Endpoint Protection

I'm an MSP and I've encountered a disturbing trend over the last couple of weeks among 4 different workstations at 4 different client sites.

Each client is running the on-premises version of Microsoft Office 2016 Home and Business with the latest patches (automatically patched by MS). When using Microsoft Outlook 2016 with the SEP add-In enabled, Outlook will abruptly crash with a generic dialog "Outlook has encountered a problem and is restarting". After some testing, it appears that this happens when entering a folder that contains a large number ( > 600) of messages, although I'm not certain that is the trigger. Two of these clients have encountered this issue while entering their Deleted Items folders, while the other two encountered this issue with their Inboxes. In all cases, we can start Outlook in Safe Mode and disable the SEP add-in, then we can access the folders that caused the crash.

All 4 workstations are running fully-patched versions of Windows 10 - 3 of the workstations are running the Anniversary Update (1609), 1 is running the Creators Update (1703).

Of the 4 workstations, 2 are running SEP 12.1.6 MP7, 1 is running SEP 12.1.6 MP8, 1 is running SEP 12.1.6 MP9. Apparently, this is an ongoing problem that the latest update has not solved.

As much as I hate to leave ANY protection disabled, it seems that disabling the SEP add-in is the ONLY way to allow these users to continue to work without issue.

I'd appreciate any feedback or suggestions.

This add-in has been problematic for awhile now. There is no ability to add "exceptions" for it so it's what you see is what you get. Frankly, if it causes a problem with the business, I'd disable it and work with support on it. That's the best I can offer on this.

This happen to one of my user as well,  is this related to DLP since the DLP Outlook plug-in is tampered and Plugin disabled when the Outlook hang-up and stop working?

If you temporarily disable the DLP plugin does it work?

we have a site location have the similar issues, but we are using notes. well, I would say almost the same problem.

just this apps crashed all the time. so for me, it is more like the notes/outlook profile setup.

other locations so far doesn't have the crashed issues, and only one site and they have very specific notes setup.

the workaround is either install SEP without notes/outlook protection, or rename the nlnvp.dll files.

that location have a lot of users, so we go for create new package without the notes/outlook plugin, and improve our spam mail system.

Disabling the Symantec Outlook Add on is not an option. Why bother. Here is the solution.

Outlook 2016 (has stopped working) (I have a similar fix for Outlook 2013)

cmd
cd %programfiles%\Common Files\Microsoft Shared\ClickToRun
officec2rclient.exe /update user updatetoversion=16.0.8431.2094
(8431.2094 brings office back to the beginning of October 2017)

1.Start Outlook.
2.Click File, and then click Office Account.
3.In the Product Information column, click Update Options, and then click Disable Updates

Symantec Endpoint 14 latest service patches
Windows 10 1709 latest service packs
Office 2016 latest service packs

Two computers were the same, one friggin failed, the other did not fail. days to troubleshoot. Symantec did not solve the problem, but was extremely helpful in the thinking process and a super catalyst to get to this solution. This post will allow Symantec to provide the solution to their clients!

No reboot required. Fixed. Symantec Endpoint Outlook Add on is enabled and working.

Need a follow up patch from Microsoft to actually solve this long term

30+ years in IT helps
-miletx.com

Still. The addon gives no extra security. All it does is force outlook to download all attachments for scanning automatically. If you disable the addon, SEP will still scan the attachment when you open it manually, using the exact same technology. IMHO the addon is just there so Symantec can list it as a feature in their fact sheet. I’ve seen so many problems with the addon in SEP 11, SEP 12.1 and now apperantly in SEP 14. Disable it..

1. The people want to know why or how to fix the problem and they want Solutions not just disabling. You may make a request to Symantec why they provide the add on at all for anyone if it doesn’t do anything.  I have. Think about it. Perhaps a JPEG has a virus in it before it’s opened as an email when it’s previewed in the email. Perhaps there is a remote code execution that occurs in outlook that is not a scannable file. Perhaps there is a remote code execution that occurs in outlet that is not a scannable file.  There are exploits in fonts even. I would rather have all the possible protections I can possibly get. I do not reinstall operating systems I provide solutions. There are two solutions here. One is to disable that Outlook add on. The other turn is to correct the application is causing the problem. If you ever notice that the correction is never the update to the outlook ad on it’s always an update to the application in the case of semantic add on’s. In the past it was a very simple remove the last service pack under view installed updates and and remove programs.  Having two different solutions helps you decide which one you want rather than having the only choice to disable.  My point was I had two identical computers one it found fault the other it did not find fault. My further research has shown that the problem was the original office 2016 bill that I used on one was different then the office 2016 build on the other even though they were both patched to the current version and identical in every way except the initial build.  That tells me that the old version created registry entries that lingered even after an update and the new installed future office 2016 did not create those registry entries which caused this issue.  The add on is looking for parameter that doesn’t exist anymore because office has changed the way that it’s built  from 2015 to the year 2017  of the package called office home and business 2016. 

Symantec is definitely aware of this issue.  We are only suggesting to disable the add-in as a workaround until we can get a permanent resolution in place.

You can subscribe to this document to stay up to date on our progress.

https://support.symantec.com/en_US/article.TECH248059.html

-John