Endpoint Protection

Hi All,

I am in the process of upgrading the company antivirus from SAVCE 10.x to SEPM 11.x

I have intstalled SEPM on the same machine as my AD but on different dirve. On the same machine also I still have SAVCE running however I have removed the SSC. 

I deployed SEP to one client without error; however SEP client is showing server is offline but the SEPM site/server status is showing online. The client can ping the server, server also able to ping the client. Secars test on server from client passed.

I suspect issue has something to do with SAVCE on the same machine. Can SEPM and SAVCE co-exist on the same machine?

Any advice/comments appreciated.

Regards
WIlson Rotop

Did you deploy SEP on the client as a managed client?  That is, by exporting a deploying package from SEPM and then installing this package on the client.

If you client is an unmanaged client, you can convert it into a managed one by using the sylinkreplacer utility to replace the sylink.xml file.  The sylink file is the one that tells the client how to communicate with the SEPM.

Check whether firewall is on...
Check this to test server client connectivity...
http://<SEPM_Server_IP_or_Machine_Name:Port>/secars?hello,secar

YOu should get a OK response.

REF:Check this link for troubleshooting client communication issue...
https://www-secure.symantec.com/connect/articles/troubleshooting-client-commuincation 
https://www-secure.symantec.com/connect/forums/troubleshooting-how-articles-created-technical-support-trusted-advisors-and-others-you

Ports used

http://service1.symantec.com/SUPPORT/ent-security.nsf/docid/2007090614430148

The answer to your question "Can SEPM and SAVCE co-exist on the same machine?" is YES they can.

As far as the communication of the client is concerned check the following link.

http://service1.symantec.com/SUPPORT/ent-security.nsf/docid/2008091215040048

In case you have installed all the features of endpoint try removing the PTP & NTP Feature keep only the AV/AS feature and then check whether you are able to see the client online with aa green dot on it. The NTP feature of endpoint is similar to that of a Firewall aand has the ability to block Incoming & Outgoind traffic. To change the feature's please follow this link.

http://service1.symantec.com/SUPPORT/ent-security.nsf/docid/2008111808135348

I fully agree with sandip_sali recommendations.

Thank you all for the comments and advices.

Mr Sandip has given good pointers and will check on that later on.

Further to this issue, site status is showing 'Poor' health - server is low on memory. The machine is running on 2GB RAM; having Win2003 Server OS and it is the primary Domain Controller. Is this critical?

Regards
Wilson Rotop

2 GB RAM for a server which is a dc and SEPM is less anyway. You can try by increasing the virtual memory...If possible try to install SEPM in a different server..

 

For installing SEPM in a different server you can refer the below doc

How do I move Symantec Endpoint Protection Manager from one server to another with a different IP address and host name?

 

Hi All,

Issue resolved. Nothing much to do with anything; just follow the installation manual/requirement  to the 'dot'... I mean really follow the instruction. This link may helpful https://www-secure.symantec.com/connect/forums/sep-installation-verification

Regards
Wilson Rotop