Endpoint Protection

Hi guys!

I've trolled the forums a bit and haven't really found anything relevant. I installed SEP 11.04 on Windows 2003 SP1 as an unmanaged client. Originally we had TruScan installed, until I called support and discovered they don't recommend anything except the AV program on servers. Ok, fine. I removed it, rebooted the server and started it up again.

And then our issue recurred.

What issue is that?

All printing on the server stops. So badly that you can't even open up Printers and Faxes. It just hangs. There's nothing logged in the Application or System eventlogs. Only some anonymous logons from one of our clients when they connect in the Security log. I think the latter might be a red herring though. 

 Nothing in the Symantec logs either. The strange thing is, it isn't happening when the users first login. It's happening about an hour later. And it's happened 2 days in a row at the same time. There are no scheduled tasks running then, the Symantec client is set up to update at 12:00am..... and the users are happily working.

Now if I stop the Symantec services, restart the Print Spooler and TCP/IP server, then start the Symantec services again all is well. I'm going to try and add the Windows spooler folder to the exceptions list. But I won't be able to tell until the same time tomorrow morning! Does anyone have any experience with this? The strange thing is, this didn't happen on our printserver or the others running Terminal Services. Just one. And they're virtually identical! I didn't have much luck with support. They just walked me through removing the Truscan component.

Thanks!

You may wish to take a look at the following articles pertaining to this issue.

"Network Printer does not receive print jobs after installing the Symantec Endpoint Protection (SEP) client"
http://service1.symantec.com/support/ent-security.nsf/docid/2008040115074048

"Microsoft Windows stops responding when printing after installing Symantec Endpoint Protection"
http://service1.symantec.com/SUPPORT/ent-security.nsf/docid/2007111613095348

Please let me know if these help.

Thanks. :-)

Does this server has file shares on it?
if yes then may be an upgarde to MR4 MP2 will help your.:)

Here2Help: Neither of those articles are relevant. We *ONLY* have the antivirus client installed. None of the tamper protection, TruScan or any other options. We don't even have e-mail scanning active!

I repeat: We only have the antivirus component installed.

That's why I'm stumped.

Kavin: Only the typical windows shares. This isn't a file server. It's running TS.

On Windows 2003 Terminal Server, be sure to install SEP using the "install" user. This can be accomplished by following the document Starting the Installation from Microsoft.

http://technet.microsoft.com/en-us/library/cc738580(WS.10).aspx

Also refer to the Best Practices for Symantec Endpoint Protection on Citrix and Terminal Servers

http://service1.symantec.com/SUPPORT/ent-security.nsf/docid/2008112414453348

I worked it out myself. For anyone else with this issue, make sure you add the Windows spool directory  to the exceptions list. Updating so hopefully the message will get passed along.


That is if you haven't hunted through Symantec's site for every piece of documentation ever.