Endpoint Protection

Machines hanging on Shutting Down screen when performing a shutdown. Started occuring after upgrading from RU4 to RU6. Issue is sporatic, does not occur on every machine, and doesn't occur in all shutdowns.

After upgrading from 12.1 RU4 to 12.1 RU6, machines are hanging on the Shutting Down screen when performing a shutdown. Does not occur on every shutdown, nor on every machine that has been upgraded. Not other updates have occurred since this upgrade.

Does it show what process it hangs at?

And just to be specific, are you at 12.1.6 or 12.1.6.1 or 12.1.6.1a?

There are three versions of 12.1.6....

I would enable advanced WPP logging and reprodice the issue:

http://www.symantec.com/docs/TECH171176

You may need to open a support case so they can review these losgs.

12.1.6. MP1a

Any messages in event viewer, anything else that can point to the specific process hang?

What about running process monitor?

We are experiencing this same issue after upgrading to 12.1 RU6.  Occuring on Windows 7 machines, both physical and virtual.  Have been working with Symantec support for over a month.  Haven't found a resolution yet. 

Machines will shutdown/restart normally until the SEP client gets new A/V definitions.  The SEP client tries to update the A/V engines with the new definitions, but not all of the engine parts get updated properly.  After this, if you do a shutdown/restart the machine will get stuck on the Shutting Down screen, and you have to perform a hard shutdown.  After you boot the machine up, the A/V engines will get updates, and you are able to shutdown/restart without issue.  That is until your SEP client gets new definitions, which starts the problem over again. 

Collected multiple sets of logs for Support, and they can't find an issue.  Tried clean wipe and reinstall, same issue occurres.  Tried many different combinations of client settings (PTP on and off, NTP on and off), only one that works is if you uninstall the A/V component and then the client is worthless.

No nothing in the event log.  The hang on Shutting Down appears to occur after the event logs stops collecting events.  Process Monitor doesn't show anything because it gets shutdown before the hang.  Tried SYMHelp, but tech said he didn't find anything in the logs. 

Only error we see is in the Virus and Spyware Protection system logs.  "Symantec Enpoint Protection has failed to load the latest virus definitions."  If we see that, we know that the system to get stuck on Shutting Down.  But like I said above, the A/V engine gets updated after the restart.

That's unfortunate.

What I would suggest is uninstalling each component one by one. Reboot after each has been removed to see what the result is. Time consuming and tedious, I understand, but, it may get this narrowed down to the specific component causing the issue until support comes up with a way to figure this out.

Another thing to be aware of is that symhelp has advanced deubgging and you can enable wpp reboot logging:

How to use the advanced debug logging options for the Symantec Endpoint Protection client in SymHelp

This may also aid in getting to the root of the problem.

We have already done that.  Issue occurs if the "Virus, Spyware and Basic Download Protection" is installed.  If that isn't installed, we don't see an issue.  Have already done the SYMHelp with WPP Reboot, tech didn't find any issues. 

And you're running the latest version, 12.1.6 MP1a?

Primarily 12.1.6.  We setup a test SEPM with 12.1.6 MP1a and upgraded a few clients to that version, but still having the issue on those clients.  Do not want to push out the new client to everyone until this is resolved.

Is the machine fully patched with the latest drivers? What about NIC drivers, are they up to date?

What OS and PC manufacturer? Seems more like an issue with hardware/drivers then anything else?

Machines are fully patched with the latest drivers.  Windows 7.  Dell Laptops, and VMware VMs.  If SEP is removed the issue goes away.  I am fairly certain this isn't a hardware/driver issue.

Then I would suggest you have support escalate your case to backline support. There is logging that can be enabled. The fact that support told you they found nothing is unaaceptable.

Thats exactly the same happening with my user as well, but its Virtual Environment..

I removed all components and checked, leaving AVS alone removing download protection which is same as before.

Issue is still not resolved, and we are working on it.

Had exactly the same situation with the last two remaining Win XP SP3 Dell laptops under my care. Issue started with upgrade RU5 (5337.5000) -> RU6 (6168.6000), v12.1, of course. After couple of days troubleshooting the issue, there was no progress, I wasn't able to find anything

As these machines are used by guys in the field, who are very rarely in the office, had to revert to RU5, with Cleanwipe. Still haven't had a chance to try RU6 MP1a (6318.6100).

We have the same exact Dell machines here running Win 7 SP1, none of them were affected.

Has a resolution been found?  We have 1500 clients, but only a few are exhibiting this issue randomly.  We are considering switching to McAfee.  Does anyone feel this would not be a good move?

Can anyone confirm that machines with this issue have some form of Encryption software installed? What product(s)?

I am seeing this during the restart after installing this month's Microsoft updates.  The machines are all Dell 7010 workstations (Win 7), running 12.1 RU6 MP3, build 6608 (12.1.6608.6300), AV, IPS, firewall & Browser Intrusion all enabled, Netwok Application Monitoring on only 1 of the three.  Disks are not encrypted.  I've noticed that the EndPoint client does not come back up after I force a power-off and power-on restart.  A second simple restart gets the EndPoint client running normally.  I've only observed 3 machines so far, so I'm trying to think of things to check on others.  I tried to restart the malfunctioning EndPoint client from the Microsoft Services, but the stop and restart were not available (grayed out) from the normal taks menu.  I opened an EndPoint client from the desktop Start Menu on one client and it reported that the EndPoint Firewall was malfunctioning and it's definitions might be corrupt.  Microsoft Security reported that neither the AV nor the firewall were working.  When I tried to turn the AV on from the Microsoft Message window I got the prompt asking if I trusted the publisherr, and then an error that the software could not start.  I'm going to try restarting a workstation without applying the Microsoft updates.

We are experiencing the exact same issue on about 50 Windows XP SP3 machines, all on the same hardware (Arbor).  We are currently on 12.1 RU6 and I have just been testing on 12.1 RU6 MP3 with no resolution.  As the machine in question are factory machines it make it very difficult to restart the machine manually as they are locked in cabinets for hygiene purposes.  If we are unable to get this resolved, we will need to roll back to 12.1.5 which worked with no issue.  We have checked and the machine have all available Windows updates and up-to-date drivers.  The machines all get to the shutting down point, the shutting down screen then goes and left with the blue background and a mouse cursor, the machine can still be pinged on the network, but it never restarts and has to be manually shutdown.

Does anyone have support case number against this issue? I will like to check if I can provide any latest update.

I have just logged a call 10075945 for this issue.

I'm seeing the same issue since updating from 12.1 RU4 to 12.1 RU6 MP3 on two separate implementations.  We've removed RU6 from the affected machines and put RU4 back on and they now shutdown ok.  I'm still in the early stages of collecting information and trying to find a pattern before logging a call with Symantec Support.

Thanks cookie999,

I've tagged your case to raise awareness.

-Shawn

Shawn Trent
Symantec Technical Support
Symantec Corporation

The stop and start functions are locked out in services.msc, however, you can stop and start the service from a run prompt.

Available command-line options for smc.exe
http://www.symantec.com/docs/TECH103048

Note: If you try to execute "smc -stop" from cmd.exe you will get an error, unless you use the syntax "start -smc stop" to start a separate window to run the process, or point directly to the executable path.

-Shawn

Much appreciated.  Still trying to gather for log information.

I may be dealing with a different problem.  On Saturday I was able to update my remaining Dell Optiplex 7010 workstations without a shutdown/restart issue  The workstations that did have the shutdown hang up problem are now operating normally.  I have not had to roll back the SEP clients.  We are trying to gather data from logs.

I've seen evidence that something is causing one of our threads to hang. This appears to be external influence from a filesystem minifilter. The feature that is impacted (Deferred Scanning) can be disabled for troubleshooting purposes, but identifying the source of the hang would require a full system memory dump.

Here is the article to test with deferred scanning disabled: http://www.symantec.com/docs/TECH224108.

-Shawn

Shawn Trent
Symantec Technical Support
Symantec Corporation