Symanec Protection Suites

Hi,

Yesterday I started having an issue with the "Symantec Endpoint Protection Webserver" Service on my Endpoint Server, running windows server 2003. After completing a database backup, the Server just slowed to a crawl, none of my clients could connect, the endpoint manager web page was no longer working, I couldn't log into the manager from the server. Our network team noticed some odd traffic on the network coming from our symantec server and that the ping response we were getting from the symantec server was showing the following (I removed our ip address and domain info):

Pinging symantec [000.00.0.000] with 32 bytes of data:
Reply from 000.00.0.000: bytes=32 time=1109ms TTL=128
Reply from 000.00.0.000: bytes=32 time=534ms TTL=128
Reply from 000.00.0.000: bytes=32 time=562ms TTL=128
Reply from 000.00.0.000: bytes=32 time=462ms TTL=128

 

We decided to stop some services and see if that helped at all. After some trial and error we were able to narrow down the problem to the "Symantec Endpoint Protection Webserver" service. With that service disabled the ping time returned to <1ms which is what we would expect to see from it. 

Since this database back up was in preperation of setting up a new Windows 2012r2 server we kicked our efforts on that migration into high gear, but we are still corious as to why this started happening. Any insight would be awesome.

 

What's the SEPM version here and what components are installed? Any changes recently made?

The Version of SEPM is 12.1 Ru4 with the Endpoint Protection, Network Protection, and Intrusion portection installed. 

The only changes made was the database backup, policy export, and communication settings export. 

Has traffic normalized? Have you checked the result with the fireewall disabled?

No it did not. The only thing that had any affect was stoping the service. The fire wall is still disabled but it didn't impact the ping times when it was enabled.

Network slowness while accessing through network is as been fixed in 12.1 RU4a. Upgrade you program to latest and let me know

I appolgize for the confusion, after checking our version again our manager is upgraded to 12.1 RU4a (12.1.4023.4080) and we are still having the issue. If there is a more current version we would be willing to try that.

Latest is RU4 MP1, you're a version behind. Is this only the SEPM you're talking about or clients as well?

Latest version is sep 12.1 ru4 mp1b.