Endpoint Protection

Hi everyone,

I have upgraded a Windows XP SP3 client from a well running SAV 10.1 to SEP 11.05. Now I see, that the client is registered to its new SEP management server and receives the correct policy, but it can't update itself with definitions. Trying to use Live Update fails, also. I can see an error message in the Windows event log saying:

error - registry value [$REGSESCROOT$\CONTENT\{different_values_in_several_event_entries}] can not be updated, because it is not inside key "CurrentVersion" of SAV.


I have already uninstalled SEP and reinstalled, but this keeps comming. Also I uninstalled SEP, then reinstalled SAV, verified that everything is ok, uninstalled SAV and installed SEP again, but the described above stays.

Did anybody experience this, yet?

Go to run and Type luall.exe and see waht happens

if that fails then go to  http://www.symantec.com/business/security_response/definitions/download/detail.jsp?gid=savce

and downlaod
 

Client installations on Windows Platforms (32-bit)

20100321-020-v5i32.exe | FTP

and see if that updates or  not. if yes then observe it for  aday

Then try installing SEP.

You would need to contact Symantec Technical Support for this.

For Technical Support Number in you location refer,
http://www.symantec.com/business/support/contact_t...

Kind Regards,
Naor .P.

Remove SEP
Delete following folders if present
C:\Program Files\Symantec
C:\Program Files\Symantec AntiVirus
C:\Program Files\Common Files\Symantec Shared
C:\Documents and Settings\All Users\Application Data\Symantec
 
Also delete following reg keys
HKLM\Software\symantec
HKCU\Software\symantec
Reboot the computer
Install liveupdate first then
Install SEP and try..

Thanks I tried this, but it did not solve the issue. After a new installation the errors come up again.

Thanks I tried this and a manual update works for the virus definitions, only. Proactive Thread and Network protect definitions stay old.

Any errors in the event viwer?

Follow this

How to clear out corrupted definitions for a Symantec Endpoint Protection Client manually

http://service1.symantec.com/support/ent-security.nsf/docid/2007123111551948

The same errors as before:

error - registry value [$REGSESCROOT$\CONTENT\{different_values_in_several_event_entries}] can not be updated, because it is not inside key "CurrentVersion" of SAV.

After clearing them out, the errors still occur. As I described above, I can manually update the virus definitions, but this does not update the other definitions and does not make the event log entry leave.

Look like some traces of SAV is still present.Contact support and get clenwipe for both SEP and SAV run both and then install once again.

Sorry, cleanwipe did not fix tis either!

Are there different versions of cleanwipe? Mine did its job, but after reinstalling later on the error stays the same.

Having the client up for one day now I noticed, that reports from viruses and policies are quite up to date, but still not the definitions.

No updations you mean non of the features are getting the updates(AV/as,PTP,NTP)?

check the registry key

http://service1.symantec.com/SUPPORT/ent-security.nsf/docid/2008080509424648

Thanks, but LiveUpdate does not cause the issue. Live update successfully updates my virus definitions, so it somehow works. Both other definitions are not updated though.

Anyway I want the client to be updated from the management server and not manually via live update.

No, none of them receives anything automatically. Running Live update manually updates the virus definitions only.

Do as follows
Reinstall liveupdate
Click Start > Settings > Control Panel.
Click Add or Remove Programs.
Click LiveUpdate.
Click Change/Remove.
Follow the on-screen instructions to uninstall LiveUpdate.
In Windows Explorer, delete the following folders if they are present:

C:\Documents and Settings\All Users\Application Data\Symantec\LiveUpdate
C:\Program Files\Symantec\LiveUpdate

Install LiveUpdate using LUSETUP.EXE located in the SEP installation files, in one of the following folders:
...CD1\SEPM\ or ...CD1\SEP\


To register the SEP Client with LiveUpdate:
Click Start > Settings > Control Panel.
Click Add or Remove Programs.
Click Symantec Endpoint Protection.
Click Change.
Click Next, select Repair, and click Next again.
Click Install.
Click Finish.

These are the regitry values from the Event Log, which are not in the
"CurrentVersion" key. Maybe someone knows what they could be related to or how I can extend the "CurrentVersion" key manually?

{CC40C428-1830-44EF-B8B2-920A0B761793}
{E1A6B4FF-6873-4200-B6F6-04C13BF38CF3}
{C25CEA47-63E5-447B-8D95-C79CAE13FF79}
{812CD25E-1049-4086-9DDD-A4FAE649FBDF}
{E5A3EBEE-D580-421E-86DF-54C0B3739522}
{4F889C4A-784D-40DE-8539-6A29BAA43139}
{42B17E5E-4E9D-4157-88CB-966FB4985928}
{D3769926-05B7-4AD1-9DCF-23051EEE78E3}
{ECCC5006-EF61-4C99-829A-417B6C6AD963}
{C13726A9-8DF7-4583-9B39-105B7EBD55E2}
{EA960B33-2196-4D53-8AC4-D5043A5B6F9B}
{DB206823-FFD2-440A-9B89-CCFD45F3F1CD}
{C60DC234-65F9-4674-94AE-62158EFCA433}
{B36CDA3C-B15B-421C-A2A4-7EC70E3B852B}
{1CD85198-26C6-4BAC-8C72-5D34B025DE35}
{DFB8BBDD-52DE-427E-9EB3-FB7665893221}
 and also [$REGSESCROOT$\CONTENT] can not be updated, as it is not inside the "CurrentVersion" key

After doing so, Live update works again for the virus definitions, but still no possibility to update from the management server with the same event log entries.

Is this the only computer in your environment that this is happening on?

Are you using locations that have any special characters in their names?  (i.e. an ampersand (&))

Sylink debugging might indicate whether or not the client is identifying it needs this content but can't install it, or that it doesn't identify it needs content at all. 

Title: 'How to enable Sylink Debugging for Symantec Endpoint Protection in the registry'
http://service1.symantec.com/SUPPORT/ent-security.nsf/docid/2008041812561948

sandra

No.  Cleanwipe is designed for SAV and SEP removal.  If anyone still has NoNav lurking around out there, throw it out.  You may do more harm than good with it.

sandra

Yes, that was the only client. I have completely re-built it from scratch, so now it is working again. Thanks.

LiveUpdate attempts to run and exits with a message -

Common Client Core 2.1.7

"Could not find installation path for at least one component"

I notices a similar error in this forum for a different Common Client Core number with a recommendation to upgrade.
My LiveUpdate version was 3.3 and I upgraded to 3.4 without success - same error occurs.
I next upgraded to 3.5, but again without success - get exactly the same error message.

What should I do?

Additional info - probably superfluous - I uninstalled the Norton utilities that had come with the original computer and
installed SEP 11.0.5002.333 obtained from the University of Miami IT department (I'm on the faculty there).

Thanks for any suggestions.

Title: '"Could not find install path for at least one component" error appears on a SEP client after LiveUpdate.'
Document ID: 2010040109410348
> Web URL: http://service1.symantec.com/SUPPORT/ent-security.nsf/docid/2010040109410348

BTW LiveUpdate 3.3 is the only one for use with enterprise antivirus.

In case you need it:

Title: 'Using the "SymNRT" utility (Norton Removal Tool)'
Document ID: 2008053006350648
> Web URL: http://service1.symantec.com/SUPPORT/ent-security.nsf/docid/2008053006350648

sandra