Endpoint Protection

HI,

I have a strange one. A PC with Vista 64-bit, SEP 11.0.4202.75.

Seems that about 60% of the time, when in Vista, the PC will boot up fine, but the PC will loose connection to the Internet [network icon with an "X" over it in the system tray]. The NIC has a hardcoded IP address and DNS. THe only way to regain network access is to disable the network portion of SEP temporarily (i.e. Disable Network Threat Protection), disable the NIC, re-enable the NIC, wait for connectivity and then enable the Network threat Protection.

AS I said, it's about 60% of the time. Don't have this issue with a similar system running Win XP SP3. Ideas?

I was thinking of changing the SMC Service to a delayed start in Vista but it won't allow me to do that (either by the SC tool or in the services). Didn't try the registry though - if it allows me.

Thanks

Gis

Do you have SEP configured to start when the computer starts, or when the symantec services start? 

Hi Gis,

Quite some time back I had a similar issue that my computer would not connect to internet for 20-30 min randomly and would be normal if I restart the services for SEP.MIne was an Unmanaged client. I was breaking my head until I tried to uninstall and reinstall NTP which eventually fixed the problem.

But even if NTP is blocking the system tray would not have Red "X", Though the IP is hard coded@@!!

Seems strange!! Please check if the IP v6 is blocked by a firewall policy if it is a managed client if unmanaged try uninstall and reinstalling NTP alone.

How can I tell? To my knowledge clients are using the default settings for this [i.e. never changed the setting].

Would of like to use Vista's delayed start of the SMC but seems it's not allowed.

To change whether SEP services start when the computer starts or when SEP starts do the following.

1. Open up the SEPM console -> Policies -> Antivirus and Antispyware -> The appropriate antivirus policy
2. Click on the File System Auto-Protect tab
3. Choose the advanced tab
4. For "Load Auto-Protect When: ", choose the button in front of "Symantec Endpoint Protection starts"
5. Restart the computer

Note: This only works (i think) when the computer is managed.

Go ahead and give this a shot. Obviously this is not ideal security wise. The longer you wait to have SEP start the more vulnerable you are during start up. However if this works it might help us determine exactly what the conflict is during start up that is causing the issue.

Cheers
Grant-

*edit* I forgot to mention that by default Auto-Protect starts when the computer starts and not when SEP starts.

Same here when we tried to implement NTP...
the reinstall realy did it.. but some computers were stuborn so be re-image them and reinstall the whole sep client package...
it worked for us..

Is this only happening when NTP is enabled?