Endpoint Protection

 View Only

  • 1.  teefer2 Miniport driver

    Posted Jan 16, 2012 08:41 AM

    Dear,

    I got a call about "missing connection with my domain".on some of my workstations that managed through SEPM and domain.

    I found out that the problem is related to a new devices were defined suddenly on this workstations as it appears on the attachement.

    it is block all inbound/outbound traffic."its like of disable NIC card"

     

    Could you please tell me the reason of this creation and the suitable way to remove it automatically without " visiting site.

    can I know previously, what is the PC's that will get this problem through SEPM ?



  • 2.  RE: teefer2 Miniport driver

    Broadcom Employee
    Posted Jan 16, 2012 08:54 AM

    Teefer2 is a driver of SEP firewall. What is your Symantec Endpoint Protection (SEP) version? The best practice is to have always the newest release of the product.

    How many machines are having that issue? Is it only one?



  • 3.  RE: teefer2 Miniport driver

    Trusted Advisor
    Posted Jan 16, 2012 08:55 AM

    Hello,

    What version of SEP are you carrying on this machine??

    How many machines are you facing this issue on??

    Understanding:

    The Teefer2 driver is responsible for capturing all network traffic entering or leaving a particular interface so that the packets may be passed to the personal firewall component of the SEP 11.0 client for analysis.

    The Teefer2 driver works, in tandem with its associated miniport driver. 

    The Teefer2 driver runs in kernel mode, and passes information over to the teefer.dll for user mode operations. Since all in- and outbound traffic is filtered through this driver, firewall rules are applied to all traffic passing through it.

    Please note that it is not possible to disable the Teefer2 driver without removing SEP 11's firewall component. 

    Removal of the Symantec Endpoint Protection client from a machine results in loss of network connectivity.

    http://www.symantec.com/docs/TECH103154

     
    Hope that helps!!


  • 4.  RE: teefer2 Miniport driver

    Posted Jan 17, 2012 05:59 AM

    My SEP version is 11.0.6. I think that the problem is initiated during the upgrade process from 11.0.6 to 11.0.7 with NTP feature (firewall).

    the old engine doesn't have a firewall feature.

    I had 8 machines having this problem. I have 2500 machines at my company.

    could you please tell me why this issue appeared at this week ? while the upgrade process started from 4 months ago.