Endpoint Protection

Hello.

We use Symantec Endpoint Protection v11.0.6100.645.

Manager Console doesn’t show virus definitions status correctly. When I check the PC, I can see that it received the latest virus definitions.

I checked the ntfs permissions of the C:\Program Files\Symantec\Symantec Endpoint Protection Manager\data folder, it is ok. Eveyone has full access right. (http://www.symantec.com/business/support/index?page=content&id=TECH123272&locale=en_US)

I need your help.

There are several causes. 1. Could be that 1 or some of the clients in SEPM might have a definition date 1/1/1970 by error. Easy way of dong this is, click on the clients tab- If you have too many clients, change the display filter to 1000 and sort by definition date. look for clients without definition date or with 1/1/1970 delete these clients. log off from sepm and login after two minutes. 2. It could be the System account proxy settings on the client that reports wrong definition date. Make sure you have the correct proxy settings in the logged in user account and the System account proxy settings. Follow the below lnk to check the proxy settings http://www.symantec.com/business/support/index?page=content&id=TECH95789&actp=search&viewlocale=en_US&searchid=1291126857551 refer the "Steps to edit the SYSTEM account proxy settings through using a Scheduled Task:" section. Your lucky if you get to access the system account using this method. If this does not help you, you might have to download the pstools from Microsoft. http://technet.microsoft.com/en-us/sysinternals/bb896649.aspx 3. If you have a Domain, There could be a Group policy defined of Symantec Endpoint Protection service startup type, it might be set to 'Automatic'. The desired setting is 'Not Defined' type rsop.msc in run and click ok. Go to Computer > Windows Settings > Security Settings > System Services On the right hand you would find system services. Make sure Startup and Permission is set to Not Defined. If it is not set to not defined, on the right hand you could find the Source GPO name. Change the GPO in AD group policy. Please let me know if either of the solution helpd you or no.

Hello,

Are you using the Symantec Embedded Database or MS SQL for the Symantec Endpoint Protection Manager?

Regards,

James

Hi.

First of all  I want to thank to you.

This problem belongs to our customer, I wanted a pc for the test and they supplied a PC today.

1. There are a lot of PCs without definitions on Management Console. But I hesitate to delete these PCs. Can they be visible again If I delete these PCs from management console? I have to be sure.

2. I didn't see any problem related system account proxy.

3.  I checked the group policy applied. Symantec Endpoint Protection service set as automatic. I'm going to offer to change this setting but I think we should try "1" first.

 

They are using Symantec Embedded Database.

 

Thanks again.

delete the client from the console and update the policy on the client

Ok.

I already tested, deleted pc became visible after the "smc -stop" and "smc -start" .

I'm going to delete all PCs without definitions.

I tried to delete all PCs without definitions but I couldn't. Deleted PCs come again rapidly.

you can use taskkill /s system name /f  /im "smc.exe"

I'm going to try.

I discovered new problem. I installed SEP to remote pc via management console. It installed succesfully but It can't updates itself. Client can reach server's 8014 and when I run netstat on command prompt I can see that connection was established. I checked SyLink.xml. Everything seems ok.

I confused.

Hi Kadir,

 

In the third point in the above post you mentioned that the Symantec service is set to 'Automatic'. The service should be set to 'Not Defined'. Change the corresponding AD Security policy to 'Not Defined'. Once the AD Security policy is changed, update the AD Security policy on the client or just restart the client. This should fix the issue.

 

Just to cross check yourself, you would notice that this issue would be for all the clients which have the Group Policy. If a client reports correct information to the manager, it might not have the Group policy.

 

--Vikas
Please remember to mark the post which resolved your issue as the solution!