Endpoint Protection

After testing for about a month I start rolling out 14.. First day start getting calls from users. They can't click on anything or type anything.

 

It's like something is moving focus to the desktop from the active window like a tick-tock-clock. Ever 1 sec the red X to close a window blicks and your mouse and keyboard loose focus. 

You have to move QUCK to make it to add/remove programs to uninstall. 

 

Call support.. they play the usual game of never hearing anything about this.. I'm the onlyone in the world.. Then he decideds my issue is the same as this one. But I'm having ZERO of those problems. So I add the execptions. At this point we've uninstalled SEP on all machines having the issue or downgraded to 12. So there is nothing to test. I try upgrading some machines to 14 but they don't show the problem with or without the scan exception. 

So I add the upgrade back. Couple hours later I get a call from the filed and a rep is having the same issue. 

 

Call support again.. and this time another guy has some idea there is some kind of problem with the driver but only level 2 support in the crystal tower are allowed to talk to customers about it.I ask him what in the he%$(* my guy is supposed to do for the next 24 hours while level 2 gets back with me? The long and short is it sucks to be him I guess.

 

So I uninstall SEP.. now when the call comes form the crystal tower they'll act like I'm a unique unicorne and they've never heard of this.. they will want a 2nd set of logs to go allong with the first set of logs.. because.. why not.. and be cause I can't reproduce the issue and I haven't infected any more of my users with the SEP 14 virus they will be so sorry they can't help me and ask I call back when it happens again.. 

Seems like it's only showing up on my Win 8.1 users. No 10 or 7 users have had an issue.

 

 

This has been a public service announcement. 

Was a determination ever made as to what component in 14 may be causing this?

No only the level 2 guys are able to speak of such things I was told. Waiting for callback.. I'm sure it'll be at like 2am or when I'm in the bathroom.. 

Seems like the same issue as described in this link: https://support.symantec.com/en_US/article.TECH236488.html I've seen this in several environments. Exclude as described Torb

Level 2 still has not contacted me and just now at 9:29am 12/23 did support email me saying there was a "new" tech doc about this. They linked me to https://support.symantec.com/en_US/article.TECH236488.html

I'm not going to be pushing the upgrades the day before the Xmas holiday so I guess we'll try again after the new year. 

Level 1 finally admits they know something about this but they can't tell me anything about it! Level 2 has to wisper in my ear or something.. But then they pull a tech doc published on the 16th out of thin air.. 

Two calls to support never mentioned this tech doc. It's not a "monitor" problem it's a window focus problem. A google search and a search of Symante support for "SEP 14 monitor keyboard" "SEP 14 window focus" and other words returns nothing. 

But the the facts, level of support, and quality of product described are sadly true. 

It's hard to be so upbeat after all the years of pain Puredisk, Netbackup, Backup Exec, and SEP have caused me. 

Bartman. The description in the KB i gave might be a bit misleading. There is an incompatibility with Intel Thermal drivers. The symptoms I've seen are just as you describe. Excluding the file fixed the issue. At least check the affected machines if they have the file mentioned in the article.

I do believe you are correct Torb and truly, thanks for the help! My rant is about Symantecs bad support.

It's ironic. Support first linked me to a totally unrelated tech doc. When I told them the description had zero to do with the issue I was seeing they said the same thing.. "sometimes the description is misleading". Ok my point is even further driven home about Symantes awful support. If they can't even fill out the tech documents with correct information what's the point of even posting them? 

No problem. I've had a few rounds with support through the years myself. :) Pro tip:. If support is going nowhere, tell them you want to change support technician and if they refuse ask for the manager. Just remember to be polite and patient.

 

The Below article seems to be a workaround for this issue and subsribe to the article for Further update,

https://support.symantec.com/en_US/article.TECH236488.html

 

 

 

SEP 14 MP1 is out:

Symantec™ Endpoint Protection 14 MP1 Release Notes

New fixes and component versions in Endpoint Protection 14 MP1