Endpoint Protection

Hi all, I updated my SEPM to RU6A and noticed that any new clients that I add are not showing up in the SEPM.  The clients themselves are showing that the virus definitions are out of date.  I click on the Fix button and they never update.  I was originally thinking that this was some sort of IIS permissions issue, but when I go to http://servername/secars/secars.dll?hello,secars I am getting an OK.  I also went through and moved all of my clients to the default group, deleted the old install points, deleted the group that the clients were in and went through the migration manager to recreate the group and install points so the manager now has the newest install by default to no avail.  (I moved all of my clients back to the correct group.)  Does anybody have any suggestions on how to fix this?  The clients that were already clients before the upgrade still show as connected and are receiving the correct definitions.  Thanks in advance for your help!

I also went through to reset the settings with the manager as mentioned in the following article and am still having the same problem:

http://service1.symantec.com/support/ent-security.nsf/docid/2009042408004148

@ brownru,

The file called "sylink.xml" (in the SEP install directory - program files\symantec\...) contains the communication settings for the SEP client to the SEPM.

Give this a try:
There is a small application called "SylinkDrop" found in the install zip under Tools>No Support>SylinkDrop, copy the sylink.xml file from a working client and use SylinkDrop to "install" the working Sylink.xml to a non-working client. See if the non-working client can communicate with the SEPM.

If this works, there is a tool called "SylinkReplacer" that can replace all the sylink files in a subnet, very useful:
https://www-secure.symantec.com/connect/downloads/sylinkreplacer-tool-connecting-sep-clients-sepm

Hope that helps.

Mike

Thank you for the suggestion Mike.  I tried this and it did not work.  When I go to "Troubleshooting" on the client, it still says the server is offline.  I can give you another little nugget of information that I didn't think to include previously, one of the clients that this is happening on is the SEP server itself.  So, the server that SEPM is installed on, the SEP client cannot communicate with the SEPM! 

Do you see a process for SescLU.exe in task manager? Try closing that process on one of the non-working clients and see if communication begins. I found a thread that said that might help.

Mike

No, SescLU.exe is not running.  Another thought I had was it was a certificate issue.  I was receiving some crypt32 errors that I tracked down to being due to update root certificates being installed.  This is very strange.  Everything was working before I upgraded to RU6A!

I figured this out.  I was right in the first post; it was an IIS permissions issue.  Somehow, the service account we had set up for SEP was not in the IIS permissions.  I added the account and password and it worked.  Thought I would post this for anybody else that is having this issue.