Endpoint Protection

On some computer SEP 12.1.1 use alot of resources and makes the computer very slow.
At this moment we have 20 computers that have this isseu. And with slow i mean very slow. 30-40 minutes you have to wait when you log in. And when your work you have to wait 2-5 minutes for opening a document. When we remove the SEP client, everything is back to normal. We did a reinstal of two computers but that didn't help alot.  

The computers al have 2+GB RAM, other computers with the same spec doesn't have this problems...

And when we install a client with only Anti-virus and Anti-spyware. Its better but it still take 15 minutes to login.

Someone have experience with this issue?

Check this might help if this was something known there must be Fix released by Symc check Symantec in article below for know issue's

http://social.technet.microsoft.com/wiki/contents/articles/10130.root-causes-for-slow-boots-and-logons-sbsl.aspx

Are you running any other security products on these systems? What is the operating system used?

It is not really the login thats the problem but after you login the computers hangs a while before you can do something.

After a few tweaks this problem is solved i think but the computer is stil very slow when you work with it.

We don't run any other security products on the system. We have other computers with same hardware s and the same software but they don't have any issue.

We have Windows XP.

Kindly verify...............

have you check reinstall window ?

This issue is rendomly or some specify system  ?

Virus defination are up to date ?

Some time this issue occured when lot of user profile are exit in System and low space in c drive.

kindly change one system pagefile location.(Only for Troubleshooting)

This issue is randomly or some specify system?
It's More randomly, but at this moment 70 % of the computers that are affected by this issue are computer from the IT department.

Virus defination are up to date?
yes

Some time this issue occured when lot of user profile are exit in System and low space in c drive.
Alot of profiles isn't possible. Will check low space...

Kindly change one system pagefile location.(Only for Troubleshooting).
On the list to try this.

hi,

Thanks for update..

Kindly verify more ..

Slowness problem occure one time in day ?

Kindly check when your system are slow can you check virus defination folder created date.

Locations of Virus Definitions for SAV or SEP Client only:

• Windows 9.x\Windows XP\Windows Server 2003:  \Program Files\Common Files\Symantec Shared\VirusDefs\ or \Program Files (x86)\Common Files\Symantec Shared\VirusDefs

Same problem occure in my company when system start system goes slow after 25 to 30 min.this problem occure every 8 hours,when we have check virus defination folder Created date and time are same.

Glenn ,

Could you please check the event log i guess there should be event mentioning event id 10xxx something

and the solution is to change the dcom settings i had dealt with similar issue earlier and had helped fixing issue after changing permission on machine , try this on 1 machine only ie workstation as a test you might have to login as Admin to make change ,

Note do not make changes on SEPM server try giving affective dcom permission on Client first and then check if it works .

http://answers.microsoft.com/en-us/windows/forum/windows_xp-performance/dcom-error-10010-very-slow-login-very-slow-desktop/4614ae6d-93cd-45e6-b66a-cbde1db13f90

http://blogs.msdn.com/b/distributedservices/archive/2009/01/21/dcom-error-10010-in-the-event-logs-and-sluggish-server-performance.aspx

On just a few systems, we had to first:

1) Uninstall SEP 11

2) Remove everything symantec from folders (program files, common files, profiles - especially "all Users")

3) do reboots after each step

4) Check disk space

5) Make sure we didn't touch anything relating to other Symantec products, such as NetBackup

6) Perorma clean push install using the wizard.

The reason is that we still had pieces of very OLD SAV software on some machines.

Excuse me:  also--

We had turned on Isight and SONAR.  No problem except we needed to have exclusions, especially in Blue Coat for some of the new Symantec websites, such as:

ent-shasta-mr-clean.symantec.com and

ent-shasta-rrs.symantec.com

I would check the following logs (most under Network Threat Protection):

SONAR

TRAFFIC

PACKET

and see if anything new is getting stopped.

Yes, I guess I'm not alone in this too, my WIndows XP SP3 user report the same thing when opening their Outlook 2007 after upgrading to SEP v12.1 RU1

We reinstalled the system so just cleaning up will not work for us. Its even on new systems.

We didn't get alot of complains from the users, so we don't really know how many PC are affected by this problem. But there are some ppl in our IT Department taht have this issue and it isn't only related to Outlook. Startup is very slow, We know that SEP will slow down the boot process.But this is to much.

We don't really care if the systems takes a little more time to boot but when we start software (Local installed software and APP-V) It takes up to 5 minutes to open. We can have 2 system (Same hardware and software) but one does have the problem and the other doesn't have it. The only differences are the MAC/IP and systemname.

I don't know if we have thos exclusions in our bluecoat will check this. I don't think this will solve our problem but i'm out of idea right now so i gonna try those exclusions if they aren't already there.

I found a list of Proxy exclusions here: http://www.symantec.com/business/support/index?page=content&id=TECH162286

Do i need to add all of them for everyone or just from our SEPM server?

This is a shot in the dark, but try disabling Insight lookups for a test and see if this has any impact on performance.

How does Insight Lookup work? - http://www.symantec.com/business/support/index?page=content&id=TECH169282

Ok turned it off. Will check those system ASAP.

Hm.. didn't think about that before :-0

Thanks for the advice Ashish

have you check system speed after setting ?

Check this might help

Go to: C:\Program FIles\Symantec\Symantec Endpoint Protection Manager\Inetpub\Content (Default Location of SEPM) 

 Check

- {535CB6A4-441F-4e8a-A897-804CD859100E} for 32 Bit

- {07B590B3-9282-482f-BBAA-6D515D385869} for 64 Bit

Note: These two folders take more disk space, compared to other folders which are used to store the Virus definitions

 Once the number of content revisions has been decreased, then this would be reflected on the number of revision folders. See TECH96214 for recommendations.

 To reduce the size of the database transaction log file

 Log in to the Symantec Endpoint Protection Manager.

 Click Admin and select Servers.

 Select the localhost under Servers.. Under Tasks, Select Edit Database Properties.

.In the General tab under Database Maintenance Tasks.

 Select the checkboxes next to Truncate the database transaction logs and Rebuild Indexes.

 Click OK to apply the changes.

We keep 25 revisions (we have 2100+ clients). I don't know this will fix the problems on the clients because this is server related and we only have a problem with a few clients. But will try this later when i checked the system speed after the change we did last week. But i didn't have alot of time to check this now.

Another strange thing:

next year we will roll out Win 7 instead of XP we are doing tests now and i changed one of those systems to Windows 7. Problem is gone. Change back to Win XP problem back....

Does your XP computers meet the minimum system requirements?

We have Dell systems and they all have 2gb ram+ and Dual core processors (I think 1.8Ghz+)

SEP 12.1 lot of new feature are available that cause windows xp OS are slow working.

Try on import SEP 11.x client package on SEPM 12.1 and check 1 or 2 system performance.

How to import SEP 11.x package in SEPM 12.1

https://www-secure.symantec.com/connect/articles/how-import-sep-11x-package-sepm-121

We already imported SEP 11 packages (there are some problems with Thinapp).

Installed it and the problem is gone with SEP 11...

Is there any difference in your Windows firewall settings?  I set SEP 12 to disable the Windows firewall since having two firewalls running could slow down things.  You also would need to check out the difference between your XP and Win 7 images.  They are probably not exactly the same.  Also, make sure you don't have duplicate SIDs in your envirnment.  There is a lot of software we have seen that is sensitive to that (mostly patching systems).

we have the same problem on some windows2003 server enterprise edition sp2 system,but when i dial the symantec support line ,they don't have any idea about this issue.

well,finally ,we had to reboot the server and uninstall the sep 12.1 client.

i think ,this problem must be caused by sep client.

Please make sure that you are not blocking access to any sites, http(s):// *.symantec.com.  SEP 12 does a lot of checking on reputation and the sites are all listed somewhere.  They don't use liveupdate, exactly for this.  We don't have any performance issues with 12.1.1.

You may also want to look at the different logs to make sure nothing is being blocked, such as SVCHOST.EXE.  You must create an exclusion for that as it tries to access the hosts file.

Are these all at one site or at a remote site?  Are you going back to a server for updates or out to the internet?  Are your proxies transparent or static?

Hi,

Is this still the issue with SEP client version 12.1 RU1 MP1 deployed to WIndows XP SP3 ?

https domains aren't blocked in our company.

http://*symantec.com is whitelisted on our proxy and it doesn't need any authentication to reach it.

Both most part is on a remote site but we also have this problem on the site were our server is located.

We use our server for updates.

What is the difference between transparent and static proxy?

Its still an issue, and we even think it got a little bit worser but we only think it  We can't deny it or prove it....

With the latest version we got more computer that have this issue but we need this version. Other version has problem with APP-V and 75% is APP-V

On Win7 we see alot of improvements, we didn't had a chance to check it on an 'clean' win XP SP3

Reinstal the computer have a little succes (it will speed up those computers but not enough).
We already have a case by symantec but we also know its a high chance that this problem is a configuration thing (OS- third party software in combination with SEP.)

We think its more a combination of different software.

like there are some user that have a standard but with alot of extra software. And with alot I am talking about 15+, most of them are from our IT department.

But the problem is also there but alot of other user but tey are spread over our company. But if we see how many per department. IT has more then the other department (3 x more).

It gave maybe a 15% extra speed on those computer. I'm  happy is 15% so our user know we are trying to fix it... 

Ah that's sounds great Glenn, because my company will soon migrate to Windows 7Pro next year.

Thanks, without seeing all of your logs I was just checking.  For what it is worth, we are running XP SP3 and Windows 7 mixed and are not seeing any issue.  I check the logs every day and find all sorts of new things that we never knew were going on.  We are using both SONAR and Insight and it is dramatically reducing scanning here.  Since some of the "policies" have new things in them, my only suggestion at this point would be to go over yours carefully (between 11.x and 12.x).  (Especially Firewall rules).  Good luck.

What processes are utilizing the most CPU?

Non active system processes are 99%

other processes are around 0-1%

Hope the slow logon issue might because of SEP scanning NTUSER.DAT file..

So users will be facing this slowness prroblem

Try to add a exlusion for one user profile and check if tat works...

Bot we don't have a option so set wildcard for this 

Better you can stop Active scan on startup...for better performance.

Go to SEPM-->Policy-->Virus and spyware policy-->edit the scan policy and disable the active scan on windows start up.

Check these articles for more info.

https://www-secure.symantec.com/connect/forums/rtvscanexe-scaning-all-cusersxxxntuserdat-endlessly

https://www-secure.symantec.com/connect/forums/how-stop-scanning-ntuserdat

Mohan, what are the tweaking method to make SEP runs faster and safer in the WIndows XP client ?

We had a similar Problem with the long logon times on:

• Windows XP
• Sites with no Domain Controller

We fixed it by adding the "BufferPolicyReads" Reg Key described in this Blog:

http://blogs.technet.com/b/instan/archive/2011/08/29/massaging-the-xp-registry-for-logon-performance.aspx

But I have no idea where that slow open documents thing could come from.

Hope the info helps you!

Have you tried to uninstall the Network Threat Protection part to see if the Network Performance is still bad?

Hi John Santana

If you install all components you need to make sure your environment need all the features. You can avoid the some features that you may not use on your environment.

Scan suggestions:

Antivirus & Antispyware:

Settings need to configure:

• You can schedule the scan frequency and Scan randomization out of productivity hours.
• Scan settings should be selected as Better performance for other applications
• Scan when a file is modified
• Set exclusions for legitimate files 

PTP [Proactive threat protection]  

TrueScan : It will scan all the process that runnin on your Memory. You can set the Heuristic level to medium or low to avoid False  Positives and better performance.

Appplication & Device control: Block or monitor the applications and devices.

If you dont' USe you can remove them.

NTP [Network threat protection]

Firewall: Works based on rules block allow or log the inbound or outbond traffic

Configure the firewall according to the enivronment

IPS: Works based on signatures.

Hope this helps,........

Many thanks Babu !

Welcome always.........John Santana

Hope you got the required information............

Is there anything else i can help you with...........

Hy we have same problem after upgrade our clients to SEP 12 RU1 MP1, some cliente with WinXP SP3, was very slow, and now We identify that all clients who updated from WSUS, was slow too.

So, you can resolve the problem? Any Idea??

@tcbilis, so what is the issue exactly ?

is that only for several random users or consistently acrosss all of the upgraded users ?

Dushan,

It´s a random users, becouse the first case We reinstall all machine and again machine is very slow, after install SEP 12 RU1 MP1.

So we install version 11 in this machine to resolve at this moment.

Today, We have 40 machines, and 3 have this issue.

Hm.. that is scary :-| please let us updated with your solution as well.

this all sounds similar to my issue - problem identified with only machines running XP with solid state hard disks....

remove the network cable whilst it's going slow - does the problem go away?

You need to add them for everyone.  We have *.symantec.com whitelisted.  You may want to note that most of these are https: sites (not port 80).  Each computer, when it scans, will be accessing those sites.

I had a computer running VERY slow with an SSD.  Fixed it by updating the SSD firmware to current levels.  Many of the older (this was a 64 GB SSD) have this issue because they did not handle deletions the way you would expect.  In any case, a firmware refresh fixed the issue.

Hi

I am also facing the same issue.

Regards

Hi man, may I know what is the model / manufacturer of the SSD and your workstation ?

So what's the update on this issue then ?

Try new version it has lot of enhanced features with improved performance scale. Updated most of the drivers.

SEP 12.1.2 has been released finally..

https://www-secure.symantec.com/connect/forums/sep...

Yes I have tried that so far and no issue encountered.

I can say after a lot of testing that the performance is betetr with the new version, but starting up some applictaies is still slow (a lot less then before).

A small update on this, i know it took a few months 

We upgraded our server to RU2 (Before we only used the RU2 Clients). We tweaked alot of stuff in the manager. (So many i don't even know what is changed  ) We disabled everything on the client that we don't use. We created a new feature set for this.

I'm proud to say that we have solved 80% of the slowspeed problems. The other 20% is just a combination between some software and SEP (Like ThinAPP still take 10+ second to startup).

Some numbers:

APP-V packages comes down from 1min+ to a few seconds
Booting is now between 2min and 5 min.
Opening documents is almost instantly.

It was alot of trial and error and patience but in the end it was it worth :-)

I just want to thank everyone here cause we used alot of stuff from this thread and other threads  to tweak our clients and server.

Hi

What are the components installed ?

Regards

SameerU,

This is wat we use:

We have a own AV on exchange, we also have a proxyAV. 

We also have a second feature set we are testing for those system that are still slow.
There Advanced downlaod protection and sonar is also disabled but this isn't final yet.

The firewall Policy has only a blank rule for now and alot of stuff isn't enabled in the settings. But in the future this will change.

We used the rule: What we don't use we don't want to install.

Hi,

It does not look to a Symantec Problem, could you check on Task manager which process it taking these much recourses.

We had also same issue while inspecting our clients we found that it is not because of Symantec, because of some HDD issues.

Regards

Ajin

I have noticed a major performance crash in moving from version 12.1.2015.2015 to version 12.1.2100.2093, particularly in accessing databases on a network server from a Windows XP workstation.

Network scanning is disabled.

It's a known issue. If you disable the firewall only, it should work as normal.

Multiple cases have been opened, including one for myself.

Thanks. I always disable the Firewall by policy, but I'm going to try adding a new Feature Set with the Firewall component deselected.

Withdrawing the policy will not work, you need exclude the firewall component for it to work normally. Sorry should've mentioned that.

We've noticed the same thing. We spent an entire day trying to troubleshoot this and did find that disabling the firewall helped, adding rules to the firewall didn't. I'm not keen on disabling the firewall and have rolled back to 12.1.2015.2015 for the workstations that are accessing the database. 

Modifying the rules won't help. It has to do with an update to the teefer driver in the latest version. Has been a very large lag in monitoring the traffic going thru the SEP firewall.

The only workarounds right now are to disable/remove the firewall component or roll back to 12.1 RU2.

My case has been escalated to the advanced team.

Thanks. If I just create a new Install Feature Set (with Firewall deselected), and modify the existing Install Package - will the clients automatically uninstall the Firewall feature?

It should. Follow this:

How to add or remove features to existing Symantec Endpoint Protection (SEP) client installations

Yes Allen, that's true, 12.1.2 RU2 is the most stable so far.

I tried the newest version on a few computers and after a day i just rolled it back.
12.1.2 RU2 is better if you still have alot of XP systems.

Rollback?

I missing something here, but when I imported the old package and created separate groups for the XP workstations and ensured they are not inheriting from the parent, they seem to reject the older package due to the newer client installed.

I have found searching for the client by IP and redeploying a package in the past works on the same verision, but do not know if it does for going back a verision, is there a specific tech doc that points to rolling back local clients?

Or are you going to the workstation itself and doing this?