I've noticed this problem after upgrading my user base to SEP 12.1 RU2. It appears that DefWatch scans take anywhere between 30 minutes to 1 hour to complete. This is a quick scan that should only take 2-10 minutes at most, considering it only touches 1,000-2,000 files roughly. I've also attached the vpdebug log as well.
Screenshot of the scan log.
I have an issue where machines are attempting to connect directly to liveupdate.symantecliveupdate.com to receive the following file.
liveupdate_3.3.0.99_english_livetri.zip
How do I stop LiveUpdate from attempting to automatically grab application updates?
Checking my SEPM I see that all of my LiveUpdate Policies have the "Download Symantec Endpoint Protection product updates using LiveUpdate server" unchecked. That's the only setting I can find that looks to be related to the experience I'm currently having.
Does anyone know how to disable this?
Hai,
i want to know the new policy settings introduced in SEP 12.1.2 & what are the new policy settings added in SEP 12.1.2 compare then SEP 11.6 RU6
Thanks & regards
Rajasekaran
After reviewing the options for migrating SEPM 12.1 from one server to another, it appeared replication would be the easiest. However, if we already have a SQL database for SEPM 12.1 stored on our SQL server, if we replicate the SEPM 12.1 server, it will create another SQL database for the new server correct? Should we setup the new server as using an embedded database instead before we replicate this way it does not create another database or am I off track here?
We've noticed that the virus, IPS, and Download Protection definitions are updating each day. However, our SONAR detections appear to be stuck on 3/1/2013 r11.
My question is does SONAR update with the other definition packages, or is 3/1/2013 r11 the most current SONAR defnition?
Thanks,
Nathan
Hi Support,
Please help me. I have a one SEPM server installed on windows server 2003 enterprise edition. Thease server configured on 80 port. Now i am going to create a replication server. I had also run the replication but replication is not completed due to system disk space on primary SEPM server. I have also check the drive size on primary server and found primary server have 84GB of hard drive and all hard drive using by Symantec Endpoint Protection Manager and SQL database. Please the solution. We need urgent help.
At the replication time SEPM showing SEM5 overwrite opetion.
Please Help Me.
Hi Team,
I have one network drive are available in every system.user are having copy and paste our data.
My question can SEP scan shared /Mapped drive ?
I've got some batch files running on user computers. They run occasionally. And I have them run on their own, not when anyone (me) is logged in.
At the end I added blat.exe which can email me after the task is completed. It's a really nice perk... "Yes, this batch file just ran." And it's a little more in my face that it's complete, as opposed to check a log file myself. (Log file still works, so if blat doesn't work I can always keep doing that... .if I must.)
When I log in and manually run the batch file file, I get the blat email.
When the batch file runs on its own, I know it hits the blat part, but I don't get any email. I see from the blat output info that it's erroring out -- can't connect to server.
I'm pretty sure it's SEP blocking it.
I ran into blat not working on some internal servers. Same idea -- done with task or a problem with a monitored task... send me an email. We took off the email policy on those machines, problem solved, I got blat emails.
These are user machines though. I want email policy on there. But I still want my blat emails to notify me.
How do I set an except for blat in SEP? Ideally, it could be for a blat email, from me, to me, on a certain port.... It could be that specific. I really don't see it being abused by spammers. I still don't want to open up every user's email just so I can get email notification just because it's nice.
How do I let my blat emails through on the user machines? What do I have to tweak in the policies to allow that to happen?
In report "Client Online Status Computer Status Report"
We can see a chart for percentage of online/offline computer and related group name.
Can we get a report with specific offline computer name and related group? So that we don't need to logon SEPM to find out the computer
If there is no similiar report available, what's the fatest way to get the offline computer account with related group name ?
After liveupdate completed,the client's definition status does not return to SEPM console even we have set heartbeat to 1 min and wait for an hour
Until I logon the SEP, manually click "Update Policy" button. Then definition date status can be properly seen on SEPM
Hi,
I try to install Symantec_Endpoint_Protection_12.1.2_Win64-bit_Client_EN on a new Dell laptop with windows 8 x64 but install is running back.
With previous versions I could fix this with install liveupdate first but the install isn't in the folders @the moment.
How to solve this?
(install log attached)
Hi all,
We are using Symantec Endpoint Protection Manager 12.1 (RU2) installed on Windows Server 2003.
Two days ago we started to receive message "Database is down". We've checked the server and found (like few times before) that there is no more space left on the disk because of the sep5.log who become to big. Like previously, we deleted the log file, restarted "Symantec Embedded Database" service, but this time nothing happened (usually sem5.log is automatically created) . We've tried to start the service manually few times, restarted whole server, but without success, service remained stoped. We checked Application log and found that "SQLANYs_sem5" error is generated whenever we try to start "Symantec Embedded Database" service. We've manualy created sem5.log file, but after starting the service file was automatically removed.
Please help me resolve this issue.
Thanks in advance.
Recently we updated from SEP 11 where we had the use of the Find Unmanaged Computers facility coveniently located under Clients. Now with SEP 12 we have to use the enable as unmanaged detector feature so we have to view the results through daily reports.
However, I know that SEP 11 had issues with false postives when using the Find Unmanaged feature but now with SEP 12's Unmanaged Detector feature we seem to be having to do even more work to check the results!
We use DHCP for our clients, when looking at the unmanaged machines report we will ping the IP addresses and if we get a response we will then do a nbtstat -a command to resolve the machine name so that we can check it in the SEPM console. However, the problem I am finding is that by doing that we are getting false positives i.e. when checking the machine name it SEP it is actually managed. But, the most concerning thing is that the MAC addresses that SEP comes back with, do not seem to match any known machines on our system and do not match the MAC of the machine name that resolves when performing the nbtstat through CMD.
Anyone else having problems with detecting clients without SEP or are unmanaged?
Hi -
Our environment is operating at SEP 11. We have several branch offices having 500 to 600 workstations over 20 subnets in each branch office. We will be upgrading to SEP 12.1 RU2 very soon and are planning to have a GUP at the branch office to reduce the load on the WAN which connects our head office with the branch office. Due to infrastructure limitations, we will be able to use only one server as a GUP at each branch office.
My idea is to create one group with a LiveUpdate Policy. The Policy will have Multiple GUP and Explicit GUP option enabled. Multiple GUP option will have rule sets that will define the IPs of all the GUPs at the branch offices.
The Explicit GUP list will map all 20 subnets in each branch office with the GUP available in that location. This way , my guess is the clients at the branch office will be able to communicate across subnet in the same branch office and still conserve the bandwidth over WAN.
Kindly help me my letting me know if this idea would work and suggest any alternatives if this wouldn't work or if there is any better way of achieving this.
Hi,
In our organization, We have SEP version 11.0.6 is running. The database is configured on MS SQL 2005 and it is on a remote server.
During configuring SQL server 2005 for SEPM 11.0.6, A weak password has configured and I want to change change it.
How I change it?
Given I run SEPM on a closed network I download the latest virus defs from the FTP site
ftp://ftp.symantec.com/public/english_us_canada/antivirus_definitions/norton_antivirus/jdb/
The files where all checking in fine up until a few days ago, now in the event logs on the SEPM server we use to put the jdb file we are getting a warning event 7203 at the time of the file check in and the checkin is failing ?
Any ideas as to what the event ID actually means ?
Cheers
Fal
I have been requested by my upper management to get SEP 12.1 RU2 installed on some new Surface Pros that are going to be distributed soon. Has anyone successfully done this before? I had the Local MIS attempt to do an install on Friday and with no success.
If anyone has successfully done this please provide any tips or tricks needed to do this successfully.
Thanks