.
Note the directory and "Log file name:"
You may have to restart IIS to enable logs, I'm not sure.

Then try to start SEPM and then can look for the log file.
 
If you add/remove SEPM:
Be sure you review the disaster recovery plan BEFORE you uninstall SEPM -- other wise your clients may get disconnected.

I'm having a hard time following your directions. I have IIS v6.0 installed. I don't see a "Web Site" tab or "Enabled
Logging" with a Properties button.

I think he was mentioning this.

http://www.microsoft.com/technet/prodtechnol/WindowsServer2003/Library/IIS/d29207e8-5274-4f4b-9a00-9433b73252d6.mspx?mfr=true

To enable logging for a specific virtual directory on a site

1.	In IIS Manager, expand the local computer, expand the Web Sites directory, right-click the virtual directory, and click Properties.
2.	On the Virtual Directory or Directory tab, select the Log visits check box if it is not selected. By default, the check box is selected.
3.	Click Apply, and then click OK.

Heres a picture (since I'm near a server today)

This is slightly different from the instructions I layed out ealier. But in any case, you have to enable that "Log Visits" option. Other wise Secars traffic is not logged in the IIS log file.

Note, this picture shows me enabling the Secars IIS logs, but you probably want to enable the SecReg IIS logs using the same method, just right click on SecReg instead of Secars

I was able to follow your steps last night. Still unable to start the SEPM service.

Here is the log I find for secar

#Software: Microsoft Internet Information Services 6.0
#Version: 1.0
#Date: 2009-10-22 13:17:28
#Fields: date time s-sitename s-ip cs-method cs-uri-stem cs-uri-query s-port cs-username c-ip cs(User-Agent) sc-status sc-substatus sc-win32-status
2009-10-22 13:17:28 W3SVC2 127.0.0.1 GET /secars/secars.dll action=34 8014 - 127.0.0.1 Java/1.6.0_14 500 0 126
2009-10-22 13:17:28 W3SVC2 192.168.1.250 GET /secars/secars.dll action=34 8014 - 192.168.1.250 Java/1.6.0_14 500 0 126
2009-10-22 13:17:28 W3SVC2 127.0.0.1 GET /secars/secars.dll action=34 8014 - 127.0.0.1 Java/1.6.0_14 500 0 126
2009-10-22 13:19:21 W3SVC2 192.168.1.250 GET /secars/secars.dll h=75AF65FB7581C0C8DDA3A0039998E6B59190D94A6C0D054F1C45DCA89138A80CA8170636522C653D8E7AAAA2B6973425205143BB0E0E94C101ED5E268F0F79A5791D98A75F936B4F17E0F016A82B4DFE65285BA1B5575025F2443BBA0372379CD9FF7D25EEEFCF7373DC642E4CD9A119A21BD46DC8C97A75811360101A83DFE9A2B16C94CF5FF9307CBE5D253166DFFBD8F3357287DFB4AD00EA24C01024BE0ADE1AFB91B065DB68BECE4B0F37DEE8124BC509744D1272E60A35EDB6233E14AC71E2801CEC48F87CCE7D7686ABA83C9DD426F4CF9B3DB7FB35CA4FF355232190F5F8002141CE7B80D8B7B3CDA3092D88FA4EEC92432486C04D72D268196B247267CF89E64CAE442C6702440624CD5A7D90ECF8863C14FD33BC812DF1AE1F9825AF7A7104D87DCE503FA290E6E13F1E86502D854B2F23A4AF660CE4E5264909A74E8C527F3DB1DE17789216D382BA332C5DD60EE0CF3B3DB82A1CFC93E4F4ADE0 8014 - 192.168.1.56 Smc 500 0 126
2009-10-22 13:19:21 W3SVC2 192.168.1.250 GET /secars/secars.dll h=75AF65FB7581C0C8DDA3A0039998E6B59190D94A6C0D054F1C45DCA89138A80CA8170636522C653D8E7AAAA2B6973425205143BB0E0E94C101ED5E268F0F79A5791D98A75F936B4F17E0F016A82B4DFE65285BA1B5575025F2443BBA0372379CD9FF7D25EEEFCF7373DC642E4CD9A119A21BD46DC8C97A75811360101A83DFE9A2B16C94CF5FF9307CBE5D253166DFFBD8F3357287DFB4AD00EA24C01024BE0ADE1AFB91B065DB68BECE4B0F37DEE8124BC509744D1272E60A35EDB6233E14AC71E2801CEC48F87CCE7D7686ABA83C9DD426F4CF9B3DB7FB35CA4FF355232190F5F8002141CE7B80D8B7B3CDA3092D88FA4EEC92432486C04D72D268196B247267CF89E64CAE442C6702440624CD5A7D90ECF8863C14FD33BC812DF1AE1F9825AF7A7104D87DCE503FA290E6E13F1E8618C4372B304277616C497E69623030754E8C527F3DB1DE17789216D382BA332C5DD60EE0CF3B3DB82A1CFC93E4F4ADE0 8014 - 192.168.1.56 Smc 500 0 126

I seriously dont know what we are lookign for here, I would be happy to know the resolution.

secars as fas as I know associated with smc.exe which communicates with SEPM via IIS
rememeber we type
http://localhost/secars/hello?,secars to check client communication with IIS

Eager to know the resolution :)

Good question. The thread has gone so long it's easy to lose site of what's going on.
So here's a recap.

1. The very first post shows that SEPM get's a 500 Error code from IIS whenever it tries to talk to Secars.
2. There is no Secars log, and activating the Debug Logging does not create one.
3. The SecReg command throws errors whenever a client connects.
4. The IIS logs show sc-status 500 with a sc-substatus of 0 whenever the server any one tries to talk to Secars
5. Derrick tried to run the Support Tool but said it didn't help (Not what happened here)
6. Derrick been shown Symantec KB on Java -1, Was there confirmation that the article steps were tried?

So, for the moment, the real issue is the SEPM to Secars communication, until that works, nothing will work.
It is not for IIS to cause problems, such as permission problems when SEPM tries to talk to Secars.

The fact that there is no Secars.dll log seems to indicate that Secars may not even be starting -- once again, this points to an issue inside IIS.
The fact that the SecReg module is throwing errors when clients could be a clue, but it's not the root issue. SecReg will not work correctly until SEPM can startup.
The final piece of evidence we have now is the IIS logs. We know the main error is #500, but the IIS logs include a substatus code that can reveal root causes, such as permission or other configuration issues. You can use the subcode to help find the issue on Microsoft support. As it is the only subcode 0 error I could find was: http://support.microsoft.com/kb/936476

So what's next? I'm not sure, I'm running out of ideas here :) It's tough without a WebEx (Which is what our Support team can do).
It almost sounds to me like the Secars.dll file may not be physically on the box... did it get deleted or moved somehow? It should be locate under %SEPM Install Dir%\bin\secars.dll, and the file size (for RU5) is 750,960 bytes.
The fact that there is no Secars log at all is what really interest/concerns me. The problem is related to IIS and Secars, but Secars has no log -- at all. Secars always creates an "Secars ISAPI Starting" log entry, even if it's not in debug mode. So no log seems to mean that IIS is not configured to load Secars. The KB Article suggested by "Prachand" really matches the symptoms of this issue.

Hi Ghet,

As far as I know smc will show 500 because SEPM service is not running, i'm assuming if you run the sylink watcher on the client it will give you the Same, why are we troubleshooting on the client side?

Ghet has given a very good explanation,

i will be happy to know the resolution, my last suggestion would be this ..:) 

uninstall IIS (safe or normal mode)
> b) Remove files and folders
> %windir%/system32/inetsvr/
> /inetpub/
> %windir%/iisx.log (x=5 for w2k, 6 for XP, Win03)
> (use safe mode to delete)
> c) reboot, reinstall IIS, repatch machines

I ran through these steps atleast three times now, with no luck.

Can you put your admin account and password in IIS directory security tab and try starting the SEPM service....?

open IIS
right click on SEPM website and click on properties
Seclect directory security
click on authentication and access control

put your domain adim id and password,

try starting SEPM service.

You can you iis diag to check problem with permissions here,

http://www.microsoft.com/DownLoads/details.aspx?FamilyID=9bfa49bc-376b-4a54-95aa-73c9156706e7&displaylang=en

Sorry Rafeeq, but can you be more specific? Do I need to put in the admin account for the local server or the admin account I'm using for SEPM? The account it has in now is IUSR_SERVER (would this be the problem?)

I can confirm that Secars.dll is under C:\Program Files\Symantec\Symantec Endpoint Protection Manager\bin
and is 750,960 bytes

Are there any screen shots I could post that would be helpful to you? I really appreciate all the help by the way.

Just put in your domain account id and password ( windows) replace iusr ... lets see what we get

Ok I did this and the SEPM service still fails to start.

Trouble shooting IIS.
Here is a basic KB article that shows you how to check a few of the needed IIS settings. Perhaps one of them is wrong.
http://service1.symantec.com/support/ent-security.nsf/854fa02b4f5013678825731a007d06af/079927f5d03c321a882576030056e654?OpenDocument

Can you confirm that this artcile did not solve your problem?
http://service1.symantec.com/support/ent-security.nsf/854fa02b4f5013678825731a007d06af/e854636255c7e2e4652576110015a7bb?OpenDocument

And I'm a little curious what the Support tool had to say.

Finally, if this is a permissions related problem, it may be possible to detect it using the Process Monitor tool. However, this tool geared towards advanced users and I wouldn't want to lecture on how to collect and analyze the information in a forum.

I did a little testing with moving my Secars.dll file around to see what errors it would produce. After testing it seems to me that the HTTP 500 error has to be generated by either IIS itself, or IIS is just passing the error from Secars.
Since the SubCode is 0, I assume it's being passed from Secars - but there is no exSecars.log file, it's really hard to say what's wrong.
Something you could try is pasting the following URL into your browser, or even telnet:
http://localhost:8014/secars/secars.dll?action=34
The trick with this is that IE has a 'feature' called "Show friendly HTTP error messages' which will hid the actual error comming from the website.
If you use something like FireFox you don't have that issue.
You can also use telnet by typing:
Telnet localhost 8014
Then blindly typing:
get secars/secars.dll?action=34

You should get an error code back... not sure how much it will help you.

This article http://service1.symantec.com/support/ent-security.nsf/854fa02b4f5013678825731a007d06af/e854636255c7e2e4652576110015a7bb?OpenDocument did not help. I will check out the other KB later and let you know how it went.

The support tool gave me a bunch of errors that I knew could not be right.
It says "The Windows Installer services is not present" - But it is present
It says "physical memory is less then the required 256MB" - When there is 2GB installed
   also says "physical memory is less then the required 1GB"
It says "Internet Explorer is not installed." - But it is
It says "The Server service is not installed" - But it is installed and running
It says "The Remote Registry service is not present" - It is and is running
It says "Microsoft's Internet Information Services (IIS) is not installed." - but it is and running
It says "Microsoft's Internet Information Services (IIS) is not installed." - but it is and running

When I try http://localhost:8014/secars/secars.dll?action=34
I get the error "The specified module could not be found. "

There is some really terrible advice going on here.   First of all, adding "Everyone" permissions to the entire SEPM folder is total overkill.  Only the data folder uses "Everyone" permissions.  Second, replacing the anonymous access account because of an http 500 error doesn't make any sense.  If the iusr account was the issue, you would be getting 401 unauthorized errors, not http 500 errors.  HTTP 500 is an internal server error.  Going over your IIS logs and the scm-server log, the most likely cause here is that your conf.properties file is set to use a different IIS port than your IIS website.  scm-server log shows you trying to start the site using port 80.  Your IIS logs show 8014.  Your IIS logs are in W3SVC2, which would indicate a custom website.  A custom website should use 8014 by default.  Right click on the Symantec Web Server, go to properties.  On the web site tab make sure the TCP port says 8014.  Make sure IP address is set to all unassigned.  Under the Directory Security tab > IP name and domain name restictions, make sure you have granted access checked and that you're not blocking your own server.  Next, open the following file with a text editor \Program Files\Symantec\Symantec Endpoint Protection Manager\tomcat\etc\conf.properties.  Make sure you have the following line: scm.iis.http.port=8014.  If that line isn't there, add it.  

Thanks for your reply, Citlai. I went through everything you suggested but everything looked ok.

 It can be the issue with http.sys file.I would suggest contact support as they will be able to have a closer look on your system.
http 500 means it is a server side issue.either its IIS,Database or OS hardening issue.

Support probably would be the best option.  Its difficult to troubleshoot issues without being able to see the whole picture.  However, the scm-server log you initially uploaded does show that conf.properties is using port 80.  If it was using 8014, it would say http://localhost:8014/secars/secars.dll?action=34. 

I don't have a support license with this product. It was bought through a donation program and does not come with support, so I'm out of luck there.

I tested conf.properties with a wrong port number, the log file does not print the port number you're using so the fact that there is no :8014 in the log file does not mean it's not using port 8014.
If the support tool was not able to find so many things, then perhaps there is a problem with the OS, or maybe some basic dependency is missing. Or perhaps you did not run the tool with full permissions.

At this point, unless you have a tech savy friend to look at the system in general, I would run the support tool on another computer until you find one that meets the minimum requirements. Then put SEPM on that system.
If this is a small setup, SEPM can even run on a Windows XP machine -- but it can't support many clients.

All you have to do is set the default website (or any website besides the Symantec Web Server) to use a non-standard port, then change the port on the conf.properties to use that website's port. 

2009-11-01 13:11:58.203 SEVERE: ================== Server Environment ===================
2009-11-01 13:11:58.203 SEVERE: os.name = Windows 2003
2009-11-01 13:11:58.203 SEVERE: os.version = 5.2
2009-11-01 13:11:58.203 SEVERE: os.arch = x86
2009-11-01 13:11:58.203 SEVERE: java.version = 1.6.0_14
2009-11-01 13:11:58.203 SEVERE: java.vendor = Sun Microsystems Inc.
2009-11-01 13:11:58.203 SEVERE: java.vm.name = Java HotSpot(TM) Server VM
2009-11-01 13:11:58.203 SEVERE: java.vm.version = 14.0-b16
2009-11-01 13:11:58.203 SEVERE: java.home = C:\Program Files\Symantec\Symantec Endpoint Protection Manager\jdk\jre
2009-11-01 13:11:58.203 SEVERE: catalina.home = C:\Program Files\Symantec\Symantec Endpoint Protection Manager\tomcat
2009-11-01 13:11:58.203 SEVERE: java.user = null
2009-11-01 13:11:58.203 SEVERE: user.language = en
2009-11-01 13:11:58.203 SEVERE: user.country = US
2009-11-01 13:11:58.203 SEVERE: scm.server.version = 11.0.5002.333
2009-11-01 13:12:00.437 SEVERE: ================== StartClientTransport ===================
2009-11-01 13:12:00.468 SEVERE: Unknown Exception in: com.sygate.scm.server.servlet.StartupServlet
java.lang.Exception: HTTP 404 Not Found, URL: http://localhost:8012/secars/secars.dll?action=34
    at com.sygate.scm.common.communicate.Communicator.getRequestInputStream(Communicator.java:626)
    at com.sygate.scm.server.util.ClientTransportHelper.startClientTransport(ClientTransportHelper.java:147)
    at com.sygate.scm.server.servlet.StartupServlet.init(StartupServlet.java:106)
    at org.apache.catalina.core.StandardWrapper.loadServlet(StandardWrapper.java:880)
    at org.apache.catalina.core.StandardWrapper.load(StandardWrapper.java:768)
    at org.apache.catalina.core.StandardContext.loadOnStartup(StandardContext.java:3484)
    at org.apache.catalina.core.StandardContext.start(StandardContext.java:3710)
    at org.apache.catalina.core.ContainerBase.start(ContainerBase.java:1148)
    at org.apache.catalina.core.StandardHost.start(StandardHost.java:697)
    at org.apache.catalina.core.ContainerBase.start(ContainerBase.java:1148)
    at org.apache.catalina.core.StandardEngine.start(StandardEngine.java:311)
    at org.apache.catalina.core.StandardService.start(StandardService.java:450)
    at org.apache.catalina.core.StandardServer.start(StandardServer.java:2213)
    at org.apache.catalina.startup.Catalina.start(Catalina.java:484)
    at org.apache.catalina.startup.Catalina.execute(Catalina.java:371)
    at org.apache.catalina.startup.Catalina.process(Catalina.java:134)
    at sun.reflect.NativeMethodAccessorImpl.invoke0(Native Method)
    at sun.reflect.NativeMethodAccessorImpl.invoke(NativeMethodAccessorImpl.java:39)
    at sun.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:25)
    at java.lang.reflect.Method.invoke(Method.java:597)
    at org.apache.catalina.startup.Bootstrap.main(Bootstrap.java:151)
com.sygate.scm.common.communicate.CommunicationException: Unexpected server error. ErrorCode: 0x10010000
    at com.sygate.scm.common.communicate.Communicator.getRequestInputStream(Communicator.java:650)
    at com.sygate.scm.server.util.ClientTransportHelper.startClientTransport(ClientTransportHelper.java:147)
    at com.sygate.scm.server.servlet.StartupServlet.init(StartupServlet.java:106)
    at org.apache.catalina.core.StandardWrapper.loadServlet(StandardWrapper.java:880)
    at org.apache.catalina.core.StandardWrapper.load(StandardWrapper.java:768)
    at org.apache.catalina.core.StandardContext.loadOnStartup(StandardContext.java:3484)
    at org.apache.catalina.core.StandardContext.start(StandardContext.java:3710)
    at org.apache.catalina.core.ContainerBase.start(ContainerBase.java:1148)
    at org.apache.catalina.core.StandardHost.start(StandardHost.java:697)
    at org.apache.catalina.core.ContainerBase.start(ContainerBase.java:1148)
    at org.apache.catalina.core.StandardEngine.start(StandardEngine.java:311)
    at org.apache.catalina.core.StandardService.start(StandardService.java:450)
    at org.apache.catalina.core.StandardServer.start(StandardServer.java:2213)
    at org.apache.catalina.startup.Catalina.start(Catalina.java:484)
    at org.apache.catalina.startup.Catalina.execute(Catalina.java:371)
    at org.apache.catalina.startup.Catalina.process(Catalina.java:134)
    at sun.reflect.NativeMethodAccessorImpl.invoke0(Native Method)
    at sun.reflect.NativeMethodAccessorImpl.invoke(NativeMethodAccessorImpl.java:39)
    at sun.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:25)
    at java.lang.reflect.Method.invoke(Method.java:597)
    at org.apache.catalina.startup.Bootstrap.main(Bootstrap.java:151)

When I reinstalled SEPM it most have fixed the port. Becuase it shows in the conf.properties "scm.iis.http.port=8014"

My install went fine and everything worked for 4 months then out of the blue I started having the same exact issues.  I've tried everything mentioned above without any success.

Quick Background:
Win2k3 R2
Standard
SP2
32-bit
Domain Controller

PLEASE HELP!!!!

This may be a fix as it did in my case.

Check to make sure that the Default App Pool in IIS is started.

Cheers.... 

Thanks for the suggestions, shalter. I checked and the Default App Pool is started.

So I finally got around to running a repair install on the server. After doing the repair and installing all windows updates everything seems to be working fine now.

Thats great at last. you got it fixed...Java -1 is such a prob that if 3-4 steps doesn't fix it then it becomes very difficult to fix..