Release notes for Symantec Endpoint Protection 11.0.x and Symantec Network Access Control 11.0.x

Symantec.com > Enterprise > Support > Knowledge Base

Release notes for Symantec Endpoint Protection 11.0.x and Symantec Network Access Control 11.0.x

Question/Issue:
This article documents the changes and fixes in each update to Symantec Endpoint Protection 11.0.x and Symantec Network Access Control 11.0.x.

Solution:
As updates to Symantec Endpoint Protection are released, they are added as sections in this document. The sections are added in chronological order, with the most recent additions at the top.

Note: To download the latest release of Symantec Endpoint Protection, read the following document: Obtaining an upgrade or update for Symantec Endpoint Protection 11.x or Symantec Network Access Control 11.x.

This document should be read in conjunction with the appropriate Readme files:

Readme_SEP.txt
Readme_SNAC.txt
Readme_appliance.txt
Readme_trialware.txt

Release Update 5 (RU5)

What's new in this version
The current release includes the following improvements that make Symantec Endpoint Protection and Symantec Network Access Control easier and more efficient to use.

Symantec Endpoint Protection Manager now supports the following operating systems:

Microsoft Windows Server 2008 Service Pack 2 (all editions except for Itanium)
Microsoft Windows Server 2008 R2 (all editions except for Itanium)

Symantec Endpoint Protection Manager can now be used with Microsoft SQL Server 2008.

The Symantec Endpoint Protection or Symantec Network Access Control client now supports:

Microsoft Windows 7 (all editions except for Itanium)
Microsoft Windows Server 2008 R2 (all editions except for Itanium)
Microsoft Windows Vista Service Pack 2

The size of the exported client installation package has been reduced.

You can configure the following features for the Group Update Provider:

Limit the amount of bandwidth that the Group Update Provider can use when the Group Update Provider downloads content from the management server.
You can define a Group Update Provider by using rules and conditions, such as an IP address or host name. You can configure a single Group Update Provider in a single LiveUpdate Policy that applies across multiple groups for multiple clients.
Define clients to connect to a Group Update Provider within the same site to improve performance.
Identify which clients act as Group Update Providers.

The client now includes a Download Support Tool command on the Help and Support menu.

Users on the client can download a support tool from the Support Web site that helps to diagnose the common issues that they might encounter on the client.

Symantec Network Access Control includes the following enhancements:

New Host Integrity templates support Altiris 7, BigFix Enterprise Suite, and new versions of additional third-party products.
End users with a valid RADIUS logon but a computer with no client installed can be blocked from your company's network.
You can configure when the command-line interface on the Enforcer times out.

Components included in this version

Component	Version
Symantec Endpoint Protection	11.0.5002
Symantec Network Access Control	11.0.5002
Auto-Protect	10.3.0.15
Avengine	20081.1.1
Behavior Blocking	3.3.0.015
ccEraser	2007.0.1.6
COH	6.1.9.44
Common Client	106.5.0.10
DecABI	1.2.5.130
Defutils	4.1.1
ECOM	81.3.0.13
VxMS (MS Light)	5.2.0.4
LiveUpdate	3.3.0.92
LiveUpdateAdmin	2.2.1.16
Microdefs	2.7.0.13
QServer	3.6.20
WpsHelper	12.0.1.41
SyKnAppS	3.0.3.3
SymEvent	12.8.0.11
SymNetDrv	7.2.5.9
Teefer2	11.0.5

Product fixes by category

Symantec Endpoint Protection Antivirus and Antispyware
This section describes the customer fixes for Antivirus and Antispyware since the release of MR4 MP2 (11.0.4.4200).

Under the guest account, Symantec Endpoint Protection clients report multiple warnings

Fix ID:

Symptom:

Solution:

Updated hardware key due to MAC address change causes Symantec Endpoint Protection client re-registration with Symantec Endpoint Protection Manager

Fix ID:

Symptom:

Solution:

Smcgui.exe crashes for a Restricted user

Fix ID:

Symptom:

Solution:

Location awareness only works when the Primary DNS suffix matches the condition

Fix ID:

Symptom:

Solution:

TPM Device not displayed in the Symantec Endpoint Protection Manager

Fix ID:

Symptom:

Solution:

Decomposer version is blank in the Symantec Endpoint Protection client user interface

Fix ID:

Symptom:

Solution:

Unable to disable the "Threats were detected while you were logged out" message

Fix ID:

Symptom:

Solution:

Smcgui.exe unexpectedly takes foreground focus

Fix ID:

Symptom:

Solution:

The Symantec Endpoint Protection client fails heartbeat with Error Code=87;AH or Error Code=0;AH

Fix ID:

Symptom:

Solution:

64-bit Symantec Endpoint Protection clients do not pass Host Integrity check

Fix ID:

Symptom:

Solution:

Scheduled LiveUpdate does not run at random times as expected

Fix ID:

Symptom:

Solution:

Scheduled LiveUpdate still launches LuAll.exe although the "Use a LiveUpdate Server" option is unchecked

Fix ID:

Symptom:

Solution:

Log forwarding settings for Scan Aborted, Scan Started, and Scan Stopped do not work properly

Fix ID:

Symptom:

Solution:

Eraser Engine displays Version 0.0

Fix ID:

Symptom:

Solution:

LiveUpdate tries to contact external LiveUpdate Servers despite policy setting

Fix ID:

Symptom:

Solution:

A Group Update Provider leaves TCP connections in the CLOSE_WAIT state, preventing Symantec Endpoint Protection clients from updating

Fix ID:

Symptom:

Solution:

Remediation options for Email Auto-Protect are grayed out in the Symantec Endpoint Protection client

Fix ID:

Symptom:

Solution:

Smcgui.exe crashes on Windows 2000 when users are logged in as Guest account

Fix ID:

Symptom:

Solution:

Location awareness switches based on "Primary DNS Suffix" provided by domain controller

Fix ID:

Symptom:

Solution:

SMC.exe uses entire CPU core and client/manager communication fails after migrating or installing the Symantec Endpoint Protection client

Fix ID:

Symptom:

Solution:

Symantec Endpoint Protection client user interface has inconsistent behavior when restoring items displayed in Quarantine

Fix ID:

Symptom:

Solution:

Symantec Endpoint Protection clients cannot update antivirus definitions from the Symantec Endpoint Protection Manager

Fix ID:

Symptom:

Solution:

MSI Repair function reverts the Symantec Endpoint Protection Manager/IIS port to 8014 from non-default

Fix ID:

Symptom:

Solution:

Symantec Endpoint Protection client upgrade warnings are inconsistent

Fix ID:

Symptom:

Solution:

Symantec Endpoint Protection Manager Home page shows the virus definition date as 1/1/1970

Fix ID:

Symptom:

Solution:

RTVScan.exe does not release memory until after the scan completes

Fix ID:

Symptom:

Solution:

Outlook Auto-Protect has problems with attachments containing non-ASCII letters in the file name

Fix ID:

Symptom:

Solution:

Microsoft Word files are deleted as soon as they are opened on a local partition

Fix ID:

Symptom:

Solution:

Crash occurs during process termination with bug check 8E

Fix ID:

Symptom:

Solution:

An application fault occurs in RTVScan.exe due to corrupted data in the registry

Fix ID:

Symptom:

Solution:

Administrator scheduled scans are not running at specified times

Fix ID:

Symptom:

Solution:

Users suddenly cannot access shared files with Auto-Protect enabled

Fix ID:

Symptom:

Solution:

Symantec Endpoint Protection crashes in RTVscan when performing multi-threaded scan

Fix ID:

Symptom:

Solution:

Symantec Endpoint Protection does not detect eicar.com when it is downloaded using Google Chrome

Fix ID:

Symptom:

Solution:

Auto-Protect does not detect threats that are copied to a network share or a mapped network drive on Windows 2003 or 2008 Server

Fix ID:

Symptom:

Solution:

Crash on Windows Vista with bug check 7f

Fix ID:

Symptom:

Solution:

Coh32.exe has an application error with the message "The instruction at '0x044be849' referenced memory at '0x000000000'"

Fix ID:

Symptom:

Solution:

Symantec Endpoint Protection Email Auto-Protect does not work properly when using Secure POP3 (POP3S) port 995

Fix ID:

Symptom:

Solution:

Symantec Endpoint Protection Firewall

Firewall does not block traffic to or from Juniper SA Network Connect virtual NIC

Fix ID:

Symptom:

Solution:

With NICs that use a TCP offload engine, Symantec Endpoint Protection with Network Threat Protection enabled causes networking problems, such as connection failures and performance degradation

Fix ID:

Symptom:

Solution:

DNS resolution fails while connected via Microsoft VPN

Fix ID:

Symptom:

Solution:

System crashes with STOP 7E during Symantec Endpoint Protection client installation

Fix ID:

Symptom:

Solution:

Last Download Time shows an erroneous date

Fix ID:

Symptom:

Solution:

Firewall rule unable to block application with use of DNS Host or DNS Domain types in Host Groups

Fix ID:

Symptom:

Solution:

Crash in sysplant.sys caused by stale data

Fix ID:

Symptom:

Solution:

Disabling the Browse files and printers on the network option through Network Threat Protection has no effect

Fix ID:

Symptom:

Solution:

With a dial-up adapter, firewall rules are not applied while using Internet Explorer

Fix ID:

Symptom:

Solution:

The Symantec Endpoint Protection client is unable to maintain a network connection through the 802.1x enforcement after the Cisco VPN client 3.6.6 dials up

Fix ID:

Symptom:

Solution:

Sysplant prevents Cygwin compiler from building code

Fix ID:

Symptom:

Solution:

Clients report Denial of Service attack (IP Fragmentation overlap) when no overlap is occurring

Fix ID:

Symptom:

Solution:

Host integrity configuration file is corrupted on Windows Vista

Fix ID:

Symptom:

Solution:

Sysplant causes CosmoCall Agent software to crash

Fix ID:

Symptom:

Solution:

On Windows Vista, Application and Device Control is not able to log DLL injection attempts to IExplorer.exe

Fix ID:

Symptom:

Solution:

System Lockdown exclusions are not honored, which causes strange characters in file path

Fix ID:

Symptom:

Solution:

Symantec Endpoint Protection detects Jolt2 DoS attack when Altiris agent sends large amounts of ICMP packets to the Altiris server

Fix ID:

Symptom:

Solution:

A crash caused by sysplant.sys, bug check 1000008E occurs

Fix ID:

Symptom:

Solution:

Symantec Endpoint Protection Manager

The Symantec Endpoint Protection Manager cannot use registry key (default) as a file path in a Host Integrity check

Fix ID:

Symptom:

Solution:

Policy settings never update after creating a new management server list using specific Japanese strings

Fix ID:

Symptom:

Solution:

Home, Monitors, and Reports pages are blank on the remote console after updating Java to version 1.6 Update 11

Fix ID:

Symptom:

Solution:

Windows 2008 is identified as Vista in scm-server logs

Fix ID:

Symptom:

Solution:

Replication error - violation of PRIMARY KEY constraint 'PK_SEM_COMPUTER' occurs

Fix ID:

Symptom:

Solution:

User Account Control prompt on Windows 2008 Server or Vista when using a remote console does not reflect the status of UAC

Fix ID:

Symptom:

Solution:

IPS Exclusions do not work for DNS host and DNS Domain used with Host Groups

Fix ID:

Symptom:

Solution:

Saved filter converts commas to "*2C"

Fix ID:

Symptom:

Solution:

Replication occurs over a proxy server if a LiveUpdate proxy is defined

Fix ID:

Symptom:

Solution:

New Software Package notification email contains multiple redundant lines

Fix ID:

Symptom:

Solution:

A broken link appears in the dbvalidator.log

Fix ID:

Symptom:

Solution:

User is prompted to change Administrator password at Reporting logon when set to never expire

Fix ID:

Symptom:

Solution:

Negative number appears in Detection Action Summary report

Fix ID:

Symptom:

Solution:

French localized Symantec Endpoint Protection Manager cannot create scheduled reports due to incorrect date format

Fix ID:

Symptom:

Solution:

Sorting by date in Client Status page generates scrambled results

Fix ID:

Symptom:

Solution:

The Symantec Endpoint Protection Manager client table Sort button stops working and does not toggle

Fix ID:

Symptom:

Solution:

The Search Client option allows limited administrators to run commands on computers in groups with no access rights

Fix ID:

Symptom:

Solution:

Duplicate client records in the database point to groups that no longer exist, causing communication failures

Fix ID:

Symptom:

Solution:

Default size of the Symantec Endpoint Protection Manager user interface does not allow all filters to be seen or selected when adding a Scheduled Report

Fix ID:

Symptom:

Solution:

System Administrator Scheduled Reports inappropriately visible across Symantec Endpoint Protection Manager Domains

Fix ID:

Symptom:

Solution:

Learned applications paths are incorrect

Fix ID:

Symptom:

Solution:

Replication fails when the password for the Symantec Endpoint Protection Manager account used for replication contains the % character

Fix ID:

Symptom:

Solution:

Improper end time in exported scan logs

Fix ID:

Symptom:

Solution:

Symantec Endpoint Protection Manager reports show file paths with a forward slash when it should be a backslash

Fix ID:

Symptom:

Solution:

Notification batch script does not finish successfully

Fix ID:

Symptom:

Solution:

Data truncation errors appear in the logs

Fix ID:

Symptom:

Solution:

Replication fails with "Duplication of Primary key"

Fix ID:

Symptom:

Solution:

Scheduled reports return a list of report recipients with extra space

Fix ID:

Symptom:

Solution:

"No entries" in Monitors > Logs> Computer status on embedded replication partner (with SQL)

Fix ID:

Symptom:

Solution:

Unmanaged Detector does not acknowledge excluded computers and IP phones

Fix ID:

Symptom:

Solution:

Host compliance log details are truncated when a Host Integrity policy has a large number of requirements

Fix ID:

Symptom:

Solution:

A Limited Administrator account is able to create packages, upgrade groups, and view reports for groups that have been blocked

Fix ID:

Symptom:

Solution:

64-bit Windows XP in exported Computer Status Export logs is incorrect

Fix ID:

Symptom:

Solution:

The raw data dump from the External Logging options does not contain column header identifiers

Fix ID:

Symptom:

Solution:

Clients are not deleted from historical data and skew reports

Fix ID:

Symptom:

Solution:

LiveUpdate errors are listed as warnings instead of errors

Fix ID:

Symptom:

Solution:

Single client does not receive the commands sent from Symantec Endpoint Protection Manager

Fix ID:

Symptom:

Solution:

Behavior of outbreak notifications is inconsistent

Fix ID:

Symptom:

Solution:

With Simplified Chinese, garbage characters appear in attack logs

Fix ID:

Symptom:

Solution:

Changes to the maximum number of clients displayed per page in the default view are not preserved in other views

Fix ID:

Symptom:

Solution:

Duplicate Centralized Exceptions policies appear when adding exceptions via risk logs

Fix ID:

Symptom:

Solution:

Event times are shown as "1970/01/01 08:00:00" [TimeZone:+8] in notification email

Fix ID:

Symptom:

Solution:

The Symantec Endpoint Protection Manager quits when displaying a large log of unapproved applications

Fix ID:

Symptom:

Solution:

Symantec Endpoint Protection Manager client status "Last Check-in" date/time is calculated inconsistently

Fix ID:

Symptom:

Solution:

Client status is displayed incorrectly in the Symantec Endpoint Protection Manager console

Fix ID:

Symptom:

Solution:

Moving users between OUs within Active Directory is not correctly reflected on the Symantec Endpoint Protection Manager interface

Fix ID:

Symptom:

Solution:

The Symantec Endpoint Protection Manager no longer accepts RISK logs from legacy Symantec AntiVirus servers after migration

Fix ID:

Symptom:

Solution:

The number of clients in an email notification and the corresponding report do not match

Fix ID:

Symptom:

Solution:

Long policy description entries cause events to be dropped

Fix ID:

Symptom:

Solution:

The Symantec Endpoint Protection Manager is slow to apply policy changes after importing 10,000 OUs

Fix ID:

Symptom:

Solution:

Initial replication fails with the notification "The transaction log for database 'sem5' is full"

Fix ID:

Symptom:

Solution:

Bad CurrentSequenceNum registry value contributing to .dat.err file build up on MR4 MP2 Symantec Endpoint Protection Manager

Fix ID:

Symptom:

Solution:

Virus alerts emails do not contain the file and file patch that was infected

Fix ID:

Symptom:

Solution:

The string "\r\n" in the description field on the client properties in Symantec Endpoint Protection Manager causes data truncation error when replicating

Fix ID:

Symptom:

Solution:

Duplicate clients in the Symantec Endpoint Protection Manager

Fix ID:

Symptom:

Solution:

Symantec Endpoint Protection Manager "Single Risk" notifications do not send email for Proactive Threat Protection risk detection of BloodHound.SONAR.1

Fix ID:

Symptom:

Solution:

SystemBiosVersion registry value results in a Symantec Endpoint Protection Manager error "An invalid XML character"

Fix ID:

Symptom:

Solution:

When the maximum number of clients displayed per page is set to over 1,000, only 1,000 clients are displayed

Fix ID:

Symptom:

Solution:

Client search by IP address only returns the first IP address even though the computer has more than one

Fix ID:

Symptom:

Solution:

"Unable to communicate with Reporting component" when you log onto the Symantec Endpoint Protection Manager remote console under certain conditions

Fix ID:

Symptom:

Solution:

Symantec Endpoint Protection Manager Home Page "Security Status . Attention Needed" lists old data in details

Fix ID:

Symptom:

Solution:

Symantec Endpoint Protection Manager Active Directory sync at root OU produces duplicate clients. AD sync at sub OUs produces no duplication

Fix ID:

Symptom:

Solution:

Java .1 errors when installing Symantec Endpoint Protection Manager to remote database using Windows Authentication

Fix ID:

Symptom:

Solution:

Symantec Network Access Control

Client peer to peer authentication blocks other clients' access to its share folder

Fix ID:

Symptom:

Solution:

SNAC.EXE and Services.exe take up to 40% of CPU

Fix ID:

Symptom:

Solution:

IP is not released when On-Demand client is exited

Fix ID:

Symptom:

Solution:

User is unable to connect to the network via VPN when using the Gateway Enforcer On-Demand plug-in

Fix ID:

Symptom:

Solution:

Client has delayed access to network resources during the boot up sequence

Fix ID:

Symptom:

Solution:

DHCP Appliance does not supply secure mask 255.255.255.255

Fix ID:

Symptom:

Solution:

Users taking considerable amount of time to switch from Quarantine to Production scope

Fix ID:

Symptom:

Solution:

The Gateway Enforcer switches continuously switches between standby and active

Fix ID:

Symptom:

Solution:

The Enforcer loses trunking function after self reboot

Fix ID:

Symptom:

Solution:

Running the Symantec Network Access Control On-Demand Client and Checkpoint VPN causes a blue screen

Fix ID:

Symptom:

Solution:

Guest Access does not work when using MAB & Transparent mode

Fix ID:

Symptom:

Solution:

RADIUS server rejects the user before PEAP authentication

Fix ID:

Symptom:

Solution:

LAN Enforcer does not communicate with Great Bay scanning device correctly

Fix ID:

Symptom:

Solution:

Unable to connect to wireless, no Symantec Network Access Control, over PEAP authentication

Fix ID:

Symptom:

Solution:

Maintenance Release 4 Maintenance Pack 2 (MR4 MP2)
This section describes the new features and fixes included in Maintenance Release 4 Maintenance Patch 2 (MR4 MP2) of Symantec Endpoint Protection 11.0 (also known as version 11.0.4202). This maintenance pack cannot be installed over any versions of Symantec Endpoint Protection or Symantec Endpoint Protection Manager prior to MR4. It must be installed over Maintenance Release 4 (MR4), (MR4-MP1), or (MR4-MP1a).

What's in this release
This maintenance patch resolves in-field reported issues within Symantec Endpoint Protection client, Symantec Endpoint Protection Manager. These release notes also list updated and new Readme items for this release.

Note: The latest available release of Symantec Network Access Control is MR4 MP1. There have been no customer fixes since the release of Symantec Network Access Control MR4 MP1.

Component	Version
Symantec Endpoint Protection	11.0.4202
Symantec Network Access Control	11.0.4010
AutoProtect	10.2.10.2
Avengine	20081.2
Behavior Blocking	3.3.7.15
ccEraser	2007.0.1.6
COH	6.1.8.8
Common Client	6.3.8.004
DecABI	1.1.1.39
Defutils	4.1.0.19
ECOM	61.3.0.17
VxMS (MS Light)	5.2.0
LiveUpdate	3.3.0.85
LiveUpdateAdmin	2.2.1.13
Microdefs	2.5.37.0
QServer	3.6.16
WpsHelper	11.0.717.804
SyKnAppS	2.5.12
SymEvent	12.5.3.2
SymNetDrv	7.2.3.302
Teefer2	11.0.697

Product Fixes by category

Symantec Endpoint Protection: Antivirus/Antispyware
RTVScan.EXE terminates unexpectedly when initiating a scheduled scan
Fix ID: 1523740
Symptom: RTVScan.exe terminates unexpectedly when initiating a scheduled scan.
Solution: A common client component, MSL, was updated to prevent the crash.

Quarantine scan causes Auto-Protect detections in %temp% folder
Fix ID: 1525749
Symptom: DWHWizard.exe starts the quarantine scan and moves quarantined files in to the %temp% folder for scanning. Auto Protect will occasionally detect these infected files.
Solution: After extracting and re-scanning each quarantine item, the TMP file is deleted unless the state is now REPAIRABLE. Repairable files are used later, either to restore to the original location or to save back to Quarantine (REPAIR_ONLY mode). These files should be clean, so Auto-Protect should not detect anything in them.

Intermittent Outlook crashes
Fix ID: 1511242
Symptom: Outlook exits unexpectedly when using "Previous Item" or "Next Item" option.
Solution: The Outlook plug-in was changed to keep track of the most recent ExchangeCallback Pointer correctly.

Sysfer crashes Adobe Elements
Fix ID: 1522283
Symptom: Sysfer crashes Adobe Elements when using context to convert .doc(x) files to PDF format.
Solution: Changed a function to read a string-type parameter correctly so that the memory address is properly accessed.

Windows 2008 x64 share connectivity problems
Fix ID: 1442447
Symptom: After a period of time (hours to a day or so) file shares become unresponsive on Windows 2008 x64.
Solution: Auto-Protect update.

TempProfile_Nlnhook is created for each user that logs into a multi-user Lotus Notes installation
Fix ID: 1519913
Symptom: A directory named "TempProfile_Nlnhook" is created in customer's Citrix Presentation Server environment under the user profile folder (%USERPROFILE%).
Solution: Changed to use the CAccessToken class to get the currently logged in user name from the access token, and to send it to the LoadUserProfile () instead of the temporary directory name.

CleanWipe fails to properly remove Symantec AntiVirus 10.2 from a 64-bit operating system
Fix ID: 1532299
Symptom: Symantec AntiVirus still appears in Add/Remove Programs, the CleanWipe log will show various deletion errors, and key folders and files are left behind after using CleanWipe to remove Symantec AntiVirus 10.2.
Solution: A different API is used to detect that Symantec AntiVirus 10.2 is installed on a 64-bit operating system.

Proactive Threat Protection displays the status "Waiting for Update" after a client migration
Fix ID: 1456698
Symptom: Proactive Threat Protection displays the status "Waiting for Update" after a client migration.
Solution: After migration, Proactive Threat Protection should be "on" and should display the latest version.

Antivirus performance is slow when scanning the procmail.log
Fix ID: 1415668
Symptom: It may take a few minutes to scan the procmail.log file. Rtvscan.exe CPU usage increases up to 99%.
Solution: Decomposer engine update.

The Symantec Endpoint Protection installation fails with a "Return value 2" when CP_USASCII is disabled
Fix ID: 1499625
Symptom: The Symantec Endpoint Protection installation fails.
Solution: Symantec Endpoint Protection now uses CP_ACP instead of CP_USASCII when the installation path is validated during installation.

CLT_INST temp folder is left behind whenever a remote install is done (through wizard or Find Unmanaged)
Fix ID: 1527791
Symptom: A CLT_INST folder is left behind after installation.
Solution: VPREMOTE now marks the CLT_INST folder for deletion upon next reboot.

During migration from Symantec AntiVirus 10 MR 7 to Symantec Endpoint Protection 11 MR4 the installation removes all log-files from C:\Temp\Logs
Fix ID: 1509069
Symptom: Upon completion of the installation, the log files are moved to %ALLUSERSPROFILE%\Symantec\Symantec Endpoint Protection\Logs.
Solution: Updated the installer to use a unique temporary folder to store the Symantec logs.

SMCGUI.exe causes users to lose windows focus
Fix ID: 1460045
Symptom: SMCGUI.exe often stops and starts, causing a user to lose window focus.
Solution: When loading a profile, a return value is checked to see if it is NULL upon calling a specific function.

High paged pool memory usage for Auto-Protect
Fix ID: 1511152
Symptom: Pool monitor shows high memory usage for SavE and SaEe pooltags.
Solution: AV engine update.

Stand-alone Quarantine Console installation cannot connect to any remote Quarantine Server
Fix ID: 1506385
Symptom: Trying to connect to selected server fails with the following error message: Cannot connect to server <SERVER NAME>.
Solution: The installer was changed to make the installation directory available to post-install script functions.

A Defwatch scan does not run on Microsoft Windows Vista if no user is logged on to the computer
Fix ID: 1508276
Symptom: The Defwatch scan does not run on Microsoft Windows Vista unless a user is logged on.
Solution: If no user is logged on, an elevated access token is used to run the Defwatch scan.

Windows Security displays the warning "MALWARE PROTECTION out of date" after a user manually runs an Active Scan or a Complete Scan
Fix ID: 1486799
Symptom: Windows Security displays the warning "MALWARE PROTECTION out of date" after a user manually runs an Active Scan or a Complete Scan.
Solution: Symantec Endpoint Protection was modified to allow the product to query the Windows Security Center information correctly.

Users with local administrator privilege can bypass the Symantec Endpoint Protection uninstall password
Fix ID: 1515363
Symptom: A user is able to bypass the uninstall password by using an undisclosed procedure.
Solution: The MSI file was updated to prevent administrators from bypassing the uninstall password.

While running CleanWipe (RunCleanWipe.bat) with the -silent switch, a dialog box prevents uninstallation from completing
Fix ID: 1588132
Symptom: A modal dialog box appears indicating the Symantec AntiVirus has been uninstalled, and prevents the uninstallation from completing.
Solution: Modified the MSIUnst.bat file to change a command line switch to MsiExec that removed the modal dialog.

Auto-resume of content-package does not resume across reboots or restart of SMC.exe
Fix ID: 1557479
Symptom: Content package download does not resume after either the computer or SMC.exe is restarted.
Solution: Preserve the partially downloaded files and use the HTTP range header information to download the remaining bytes from Symantec Endpoint Protection Manager.

Clients cannot download content from Group Update Provider (GUP)
Fix ID: 1588869
Symptom: Clients attempt to connect to the GUP to download content, but the clients are rejected. The sylink.log shows "<GetLUFileRequest:>Send Request failed. Error code = 12152". The GUP allows for only 100 cached entries, and if that number was exceeded, the GUP fails and does not accept any new connections.
Solution: Updated the GUP caching functionality to use to the administrator's configurations for file count or size.

During installation of LiveUpdate, lucheck.exe returns an invalid error code
Fix ID: 1545886
Symptom: Installing Symantec Endpoint Protection fails as a result of an lucheck.exe error.
Solution: LiveUpdate component change.

System performance decreases when virus definitions are downloaded
Fix ID: 1488785
Symptom: When Symantec Endpoint Protection downloads and applies virus definitions, the system performance for other applications can become sluggish due to excessive disk I/O. Performance returns to normal after the virus definition upgrade is complete.
Resolution: Several components were updated to significantly improve disk I/O during virus definition download and processing.

Symantec Endpoint Protection: Firewall

When a scheduled scan starts, SMC.exe intermittently crashes
Fix ID: 1472880
Symptom: SMC.exe crashes when a scheduled scan starts.
Solution: Additional checks were built into SMC to avoid crashes.

Unable to daisy chain Remote Desktop Protocol (RDP) sessions with sysplant enabled
Fix ID: 1499711
Symptom: When creating a second RDP session from within an existing RDP session, the second RDP session hangs.
Solution: Subsequent RDP sessions are now established normally.

Ping response times increase in releases since Symantec Endpoint Protection 11 MR3
Fix ID: 1510782
Symptom: The ping response time increased.
Solution: The process ID of incoming ICMP packets was not set correctly. The process ID has been modified.

DNS suffix-based location switching does not detect the "disconnected" status of the network card
Fix ID: 1486618
Symptom: DNS suffix-based location switching does not detect the "disconnected" status of the network card when a user joins a domain.
Solution: DNS suffix-based location switching now detects the "disconnected" status of the network card correctly.

After enabling a "Block USB" write policy, files located on network shared folders take longer to open and save
Fix ID: 1475460
Symptom: Access to files located on network shared folders is slow.
Solution: The Application and Device Control cache was increased to improve performance.

A third party management folder "Inbox" is created in the wrong location
Fix ID: 1514511
Symptom: The third party management folder "Inbox" is created in the default location when Threat Protection is enabled and custom user shell folders are used.
Solution: SMC.exe was changed to use "SHGetFolderPath", which allows the Inbox to be created in a custom folder rather than the default.

SMC.exe CPU spikes when no user is logged in on virtual machines
Fix ID: 1517849
Symptom: SMC.exe CPU processing time is greater than 10%.
Solution: SMC.exe was incorrectly querying a process list twice. The extra call was removed and the existing call modified to increase performance.

Symantec Endpoint Protection does not switch locations when using Dial-Up or PPP/SLIP interface
Fix ID: 1530050
Symptom: You configure Symantec Endpoint Protection to switch locations when dial-up or PPP/SLIP interfaces are used. When the client switches interfaces, it does not automatically change locations as expected.
Solution: Change to properly detect dial-up, PPP, SLIP, and PPoE network connections.

Inconsistent behavior with NTP "Microsoft Windows Networking" settings
Fix ID: 1509179
Symptom: Settings are not handled correctly in the Symantec Endpoint Protection GUI when a computer contains more than one network adapter.
Solution: Modified the user interface to display the settings correctly.

Symantec Endpoint Protection Manager
Scheduled reports run with different parameters than the ones that were originally set
Fix ID: 1505248
Symptom: Scheduled Reports for Top Risk Detections Correlation always use the default Group/RiskName filters (X-Y axis), even though a different parameter is used.
Solution: Modified the PHP file to retrieve the filter to be used from the database.

"Enable LiveUpdate Scheduling" should not work after unselecting "use a LiveUpdate server"
Fix ID: 1595629
Symptom: "Enable LiveUpdate Scheduling" still works after unselecting "use a LiveUpdate server".
Solution: LiveUpdate scheduling is disabled when LiveUpdate is not used and LiveUpdate UI options are disabled unless a user is allowed to configure the LiveUpdate schedule.

Group names text in the group tree is truncated when exporting packages or assigning limited administrator rights
Fix ID: 1528898
Symptom: Only part of the client-group name is visible.
Solution: The label width of the tree renderer was extended to accommodate the need for additional space.

An exported Computer Status report does not provide IPS definition information
Fix ID: 1508289
Symptom: The information for the IPS definitions is missing from an exported Computer Status report.
Solution: A new column called "IPS Version" was added to the exported Computer Status report.

When using Windows Authentication for Microsoft SQL, no special characters are allowed in the password
Fix ID: 1503301
Symptom: A user cannot input special characters in the password field.
Solution: Special passwords are now allowed, including additional support for Windows Authentication mechanisms and improvements that affect IIS and the IIS configuration wizard to allow special handling of characters.

NTP logs exported as CSV files from Symantec Endpoint Protection Manager cannot be processed correctly due to double quotes within the text field
Fix ID: 1510799
Symptom: The column order and the values are incorrect after exporting the data to CSV format.
Solution: Quotes were changed to double quotes for the column description.

Deleting old packages generates errors in the Symantec Endpoint Protection Manager during manual LiveUpdate
Fix ID: 1515458
Symptom: Removed packages fail to update.
Solution: Filter out the suspended packages when initializing SesmContentCatalog.

"Query Failed" appears in the Action Summary by Detection Count window on the Home Page of Symantec Endpoint Protection Manager when logging in with a Limited Administrator account
Fix ID: 1538866
Symptom: The Action Summary by Detection Count window in the Home Page shows "Query Failed.
Solution: A query was changed to prevent the failure from occurring.

Slow process of DAT files in the Inbox\Agentinfo folder on the Manager
Fix ID: 1513330
Symptom: Large numbers of files in the Inbox\Agentinfo folder. The number of files continually increases.
Solution: Updates to Avman and Agentinfo processing along with SQL batching of statements, and configurable multi-threading to the Agentinfo processing.

Client does not report the correct IP address when a NIC is assigned more than one IP address
Fix ID: 1511355
Symptom: Client properties may reveal an IP-address of "0.0.0.0".
Solution: Symantec Endpoint Protection Manager displays the IP address that the client uses to connect to Symantec Endpoint Protection Manager.

Symantec Endpoint Protection comprehensive risk report shows incorrect month
Fix ID: 1512110
Symptom: Comprehensive risk reports shows threats as occurring in the wrong month when a report of more than one month is run.
Solution: SQL script update.

Symantec Endpoint Protection Manager replication fails with ASA error 193: "Primary Key for Table 'COMMAND' is not unique" when using an embedded database
Fix ID: 1533903
Symptom: Replication fails when the HARDWARE key is NULL.
Solution: Made changes to the query that finds the data.

Large number of BCP queries during DAT-file processing causes high CPU usage on SQL Server
Fix ID: 1533966
Symptom: SQL Server will show high CPU usage in conjunction with a Symantec Endpoint Protection Manager database.
Solution: The code was modified to address database deadlock issues.

Symantec Endpoint Protection Manager displays error "Object cannot be found [0x16010000]" when going to Policies > Policy Components > Host Groups
Fix ID: 1533012
Symptom: You are unable to edit a Firewall/IDS policy.
Solution: Update USN for reference when updating objects which contains references.

Unable to edit policies, and an incorrect location use count for policies is displayed
Fix ID: 1532253
Symptom: The location use count shows 0.
Solution: The location use count should no longer display 0 unless it is truly not applied to any groups.

Symantec Endpoint Protection 11 MR4 does not provide an option to deploy to clients using a URL
Fix ID: 1516419
Symptom: The URL option is disabled.
Solution: The URL option was enabled to support the handling of a single executable file.

Client can't get the correct setup file after resetting the 3rd party URL to a correct location
Fix ID: 1520249
Symptom: If a third party download URL is set to an incorrect setup file, after it fails to apply and a new URL that points to a correct file is set, the client continues to download from the original, incorrect URL. This persists until the client restarts.
Solution: Sylink update to import a new URL after a failed download.

Symantec Endpoint Protection Manager does not update content for clients after upgrading from MR4 to MR4 MP1
Fix ID: 1539713
Symptom: Content on clients is not updated after upgrading from MR4 to MR4 MP1.
Solution: When moniker and sequence number are not synchronized between Inetpub, symcdata and registry, SesmLU needs the full folder and if necessary SesmLU will create this folder by extracting the related full.zip file.

Replication fails with a reference to "Violation of PRIMARY KEY constraint 'PK_SEM_CONTENT'"
Fix ID: 1534131
Symptom: Symantec Endpoint Protection Manager may log a PRIMARY KEY violation during replication.
Solution: Symantec Endpoint Protection Manager replication was modified to prevent this error from occurring.

Configuration wizard does not allow user to specify domain name
Fix ID: 1522005
Symptom: User cannot type "\" for user name when using windows authentication.
Solution: Allow domain extraction from the textbox and make PHP use real windows authentication mechanisms.

Symantec Endpoint Protection Manager console experiences performance issues when PackageTask is running
Fix ID: 1532312
Symptom: PackageTask memory usage is high.
Solution: Optimized memory usage by the PackageTask process.

Microsoft Excel is unable to parse an exported Computer Status report correctly due to a comma in the Service Pack column
Fix ID: 1507303
Symptom: After introducing one or more computers that contain a comma in the Service Pack field, the data in the exported Computer Status report shifts to the right.
Solution: The value was enclosed with double-quotes for service packs that contain a comma.

When an Active Directory Sync mode-enabled Symantec Endpoint Protection Manager has clients in user mode, the Symantec Endpoint Protection Manager GUI shows duplicate client entries
Fix ID: 1514585
Symptom: The Symantec Endpoint Protection Manager GUI displays duplicate client entries with the same user and computer names.
Solution: Symantec Endpoint Protection Manager now displays the actual user name which registered and the last online user for the client instead of the current user for the agent.

SESMLU connectivity to Tomcat can time out while a lock in the database is held, causing automatic notification of content availability to fail
Fix ID: 1510207
Symptom: Certain content may not be updated automatically but can be updated manually.
Solution: The default receive time-out value was increased (defaults to 30 minutes) and is now configurable through the registry: HKEY_LOCAL_MACHINE\Software\Symantec\Symantec_Endpoint_Protection\SEPM\LUReceiveTimeout (DWORD), which is the time in seconds that the timeout is set to. This value is set to 1800 seconds by default, and the minimum value that it will accept is 600 seconds. If a value lower than the minimum is set, the minimum value is used.

The virus definition distribution reports in a replicated environment show the same report for each server
Fix ID: 1523677
Symptom: The same virus definition distribution report will show for all servers.
Solution: The virus definition distribution report now shows the correct information per server.

Replication fails with remote sites after migrating to MR4 MP1 with string index out of range
Fix ID: 1587973
Symptom: StringIndexOutOfBoundsException happens during replication.
Solution: Turned off escapes in embedded database's BCP command.

Symantec Network Access Control
There have been no customer fixes since the release of Symantec Network Access Control MR4 MP1.

Readme items

"Error 1327. Invalid Drive" when installing Symantec Antivirus 10.2 after pointing "Documents" folder to a mapped drive
Fix ID: 1589016
Symptom: "Error 1327. Invalid Drive" error is displayed during the installation of Symantec AntiVirus 10.2 for Windows Vista.
Solution: For full details see readme_sep.txt section titled "Installing to a reassigned Documents folder displays Invalid Drive error message".

Temporary Files should not be opened during automatic scan after updating virus definitions
Fix ID: 1525749
Symptom: An auto-protect detection is triggered upon opening a temporary file (DWH****.tmp) that was created by an automatic scan after updating virus definitions.
Solution: For full details see readme_sep.txt section titled "Temporary Files should not be opened during automatic scan".

Hardware change may create duplicate clients in Default group
Fix ID: 1528038
Symptom: Making hardware changes to a client computer that is in a group synchronized with Active Directory might cause the client to be duplicated and registered to the Default group.
Solution: For full details see readme_sep.txt section titled "Hardware changes might create duplicate clients in the Default group".

Auto-location's NIC description condition is not available for dial-up connections
Fix ID: 1544958
Symptom: The auto-location NIC description is not available for dial-up connections.
Solution: For full details see readme_sep.txt section titled "Auto-location's NIC description is not available for dial-up connections".

IPv6 and Network Protection affects performance on Windows Vista virtual machines
Fix ID: 1545253
Symptom: On virtual machines running Windows Vista, copying large files to network shares might take longer when Symantec Endpoint Protection NTP (Network Protection) is enabled.
Solution: For full details see readme_sep.txt section titled "IPv6 and Network Protection affects performance on Windows VISTA virtual machines".

Maintenance Release 4 Maintenance Pack 1a (MR4 MP1a)
Symantec Endpoint Protection MR4 MP1a provides a fix for a specific problem that occurred in MR4 (11.0.4). This maintenance pack cannot be installed over any versions of Symantec Endpoint Protection or Symantec Endpoint Protection Manager prior to MR4. It must be installed over MR4 or MR4 MP1.

Components updated in this release

Component	Version
Symantec Endpoint Protection	11.0.4014

Fixes in this release
Symantec Endpoint Protection: Firewall
After installing MR4 MP1, when a networked application is run, all connections to the client computer are dropped.
Fix ID: 1530477
Symptom: Client loses network connectivity when Network Threat Protection is installed and an application is launched from a UNC path.
Solution: API calls from the thread which were causing firewall deadlocks have been fixed.

Maintenance Release 4 Maintenance Pack 1 (MR4 MP1)
Symantec Endpoint Protection MR4 MP1 (11.0.4010) and Symantec Network Access Control MR4 MP1 (11.0.4010) provide customer fixes since the release of MR4 (11.0.4). This maintenance pack cannot be installed over any versions of Symantec Endpoint Protection or Symantec Endpoint Protection Manager prior to MR4. It must be installed over Maintenance Release 4.

What's in this release
This Maintenance Pack resolves in-field reported issues within Symantec Endpoint Protection client, Symantec Network Access Control client, and Symantec Endpoint Protection Manager. These release notes also list updated and new Readme items for this release.

Components in this release

Component	Version
Symantec Endpoint Protection	11.0.4010
Symantec Network Access Control	11.0.4010
AutoProtect	10.2.8
LiveUpdate	3.3.78
ccEraser	108.2.2.8
Avengine	20081.2
SyKnAppS	2.5.12
SymEvent	12.5.3.2
DecABI	1.1.1.39
ECOM	61.3.0.17
Defutils	3.3.20.0
LiveUpdateAdmin	2.2.1.13
Microdefs	2.5.37.0
SymNetDrv	7.2.3.302
Common Client	6.3.8.004
Behavior Blocking	3.3.7.15
COH	6.1.8.8
QServer	3.6.16
Teefer2	11.0.697
WpsHelper	11.0.717.804
VxMS	5.2.0

Product fixes by category:

Symantec Endpoint Protection: Antivirus/Antispyware

After restart, communication between the client and Symantec Endpoint Protection Manager is not established.
Fix ID: 1443855
Symptom: Communication is not established immediately, or drops intermittently after restart.
Solution: Registration information and the last known connected server are now saved in the registry on client shutdown.

Large PowerPoint files open slowly with Symantec Endpoint Protection Auto-Protect enabled.
Fix ID: 1432356
Symptom: It takes several minutes for a 5MB or larger Power-Point file to completely open on Vista.
Solution: Fixed with an update to the Auto-Protect component.

"Tamper protection alert" appears after upgrading from an older version.
Fix ID: 1395857
Symptom: Tamper Protection alert pops up near the end of installation.
Solution: Fixed with an update to the Behavior Blocking component.

Symantec Endpoint Protection clients using the Outlook Scanner are unable to preview JPEG images sent from a Macintosh.
Fix ID: 1461975
Symptom: Clients using the Outlook Scanner for Symantec Endpoint Protection are unable to preview JPEG images sent from a Macintosh machine.
Solution: Implemented a check if this attachment is AppleDouble-encoded. If it is, it is not saved, allowing Outlook to handle it.

LiveUpdate cannot update the virus definitions after an old Intelligent Updater is applied.
Fix ID: 1407607
Symptom: Applying an Intelligent Updater of a couple weeks or older will prevent LiveUpdate from updating virus definitions.
Solution: Fixed with an update to Intelligent Updater.

Symantec Endpoint Protection client uninstallation does not remove LiveUpdate from the system in some migration patterns.
Fix ID: 1441612
Symptom: After an unmanaged 11.0 MR2 Symantec Endpoint Protection client is migrated to 11.0 MR2 MP2 and uninstalled, Live Update will be left on the machine.
Solution: LiveUpdate is now removed correctly upon uninstallation.

Opening Microsoft Word 2007 "docx" files on Windows Vista takes longer than on Windows XP.
Fix ID: 1399868
Symptom: Noticeable delays occur when trying to open Microsoft Word 2007 "docx" files on Windows Vista.
Solution: Fixed with an update to the Auto-Protect component.

Veritas clustering is unable to fail over due to Symantec Endpoint Protection locking volumes.
Fix ID: 1439705
Symptom: Attempts to take a server offline are initially possible but cease to work after an undetermined length of time. Once you stop the Symantec Endpoint Protection service, taking the server offline works correctly again.
Solution: Fixed in an update to the Common Client component.

After uninstalling Symantec Endpoint Protection and restarting, some registry keys still exist.
Fix ID: 1223463
Symptom: After uninstalling Symantec Endpoint Protection and restarting, some registry keys are left behind in the HKEY_CURRENT_USER hive.
Solution: Added custom action to Symantec Endpoint Protection installer to enumerate and delete necessary registry keys during uninstall.

LUALL CPU usage of 50% and memory size increases until system stops responding when LiveUpdate launches via a schedule.
Fix ID: 1473616
Symptom: LUall.exe consumes CPU and memory starting at 50% until the system stops responding.
Solution: Fixed hard loop when certain scenarios or states are detected during LiveUpdate.

Offline Microsoft Office files opening as "corrupt" or "encrypted."
Fix ID: 1442180
Symptom: When opening Office documents, the Office file conversion assistant will open and show what appears to be a corrupted (or encrypted) document.
Solution: Fixed with an update to the Auto Protect component.

Workstation freezes when copying over a network share.
Fix ID: 1383615
Symptom: Copying files over a network share freezes the share or the workstation.
Solution: Fixed with an update to the Behavior Blocking component.

When migrating from Symantec AntiVirus 10.1.7, the installation pauses for up to five minutes at the end of the installation before completing.
Fix ID: 1423539
Symptom: When migrating from Symantec AntiVirus 10.1.7 to Symantec Endpoint Protection 11.0 MR2, MR3, or MR4, the installation pauses for about 5 minutes at the end of the installation before actually completing.
Solution: Improved the checks for proper registry key settings.

Outlook Auto-Protect corrupts files with Unicode characters in the file name.
Fix ID: 1405173
Symptom: Attachments with Unicode file names appear empty.
Solution: If the file name passed to the Outlook Plug-in is invalid, Auto-Protect now lets Outlook write the attachment.

MSL crash in Common Client.
Fix ID: 1407121
Symptom: Logs show MSL crash in component Common Client 6.3.7.
Solution: Fixed with an update to the Common Client component.

UPHClean points to RTVScan.exe as the root cause of a profile unloading issue on Windows 2000 Professional.
Fix ID: 1484409
Symptom: RTVscan does not shut down within the time allowed by the Windows 2000 system shutdown, causing a Userenv error.
Solution: Added extra checks to verify if COM already initialized.

Cleanwipe tool prompt asks, "Do you want to uninstall Windows related files that Symantec installed?"
Fix ID: 1469385
Symptom: Cleanwipe presents a confusing prompt which asks, "Do you want to uninstall Windows related files that Symantec installed?".
Solution: The prompt text has been changed to "Do you want to uninstall the files that Symantec installed under the Windows directory, if removing these files will not harm your system?"

When Cleanwipe runs silently, the blank DOS box does not indicate that the tool is working.
Fix ID: 1469470
Symptom: When Cleanwipe runs silently, the blank DOS box does not indicate that the tool is working.
Solution: New command line parameter -showprogress is added, which displays verbose output to the command window.

When Scheduled LiveUpdate configuration is used from the Symantec Endpoint Protection user interface, it is saved incorrectly.
Fix ID: 1484916
Symptom: Set the weekly LiveUpdate schedule to a particular day. Re-open the LiveUpdate schedule dialog to see the day moved back 2 days.
Solution: While saving the schedule in the registry, convert the local day index to the Symantec Endpoint Protection day index.

USB hard drives can't be safely removed after context menu scan completes successfully.
Fix ID: 1410194
Symptom: After running a scan with default settings, an attached USB hard drive can no longer be safely removed. If you terminate RTVScan.exe, you can then safely remove the drive.
Solution: Fixed in an update to the Common Client component.

Symantec Endpoint Protection displays two Symantec Tamper Protection Alerts when installing Backup Exec over the network.
Fix ID: 1473579
Symptom: Tamper Protection Alerts occur during Backup Exec installation.
Solution: Network installation no longer triggers Tamper Protection alerts.

Symantec Endpoint Protection patching may cause "Resolve Source" after LiveUpdate of WpsHelper.
Fix ID: 1505190
Symptom: Patching Symantec Endpoint Protection 11.0 may result in a "Resolve Source" during the patch process.
Solution: Added WpsHelper to the full file patch list.

High Explorer.exe CPU usage when touching exported Symantec Endpoint Protection client package.
Fix ID: 1470577
Symptom: Explorer.exe has high CPU usage in Task Manager.
Solution: Fixed in an update to the Auto-Protect component.

Symantec Endpoint Protection: Firewall

A managed Symantec Endpoint Protection client displays a "Collect User Info" pop-up before the delay time has elapsed.
Fix ID: 1455613
Symptom: User information collection pop-up reappears, even though the delay time has not elapsed after logging in again or restarting.
Solution: Save the delay time to Registry on firewall service stop, and restore its value on firewall service start.

The Driver_Level_Protection_(DLP) doesn't work even when the option shows normal in Profile.xml.
Fix ID: 1481759
Symptom: Cannot block IPX packets.
Solution: Updated the handling of IPX packets.

SMC.EXE application crashes when more than 16 DNS servers are configured in the TCP/IP properties.
Fix ID: 1471456
Symptom: If a user creates more than 16 DNS servers, SMC.exe will crash.
Solution: Add the boundary check when copying DNS servers from Netport to SMC.

Teefer driver is still shown under network properties after upgrade to Symantec Endpoint Protection 11.0 MR3 or later.
Fix ID: 1293420
Symptom: Teefer2 driver appears in the network properties.
Solution: Teefer2 driver no longer appears in the network properties.

Microsoft Expression Design 2 will not start when Application and Device Control policy is enabled.
Fix ID: 1482773
Symptom: This .NET program crash when Application and Device Control is enabled.
Solution: Updated a Symantec driver to prevent the crash.

Application and Device Control causes custom application to fail on Windows 2000 computers.
Fix ID: 1470672
Symptom: If Application and Device Control is enabled, "TASKING EDE" will fail to start on Windows 2000 SP4.
Solution: Updated a Symantec driver to prevent the error.

Portscan detections are inconsistent.
Fix ID: 1456195
Symptom: Some port scan parameters result in inconsistent detections.
Solution: Check all the TCP packets, regardless of the TCP flags.

Application and Device Control causes Inova Lightlink software to fail.
Fix ID: 1472582
Symptom: If Application and Device Control is enabled, Inova Lightlink software crashes.
Solution: Application and Device Control was corrected to support such .NET applications.

Unable to connect to any shares on Windows XP with Symantec Endpoint Protection MR 3 or later installed and Network Threat Protection enabled on Japanese-language operating system.
Fix ID: 1447741
Symptom: On a Japanese language Windows XP operating system, ports 139 and 445 are blocked by default after Symantec Endpoint Protection 11.0 is installed. This does not occur on English Windows XP.
Solution: Added TCP and UDP rules for file sharing.

Symantec Endpoint Protection Manager Quick Reports show OS codes instead of OS names.
Fix ID: 1447318
Symptom: Client inventory report shows an odd entry.
Solution: Added appropriate localization entry for Windows 2003 Enterprise Domain Controller and Windows 2000 Advanced Server Domain Controller.

Pillar Trim application does not start when Symantec Endpoint Protection is installed.
Fix ID: 1482423
Symptom: This .NET program will crash when Application and Device Control is enabled.
Solution: Application and Device Control was corrected to support such .NET applications.

Application rules do not persist after restart.
Fix ID: 1447262
Symptom: Once a user chooses which applications to allow or deny, they are added to the application list. This list is cleared when the computer is shut down. The user is presented with the alerts again the next time the applications are started
Solution: Application rules now persist across restart.

VNCon application will not start when Application and Device Control policy is enabled.
Fix ID: 1473568
Symptom: VNCon application cannot run when the Application and Device Control Policy is in effect.
Solution: Updated a Symantec driver to allow the application to run.

If only one Symantec Endpoint Protection client exists, the client is unable to establish communication with Symantec Endpoint Protection Manager.
Fix ID: 1486698
Symptom: A single client cannot communicate with the server.
Solution: Improved handling of a single client count.

Application and Device Control conflicts with DMES software.
Fix ID: 1477161
Symptom: With Application and Device Control enabled and when DMES is running, the newly launched Internet Explorer will hang.
Solution: A Symantec driver was modified to allow the application to run.

Fingerprint no longer takes effect when an .exe file is moved to a new folder and the folder is re-named.
Fix ID: 1295598
Symptom: With OS Protection enabled, add a rule to block an application running with file fingerprint. When renaming the folder containing the application the rule doesn't work.
Solution: Fixed in OS Protection block rules.

SMB protocol traffic is sent to the detection engine with a 1-6 minute delay.
Fix ID: 1480679
Symptom: SMB protocol traffic triggers the Intrusion Protection signature, but traffic to the IPS engine is delayed by 1-6 minutes.
Solution: Fixed in a component update.

Computer stops responding with a blue screen while the computer is idle.
Fix ID: 1480602
Symptom: Computer stops responding with a blue screen while the computer is idle.
Solution: Fixed in a component update.

Port client connection timeout from Symantec Endpoint Security Maintenance Release 3.
Fix ID: 1486881
Symptom: Client timeout value for establishing connection with the server to download client packages is low and causes frequent failures, particularly if the network is slow between the client and Symantec Endpoint Protection Manager.
Solution: Increased timeout value.

Symantec Endpoint Protection continues downloading the same definition file when the disk is full.
Fix ID: 1472608
Symptom: Even when the disk space is full, the client will make attempts to download and apply LiveUpdate content.
Solution: Roughly estimate how much disk space is required before attempting the content download.

Cannot configure Veritas Cluster Service (VCS) when Symantec Endpoint Protection is present.
Fix ID: 1487863
Symptom: Cannot configure VCS with Symantec Endpoint Protection present.
Solution: A Symantec driver was modified to allow the application to run.

Symantec Endpoint Protection Manager

Limited Administrator scheduled reports can become "invisible."
Fix ID: 1472513
Symptom: Limited Admin's Scheduled reports can become "invisible."
Solution: Kept the "created by" field when updating a report.

Auto-refresh of Computer Status Logs causes different logs to be shown.
Fix ID: 1469309
Symptom: When viewing the Computer Status Logs with the count per page at 1000 entries, enable auto-refresh at 30 second intervals. After a refresh, the row count drops dramatically (between 20-30). The full list is restored if auto-refresh is disabled.
Solution: All entries are now viewable when auto-refresh is enabled.

Server certificate is missing from the client's Sylink.xml.
Fix ID: 1472560
Symptom: Some Symantec Endpoint Protection Manager sites and server certificates are missing in sylink.xml.
Solution: Symantec Endpoint Protection Manager was modified to resolve the problem.

Configured Notifications fail to be created as expected.
Fix ID: 1446178
Symptom: No Application Device Control events trigger notifications, even when the option is configured.
Solution: Added a new attribute to policies for checking whether a notification should be sent.

Cannot open location-independent policies and settings for certain Symantec Endpoint Protection Manager client groups.
Fix ID: 1474607
Symptom: Clicking Clients > Policies > General Settings does nothing.
Solution: Get default attribute value if Symantec Endpoint Protection Manager cannot get optional one.

In the Computer status log, the sort function does not work for the "Infected" column.
Fix ID: 1453826
Symptom: In the Computer status log, the sort function does not work for the "Infected" column.
Solution: Added a sort function to column "Infected."

After repair, Symantec Endpoint Protection Manager malfunctions in some environments.
Fix ID: 1470381
Symptom: User cannot log into the console after the installation is repaired.
Solution: Back up files and restore them later, so that those files are always kept during repair and migrate installations.

Replication fails after deleting the default domain.
Fix ID: 1458968
Symptom: Replication fails after deleting the default domain.
Solution: Bypass conflicting check when policy and policy component's Symantec Endpoint Protection Manager domain is deleted; add more null pointer checking.

Firewall rules keep inheriting from the parent when opening the child firewall policy for editing.
Fix ID: 1449215
Symptom: The rules in parent group keep growing when editing a subgroup firewall policy.
Solution: Rules from the parent group are no longer saved.

Virus Definition Distribution reports show many different sequence numbers for the same date/revision definitions.
Fix ID: 1440933
Symptom: The Reports > Computer Status > Virus Definitions Distribution report shows 0 and XXXX(sequence number) for the same date/definitions.
Solution: Removed the sequence from the grouping in the virus definitions report.

When viewing a LiveUpdate policy, the "Last Modified" entry actually reflects when the policy was created.
Fix ID: 1454394
Symptom: When you update the LiveUpdate Policy or LiveUpdate Content Policy, the "Last Modified" entry is not updated.
Solution: Added code to update the LiveUpdate Policy and Content Policy.

Slow Symantec Endpoint Protection Manager performance when assigning policies to a large number of groups.
Fix ID: 1454359
Symptom: The console takes a long time when assigning policies to a large number of groups.
Solution: Optimized code to remove unused objects and improve efficiency of queries.

Console freezes when opening Policies tab in Symantec Endpoint Protection Manager.
Fix ID: 1443849
Symptom: After replication, when switching to the policy tab, the policy tab will freeze or show wrong group information.
Solution: When doing replication, if there are any other schemas, reference to them to eliminate hangs or incorrect data.

Configured Notifications fail to be created as expected.
Fix ID: 1459053
Symptom: On Symantec Endpoint Protection Manager, even if the "alert" flag has been set, no logs can be received from the client when an Operating System Protection policy is sent.
Solution: Import "Alert" flag and copy this alert to registry.

Heartbeat time configuration not synchronized with client number in the client group.
Fix ID: 1473493
Symptom: If client-number/heartbeat is greater than 1000 in a one-minute timeframe, there will be communication problems.
Solution: Added a warning dialog for short heartbeat settings.

Symantec Endpoint Protection Manager query to SQL database is causing a very high CPU spike.
Fix ID: 1460880
Symptom: A very high CPU spike appears in the task manager.
Solution: Resolved a JDBC issue.

Upgrade failure from Symantec Sygate Enterprise Protection MR9 to Symantec Endpoint Protection when the Manager has multiple domains.
Fix ID: 1407636
Symptom: Error occurs during upgrade.
Solution: Detect and clean up broken data before upgrade.

Possible broken link after replication.
Fix ID: 1480062
Symptom: Error: "No SemAgentPolicy GUID in Group Policy."
Solution: When updating a group policy, update all the references' USNs so that they will be replicated together.

Copied or moved Active Directory user continues to use the policy from the original group.
Fix ID: 1453632
Symptom: Cannot register the client when there are duplicate clients with the same hardware key.
Solution: Added source to register to the client ID marked first to eliminate this problem.

After installing Symantec Endpoint Protection Manager on Windows XP Professional, there are two performance objects for "memory," and their counters have been changed.
Fix ID: 1198477
Symptom: Two "Memory" performance objects appear when using Performance Monitor tool.
Solution: Added registry values needed in the Symantec Endpoint Protection Manager installer.

Replication server is missing partner's certificates.
Fix ID: 1472563
Symptom: Some Symantec Endpoint Protection Manager sites and server certificates are missing in sylink.xml.
Solution: Added source during replication process to help resolve the broken link during upgrade process.

Replication error when trying to resolve a conflict.
Fix ID: 1481287
Symptom: Replication fails after deleting default domain.
Solution: Fixed conflicting check when policy and policy component's Symantec Endpoint Protection Manager domain is deleted.

Unexpected console error 0x80010000 when unchecking Inherit Policies from the client policy tab in Symantec Endpoint Protection Manager.
Fix ID: 1449208
Symptom: Error: "No SemAgentPolicy GUID in Group Policy."
Solution: When updating a group policy, update all the references' USNs so that they will be replicated together.

After replication, all Symantec Endpoint Protection Manager data on the client is marked as deleted when one record is deleted at its partner.
Fix ID: 1488176
Symptom: Version will be different between partners.
Solution: Added source during the replication process ensuring correct data deletion and avoiding making other data deletion errors.

Non-English users see English text describing a Host Integrity condition.
Fix ID: 1470295
Symptom: Non-English users see English text describing an HI IF condition.
Solution: Provided translatable string for description.

Symantec Endpoint Protection Manager service stops when unchecking Policy inheritance for client group.
Fix ID: 1482253
Symptom: Symantec Endpoint Protection Manager server stops when unchecking Policy Inheritance feature.
Solution: Added source to avoid recursive calls.

Unable to complete the migration to Symantec Endpoint Protection 11.0 from Symantec Sygate Enterprise Protection 5.1.
Fix ID: 1485857
Symptom: Exception errors during upgrade.
Solution: Problematic exception has been removed.

Console input field is one character too short .
Fix ID: 1461702
Symptom: The console input field is incorrect.
Solution: Now users can input a value equal or less than 4294967295(0xffffffff), same as the behavior of Registry Editor.

Static date is displayed in Symantec Endpoint Protection Manager client installation package pane after migration.
Fix ID: 1499357
Symptom: Creation Time column shows static date "January 9, 2009 4:35pm EST" for all packages created after migration.
Solution: Set "Created Time" as current time during upgrade.

Reports show conflicting IPS dates after replicating Symantec Endpoint Protection Managers via Computer Status report: IPS distribution.
Fix ID: 1447222
Symptom: Reports show conflicting IPS dates.
Solution: Removed the offending string and reset USN for all the tables which cannot be replicated during upgrade from MR4 to MR4 MP1.

Hourly Scheduled Replications fails with "String index out of range: -1"
Fix ID: 1476198
Symptom: Scheduled replication causes failure.
Solution: Corrected the string index to resolve the issue.

Symantec Endpoint Protection Maintenance Release 3 service crashes when exporting a client package.
Fix ID: 1457431
Symptom: After replicating a site, an "Invalid Management Server List" error occurs when trying to export a client installation Package from a group that is originally communicating with the deleted site.
Solution: In "Export Client Install Package", a dialog box is displayed asking the user to select a valid Management Server List to be used for the group if it is invalid. The dialog box will be displayed for any group having an invalid server list. In "Delete Remote Site", a dialog box is displayed preventing the user from proceeding if its default Management Server List is still being used by any group. In "Policy Summary Panel", before displaying the Communications Setting dialog, a dialog box is displayed if the Management Servers list is invalid for that group.

When you navigate to the Monitors > Logs > Risk log and sort by User, only the first page sorts correctly.
Fix ID: 1483276
Symptom: Navigate to Monitors > Logs > Risk and view the Risk log. Sort by User Name. Only the first page sorts the User Names, not additional pages of user names.
Solution: Added sort function to the logs for multiple pages.

Incorrect IPS failure information and computer count in the database.
Fix ID: 1488007
Symptom: IPS failure information or computer count is different between partners when there is deleted Symantec Endpoint Protection Manager content.
Solution: Enhanced filtering when there is deleted Symantec Endpoint Protection Manager content.

Symantec Endpoint Protect Manager LiveUpdate cannot install virus definitions when it matches LuDownloadedContentArray.xml.
Fix ID: 1478558
Symptom: Cannot install virus definitions.
Solution: Changed the .xml file to eliminate this issue.

Clients managed by other replication partners indicate no definitions are present when viewing the client properties.
Fix ID: 1456697
Symptom: When clients are viewed from replication partners besides their own manager, the clients show "no definitions" or different versions.
Solution: Removed the offending string and reset USN for all the tables which cannot be replicated during upgrade from MR4 to 11.0 MR4 MP1.

Cannot select some groups in the advanced settings for computer status logs with long nested OUs.
Fix ID: 1483311
Symptom: In Computer Status Logs Advance Setting, Group drop-down list, when you mouse over a group, it jumps to the top of the list of the drop-down.
Solution: Since the horizontal scrollbar is available for longer OU names, resolved this by preventing the content from wrapping to the next line.

Symantec AntiVirus Corporate Edition changes to "AhnLab V3 Internet Security" in custom Host Integrity policies.
Fix ID: 1503283
Symptom: You see "AhnLab V3 Internet Security" selected instead of the expected choice "Symantec Endpoint Protection" in policies that were migrated from SPM 5.1 MR8.
Solution: The UI was changed to accept both values, which now correctly map to "Symantec Endpoint Protection."

Replication failure between SQL 2000 and embedded database.
Fix ID: 1481901
Symptom: SQL exception occurs because Primary Key is not unique.
Solution: Saved the multi-key in all columns for the table and added a cache.

Symantec Endpoint Protection Manager 11.0 Maintenance Release 3 policies do not update.
Fix ID: 1502048
Symptom: Broken link produced when trying to edit a command scan via Antivirus policy. You cannot open the Edit dialog, and see an exception when creating a policy for groups.
Solution: Added additional policy checking upon creation and upgrade.

Hourly Scheduled Replications fail 3 - 4 times a day.
Fix ID: 1471437
Symptom: Replication failures can be seen in the reports.
Solution: Eliminated possible deadlocks.

The "agentinfo" folder does not get processed after 00:00 AM.
Fix ID: 1476443
Symptom: You see "java.lang.OutOfMemoryError" in the scm_server.log
Solution: Merged two SQL statements into one to avoid putting compliance IDs into memory.

Replication partner cannot be set up again after migration from Symantec Sygate Enterprise Protection 5.x MR 9 to Symantec Endpoint Protection.
Fix ID: 1501797
Symptom: Replication couldn't be set up again after upgrade.
Solution: Fixed code so that it will handle the case of upgrade from 5.X.

The "Command" column data does not sort correctly within the Command Status page.
Fix ID: 1504788
Symptom: In the Command Status result page the "Command" column data does not sort correctly.
Solution: Re-sort the "Command" in PHP code.

Symantec Network Access Control

SNAC.exe takes up to 100% CPU.
Fix ID: 1474538
Symptom: SNAC.exe takes up to 100% CPU on single CPU computers after migration to MR4. Can take up to 50% CPU usage on dual core CPU.
Solution: Removed an event handler which will reset the triggered event. When this issue happens, restarting the computer resolves this issue.

Symantec transparent mode settings cannot be saved. After restart it resets to PEAP authentication type.
Fix ID: 1476298
Symptom: If the user selects "Symantec NAC Transparent Mode" in the network property window, the setting is lost after restart.
Solution: Made corrections within the registry.

DHCP Plug-in Enforcer cannot get entire serverprofile.xml with 16,000 trusted MAC addresses from Symantec Endpoint Protection Manager.
Fix ID: 1465088
Symptom: Policy is not effective in Integrated Enforcer if the policy contains large numbers of trusted MAC addresses.
Solution: Use dynamic memory to receive policy from Symantec Endpoint Protection Manager.

Sylink module crashes during auto-upgrade.
Fix ID: 1487223
Symptom: Sylink crashes during upgrade.
Solution: Improved the object handling.

Readme items

Peer to peer enforcer authentication doesn't work.
Fix ID: 1483085
Symptom: Peer-to-peer authentication and host integrity policies block access to shared folders.
Solution: For full details see the readme_sep.txt or readme_snac.txt section titled "Peer-to-peer authentication and host integrity policies block access to shared folders."

Client fails to show tray icon when "Display the notification area icon" is checked.
Fix ID: 1483345
Symptom: Missing tray icon.
Solution: For full details, see the readme_sep.txt or readme_snac.txt section titled "Icons do not display in system tray."

Maintenance Release 4 (MR4)

What's in this release
Symantec Endpoint Protection Manager now supports Windows 2008 Server. Symantec Endpoint Protection Manager now supports the following versions of Windows 2008 Server (all applicable 32-it and 64-bit versions): Windows Server 2008 Standard, Enterprise, DataCenter, Web, Small Business Server (Standard and Premium), and Essential Business Server (Standard and Premium).

Specific Symantec Endpoint Security features include:

The ability to resume downloads for maintenance releases and patches.
The addition of traffic bandwidth configurations for the Group Update Provider (GUP).
Support for 640 x 480 screen resolution.

Specific Symantec Network Access Control features include:

On-demand Agent can now be downloaded from Firefox version 3.
Persistence options allow the On-demand Agent to stay on the client machine for a specified period of time. Without this option the agent is uninstalled when the computer restarts.

Components in this release

Component	Version
Symantec Endpoint Protection	11.0.4
Symantec Network Access Control	11.0.4
AutoProtect	10.2.7.11
Live Update	3.3.0.69
ccEraser	108.2.2.8
Avengine	20081.2
SyKnAppS	2.5.12
SymEvent	12.5.3.2
DecABI	1.1.1.39
ECOM	20081.2
Defutils	3.3.20.0
LiveUpdateAdmin	2.2.1.13
Microdefs	2.5.32.0
SymNetDrv	7.2.3.302
Common Client	106.3.7.9
Behavior Blocking	3.3.7.4
COH	6.1.8.8

Product fixes by category:

Symantec Endpoint Protection: Antivirus/AntiSpyware

A Full Scan with compressed files level set to 1 reports 0 files scanned.
Fix ID: 1371190
Symptom: On the client UI, the total files scanned count either reflects an incorrect value or 0 (if the count was negative).
Solution: Do not decrement the total scanned files count for files in archives past the maximum file scan depth.

Miscellaneous files such as - slu****.tmp, mdf****.tmp, and CValidateCom.txt files are generated in Temp folder.
Fix ID: 1298906
Symptom: Temp folders are left over in the Windows Temp folder.
Solution: Delete Temp folder files.

Temp files left over in the 7.5 folder after scans.
Fix ID: 1405018
Symptom: After a scan, Symantec Endpoint Protection does not clean up all temporary files from the "7.5" folder.
Solution: The heuristic scan engine was incorrectly holding on to the temporary files in the 7.5 folder during the scan. Modified the engine to prevent this issue from occurring.

SymCorpUI error when trying to do a Symantec Endpoint Protection scan in safe mode on Windows 2000 SP4.
Fix ID: 1300088
Symptom: After clicking Scan Now,a "SymCorpUI error" message appears, after which the "Run active" scan doesn't work.
Solution: Passed API calls check in Win2k safe mode (without networking).

Location-based scans that are defined in the policy trigger when locations switch.
Fix ID: 1380226
Symptom: Having a scheduled scan in one location but not another results in the scan being triggered incorrectly.
Solution: Fixed incorrect scan entries in the registry for these scheduled scans.

Auto-Upgrade installation rolls back with Error 1308: Source file not found on OEHeur.dll.
Fix ID: 1371851
Symptom: Client installations may fail while re-creating the delta package, or attempting to install a bad full package.
Solution: Implemented better error checking to ensure that a good client package folder is created. If installations are failing, it is suggested that the 'full' directories corresponding to the package are removed.

Installation fails when installing as part of Windows XP unattended install.
Fix ID: 1383539
Symptom: Installation of Symantec Endpoint Protection as a part of an unattended Windows XP installation rolls back.
Solution: Corrected registration of Symantec Endpoint Protection components with LiveUpdate during installation.

Possible hang/crash after applying Active Directory folder exclusions on the server.
Fix ID: 1406310
Symptom: After applying Active Directory folder exclusions on the server and during scanning of the system files, NTDS may encounter a hang or crash.
Solution: This hang was caused by Auto-Protect trying to read from certain files. The hang occurred when Auto Protect does a scan of files in the clean file cache when new virus definitions arrive. This is resolved by disabling the Rescan the cache option by navigating to: AntiVirus/AntiSpyware Protection Settings > File System Auto-Protect > Advanced File Cache > Rescan the cache when new definitions load.

File backups are at least 80% slower with Symantec Endpoint Protection installed.
Fix ID: 1275606
Symptom: Poor backup performance when Symantec Endpoint Protection is installed.
Solution: Modified the engine to prevent this issue from occurring by skipping files opened with backup semantics.

The Symantec Endpoint Protection client interface wraps to the second monitor.
Fix ID: 1304016
Symptom: Parts of the window are seen on the second screen.
Solution: Resized the main frame to fit the display area of the first screen.

64-bit clients are sending Tamper Protection status to Symantec Endpoint Protection Manager as "Off" rather than as "Not Installed."
Fix ID: 1412863, 1098328
Symptom: Symantec Endpoint Protection Manager shows Tamper Protection as Off rather than as Not Installed.
Solution: Added new interface registration information to the installer.

Custom service written in .NET bloats memory usage with Proactive Threat Protection installed.
Fix ID: 1438181
Symptom: If the Windows service CMISImageHandler.exe is running, Symantec Endpoint Protection service grows from 14MBs to 68-71MBs.
Solution: Resolved through a Confidence Online component update.

Application Error after a push install.
Fix ID: 1361697
Symptom: During push install process, user receives an error.
Solution: This was caused by a timing issue during service shutdown. Added improvements to the cleanup process and added sanity checks to prevent this from happening again.

Windows Security Center status is not updated for out-of-date definitions until a service cycle.
Fix ID: 1405083
Symptom: Windows Security Center will not show correct status until the computer restarts.
Solution: The definition status in Windows Security Center is now updated every 60 minutes.

Symantec Endpoint Protection service starts and stops repeatedly on Windows 2000 Terminal Server.
Fix ID: 1179755
Symptom: Repeated service starts and stops on Windows 2000 Terminal Server.
Solution: Fixed NULL parameter causing the problem.

The scroll bars at the bottom are slightly off the screen on the client.
Fix ID: 1304020
Symptom: Parts of the window are seen on the second screen.
Solution: Resized the main frame to fit the display area of the first screen.

User registry hive in Symantec Endpoint Protection 11 MR 2 MP 2 and newer is locked after logging off of a RDP session.
Fix ID: 1431936
Symptom: An error in logs states Symantec Endpoint Protection is holding on to the user hive registry.
Solution: Disabled the scheduled scan service notify thread.

Cannot save changes in Word 2000 files to FDD.
Fix ID: 1201116
Symptom: Word cannot complete the save due to a file permission error.
Solution: Modified the Auto Protect engine to prevent this issue from occurring.

Constant 5% Rtvscan CPU usage.
Fix ID: 1389006
Symptom: Constant 5% Rtvscan CPU usage seen from Process Explorer or Task Manager.
Solution: Changed to cache the state of Auto-Protect ,thus reducing excessive calls which gather state information. The state is now updated once on startup, on change notification from Auto-Protect, and occasionally on the main timer, eliminating this issue.

Symantec Endpoint Protection: Firewall

Firewall rule ignored if Description field is populated for the Application List.
Fix ID: 1284625
Symptom: If the Description field is set, the Firewall rule containing the description will not be triggered.
Solution: Modified the firewall to correctly set the appropriate flags in the registry.

CardSpace service fails to launch with client running.
Fix ID: 1417019
Symptom: While trying to start the CardSpace service, a popup message states that the service was not able to start. Errors also appear in the System Event logs.
Solution: Resolved via a component update.

Laptops with Symantec Endpoint Protection and 4GB RAM stop responding.
Fix ID: 1444613
Symptom: With Symantec Endpoint Protection installed on a laptop running Windows Vista Business 32-bit, upgrade the amount of RAM from 2-3 GB to 4GB. The laptop stops responding after 20-30 minutes.
Solution: Resolved infinite loop in the firewall code.

Sysplant blocks certain Network based apps.
Fix ID: 1430654
Symptom: IRIS Practice Software is blocked by the firewall.
Solution: Firewall now allows this software to run.

Blue Screen while Incredibuild 3.2 is in use.
Fix ID: 1431699
Symptom: With Symantec Endpoint Protection and Incredibuild 3.2 installed, the system stops responding with a blue screen.
Solution: Removed the data structure that caused the problem.

IncrediBuild 3.2 does not work unless Sysplant is disabled.
Fix ID: 1394288
Symptom: After enable OSP policy, Microsoft Visual Studio can't compile program with IncrediBuild program.
Solution: Application is now compatible.

SMCinst.exe is not replaced when Symantec Endpoint Protection or Symantec Network Access Control Client is migrated using MSI patch.
Fix ID: 1301423
Symptom: Smcinst.exe is not replaced when Symantec Endpoint Protection/Symantec Network Access Control client is migrated by MSI+MSP installation package.
Solution: Latest Smcinst.exe is added to the MSI+MSP package, and is replaced upon successful migration.

Wireless connections at 104Mb/second do not register with Location Awareness as Wireless connections.
Fix ID: 1441489
Symptom: Auto Location Awareness does not work when using 104Mbps wireless network.
Solution: Added 130Mbps/117Mbps to the list that detects when the wireless speed is not stable.

Symantec Endpoint Protection client management system logs report incorrect IP address for the Manager.
Fix ID: 1220138
Symptom: Incorrect IP address shows in the logs.
Solution: If DNS cannot resolve the hostname, incorrect IP address is not reported.

Smc.exe stops responding and reports errors citing address 0x00006ad0 under low memory conditions.
Fix ID: 1372843
Symptom: Unexpected SMC crash encountered.
Solution: Corrected the usage of the function causing the problem.

Random, limited, or no connectivity on laptops with Symantec Endpoint Protection and Juniper VPN client.
Fix ID: 1433195
Symptom: Network connections randomly have limited or no connectivity on laptops with Symantec Endpoint Protection and Juniper VPN client installed.
Solution: Fixed a deadlock issue with the SMC process.

Event "Connected to Symantec Endpoint Protection Manager (%1)" logs the wrong IP Address for the manager.
Fix ID: 1387845
Symptom: In the System log on the client, the event "Connected to Symantec Endpoint Protection Manager" reports an IP address that is not the address of the Symantec Endpoint Protection Manager.
Solution: If DNS cannot resolve the hostname, incorrect IP address is not reported.

Last Download Time field never updates.
Fix ID: 1423529
Symptom: "Last Download Time" in Symantec Endpoint Protection Manager Reports always shows "Never".
Solution: Stopped zeroing out the last content check time inadvertently and started handling situations in which the value had not changed correctly.

Google Chrome browser cannot be launched if the firewall is running.
Fix ID: 1403244
Symptom: With Symantec Endpoint Protection installed, an application error occurs when launching Google Chrome.
Solution: Application is now compatible.

Errors with Google Talk Plug-in.
Fix ID: 1441738
Symptom: The Google Talk plugin cannot be launched.
Solution: Application is now compatible.

Symantec Endpoint Protection Application and Device control prevents Wild Tangent software from running.
Fix ID: 1422627
Symptom: After clicking "PLAY" button, "FATE.EXE" crashes.
Solution: Application is now compatible.

Firewall rules configured to "ASK" do not log incoming traffic.
Fix ID: 1363282
Symptom: No incoming traffic is logged when configuration option is set to Ask.
Solution: Fixed code that could not find the Process ID or App name.

There is no dialog warning that Application and Device Control will not function unless TruScan is installed at install time.
Fix ID: 1238501
Symptom: Application and Device Control will not function unless TruScan is installed.
Solution: Removed dependency on TruScan.

C++ runtime errors with Think Vantage Client Security Solution for Vista.
Fix ID: 1267801
Symptom: Smc.exe crashes on boot up or service restart on Vista Enterprise laptops.
Solution: Added the appropriate flag to avoid crashes and security issues.

Unable to run whois from within Symantec Endpoint Protection client Traffic logs successfully more than once.
Fix ID: 1370712
Symptom: Running whois from within Symantec Endpoint Protection client Traffic logs successfully more than once is not possible.
Solution: Every time the detail dialog box was opened, the UI sent two requests. The issue was resolved by sending only one request.

Application "Calyx Point" will not run with Sysplant enabled.
Fix ID: 1408234
Symptom: Winpoint crashes when launched.
Solution: Application is now compatible.

Sysplant does not allow MATLAB 2008a software to launch.
Fix ID: 1389109
Symptom: Run the Matlab exe. After two error message boxes, the process exits.
Solution: Do not allow sysfer.dll into "matlab.exe" process.

The firewall prevents the 3G HSDPA connection adapter from properly disconnecting.
Fix ID: 1284609
Symptom: Attempts to re-establish a VPN connection with the client fail.
Solution: Added additional checks on known ports used by 3G card driver allowing connections.

"Block all traffic until firewall starts" prevents Vista hibernation.
Fix ID: 1383703
Symptom: Configuring Symantec Endpoint Protection firewall to "Block all traffic until firewall starts and after firewall stops" will prevent Vista from sleeping or hibernating.
Solution: Component update resolved this issue.

Application and Device Control causes Microsoft Excel to give XMLoader errors.
Fix ID: 1282072
Symptom: Unexpected results when clicking a button in Excel file.
Solution: OSP prevents some processes from being executed normally.

Event ID 6004 error appears in logs repeatedly on Symantec Endpoint Protection clients.
Fix ID: 1259196
Symptom: System log shows Event ID 6004: "A driver packet received from the I/O subsystem was invalid. The data is the packet".
Solution: Modify the WPS driver to remove the unnecessary hooking in XP.

Reverse DNS lookup sometimes does not work.
Fix ID: 1413853
Symptom: Firewall policy allowing traffic from those hosts matching a specified domain name are at times blocked by the firewall.
Solution: No matter whether the first packet is incoming from or outgoing to a remote host, if domain name is configured in rule, RDNS is triggered.

Upgrade should resume download where it left off.
Fix ID: 1369301
Symptom: If network connectivity errors are encountered, the currently downloading client package will be deleted and download will start fresh when connectivity is restored.
Solution: Package updates now use HTTP download resumption protocol.

Conflict between Symantec Endpoint Protection and Checkpoint installation.
Fix ID: 1421768
Symptom: Checkpoint's secure client (SC NGX R60 HFA2) does not finish installation and will eventually blue screen the computer if the customer has Symantec Endpoint Protection client installed.
Solution: Resolved a problem in the firewall driver.

Tamper Protection causing a deadlock when program is run from a mapped drive.
Fix ID: 1422553
Symptom: With Windows 2000 Pro SP4 and Symantec Endpoint Protection AntiVirus/AntiSpam-only client installed, the system eventually stops responding when trying to browse folders within a program called "OpenFile.exe."
Solution: Component update resolved this issue.

Apparent firewall driver memory leak.
Fix ID: 1406226
Symptom: Srtsp.sys driver memory leak and driver (ofant.sys) hangs and causes 20 other processes, including srtsp.sys, to stay locked.
Solution: This was actually an Auto Protect hang issue during file reads, not a firewall memory leak. Resolved.

Large temp files in the Symantec Endpoint Protection\LiveUpdate folder.
Fix ID: 1391636
Symptom: Large temp files produced during content delta building and content download.
Solution: Improved temp file cleanup.

SMC.exe continually accesses rasphone.pbk.
Fix ID: 1318905
Symptom: Smc.exe takes 100% of the CPU time regularly due to smc.exe accessing file rasphone.pbk.
Solution: Corrected the need for smc.exe to continually access the *.pbk.

Aventail client causes smc.exe appcrash in msvcr80.dll
Fix ID: 1432369
Symptom: Installing Aventail VPN client results in SMC crash.
Solution: Fixed a Windows APIs call failure and added a check to ensure that the call succeeded, to prevent a memory access violation.

"Disable NTP" command sent to AntiVirus/AntiSpam-only client causes Symantec Endpoint Protection tray icon to show a red X.
Fix ID: 1416668
Symptom: Sending a "disable NTP" command from Symantec Endpoint Protection Manager causes a red X to be displayed on the tray icon.
Solution: When the command to disable NTP is received by the client, it checks that the firewall is installed and no longer displays the red X.

Symantec Endpoint Protection with custom policy causes uninstallation hangs.
Fix ID: 1223775
Symptom: Using Windows XP SP2 or Vista, uninstalling with a custom policy hangs.
Solution: Component update resolved this issue.

GUP throttling enhancement.
Fix ID: 1414302
Symptom: GUP overloaded network when used across a wide area network.
Solution: Added a configurable fixed delay to reduce overload.

Blue screen error when starting computer.
Fix ID: 1434623
Symptom: Symantec Endpoint Protection 11 MR3 generated a blue screen error on startup, referencing wpsdrvnt.sys.
Solution: Corrected invalid memory condition error.

Symantec Endpoint Protection Manager

System Administrator accounts can be added and deleted but not modified through a remote Symantec Endpoint Protection Manager console.
Fix ID: 1426040
Symptom: System administrator properties and password cannot be changed remotely.
Solution: From the Symantec Protection Endpoint Manager console, you can now modify accounts.

Database administrator name and password are not encrypted during communication.
Fix ID: 1389362
Symptom: User is given the option to select Windows authentication to the database in the configuration wizard.
Solution: The security data is encrypted now.

Symantec Endpoint Protection Manager Host Integrity configuration does not have Windows Vista as an operating system selection.
Fix ID: 996535
Symptom: Windows Vista is not an available option.
Solution: Added Windows Vista to Symantec Endpoint Protection Manager Host Integrity configuration types.

Scheduled replication occurs 30 minutes earlier than expected when Symantec Endpoint Protection Manager is in IST time zone.
Fix ID: 1442805
Symptom: Scheduled replication occurs 30 minutes too soon when in IST time zone.
Solution: Server now converts time based on both hours and minutes.

Symantec Endpoint Protection Manager System Event Notifications do not report errors.
Fix ID: 1362428
Symptom: The report shows 'Nothing to report'.
Solution: Change the SQL query string used.

Copied clients are not listed as expected in non-default views of Symantec Endpoint Protection Manager console.
Fix ID: 1424210
Symptom: Copy a user or computer to the manually-created group from OU. Change the client view to one of the non-default choices (Client status, Protection technology, Network information, or Client system). The client list is blank in the imported OU and each client is listed twice in the manually-created group.
Solution: Altered the SQL query used, improving the filter query results.

Symantec Endpoint Protection Manager does not provide NTLM Authentication when running LiveUpdate.
Fix ID: 1434288
Symptom: Launching LiveUpdate from Symantec Endpoint Protection Manager, using a proxy server configured for NTLM authentication, fails.
Solution: Added a new UI check box that allows enabling the use of Windows Authentication.

Some client reports do not include all client systems.
Fix ID: 1227607
Symptom: The count of clients in some reports is incorrect.
Solution: Modified the Product Version report to show all clients, even if they are not currently reporting status or if AntiVirus is not installed. There is a separate row in the dashboard action summary to show clients that are not reporting status. There are two new rows for the Site Status Report. One row shows computers that do not have clients. One row shows clients that are not reporting status.

AntiVirus/AntiSpyware Policies for a group created during a legacy version migration can be exported but not imported.
Fix ID: 1322745
Symptom: You receive an error message: "Failed to import the policy. Error: Invalid import file".
Solution: Improved import process during migration from Symantec AntiVirus policy file or upgrading from MR3.

Slow login with Symantec Endpoint Protection and Novell client software.
Fix ID: 1447337
Symptom: With Novell client installed, logging on to the console is very slow.
Solution: Improved login time with Symantec Endpoint Protection and Novell client software installed.

New Management Server Lists default to port 80 instead of 8014 creating mismatch.
Fix ID: 1437959
Symptom: MR3 fresh install package with a policy including a non-default Management Server list. The clients that were rolled out were unable to communicate with the Manager.
Solution: Read http port and https port information at login time of Symantec Endpoint Protection Manager.

"Last scanned time" shows 1970/01/01 08:00:00 in scan report.
Fix ID: 1397861
Symptom: The last scan time show incorrect time.
Solution: Converted the time to the correct format.

Setting to accept legacy Symantec AntiVirus 10.x logs is deselected after migration.
Fix ID: 1395850
Symptom: After setting LegacySupport configuration via the Preferences dialog on the homepage and then performing an upgrade, the configuration is lost.
Solution: This preference is now honored and persists after migration.

Renaming groups in Symantec Endpoint Protection Manager does not take effect until a policy change.
Fix ID: 1416751
Symptom: Clients do not show the group name change until a policy change.
Solution: Clients now show the group name change immediately.

Status icon for client is not the correct status for all views except default via Symantec Endpoint Protection Manager.
Fix ID: 1447203
Symptom: When selecting the Default view, the Client Status shows a red arrow. When selecting other views, it changes to a green dot.
Solution: Default view now displays the accurate client status.

Event times in scheduled and alert based reports are an hour later than correct times.
Fix ID: 1299108
Symptom: Reports are an hour later than correct times.
Solution: Added a condition to determine whether the system is using daylight saving time to decide how to compute the local time.

Symantec Endpoint Protection Manager Notifications do not run batch files.
Fix ID: 1427063
Symptom: Symantec Endpoint Protection Manager Notifications do not run batch files.
Solution: Removed the function that prevented the process of batch or executable files.

Javaw.exe takes up to 90% CPU during backup, and event is not logged.
Fix ID: 1365401
Symptom: Backup task leads to 90% CPU usage and leads to Monitoring tab hangs.
Solution: Use specified cache to read and write methods and write binary files to back up zip packages. The backup tool does not support writing to a log.

SemSvc takes up to 90% CPU during backup.
Fix ID: 1365396
Symptom: Backup task leads to 90% CPU usage, and leads to Monitoring tab hangs on
Solution: Use specified cache to read and write methods and write binary files to backing up zip packages.

Symantec Endpoint Protection clients report to incorrect Symantec Endpoint Protection Managers.
Fix ID: 1418576
Symptom: Location-specific communication setting does not honor the preferred group and preferred mode. Symantec Endpoint Protection Client reports to Default Group.
Solution: While exporting a package, preferred group information and preferred mode information is set to these location-specific communication settings.

Sylink watcher log shows 400 responses when trying to download definitions from Symantec Endpoint Protection Manager.
Fix ID: 1418637
Symptom: Client receives 400 bad requests in the Sylink Watcher log.
Solution: Updated product to skip the content and package delta generation.

Symantec Endpoint Protection Manager firewall policy editor does not gracefully handle blank rule names.
Fix ID: 1301097
Symptom: If you blank a firewall rule name and click "OK". The editor warns that a name is required, but then quits without letting you make the change. If you try to import firewall rules with blank rule names, all the rules listed after the blank rule name cannot be imported into firewall policy without a warning message.
Solution: Validate firewall rule panel before updating the firewall policy. Validate input dialog if a blank rule name exists in Import Firewall Rules.

Symantec Endpoint Protection Manager "AgentInfo" folder fills with multiple .DAT files.
Fix ID: 1261236
Symptom: Symantec Endpoint Protection Manager "AgentInfo" folder fills up with .DAT event files.
Solution: Symantec Endpoint Protection Manager now better processes the events sent by the client so the folder will not fill up.

Database admin name and password are not encrypted during connection.
Fix ID: 790931
Symptom: With Symantec Endpoint Protection Manager and SQL 2000 DB installed on the same computer, during a connection from another manager to the manager with SQL installed, the database name and password are not encrypted.
Solution: Name and password are now encrypted.

Pull-down items within Symantec Endpoint Protection Manager Console show different wording.
Fix ID: 1303194
Symptom: Pull-down items within Symantec Endpoint Protection Manager console show different wording.
Solution: Improved the resource file responsible for making the display string identical with the other one, eliminating the problem.

Home, Monitors, and Reports pages are blank on the remote console after updating Java to version 1.6 Update 10.
Fix ID: 1450539
Symptom: After installing JDK or JRE 6 Update 10 from Sun, the Home, Monitors, and Reports pages are blank and will not load.
Solution: Added workaround message in Symantec Endpoint Protection Manager and Symantec Endpoint Protection Manager remote console installation page.

Symantec Endpoint Protection Manager reports generated in .MHT format display a blank page in Internet Explorer.
Fix ID: 1281050
Symptom: Symantec Endpoint Protection Manager Reports generated in .MHT format display a blank page in Internet Explorer.
Solution: By default, Auto-select is checked, which prevents this issue from occurring.

Last Update Time does not match heartbeat time.
Fix ID: 1316833
Symptom: When the client is offline, the last update time in the database does not reflect the last connect time to server. When the client is online for an extended period, the last update time may not change for quite some time. It does not post any client information to the server, and also has no state change.
Solution: Added a new task to pull the client's last update time on a more frequent basis.

Notifications are not triggered when the first Symantec Endpoint Protection Manager in an environment is stopped or removed.
Fix ID: 1421789
Symptom: Email notification does not alert.
Solution: Added a prioritized reporting server list into the site properties.

"Query Failed" when exporting log data after sorting specific columns within Symantec Endpoint Protection Manager.
Fix ID: 1381232
Symptom: "Query Failed" displays when exporting log data.
Solution: Removed duplicate columns and added a lost column in SQL query statement when performing exports.

Time Zone Offset is not listed correctly in Symantec Endpoint Protection Manager for clients whose zone has a fractional hour offset.
Fix ID: 1364622
Symptom: Time Zone Offset is not listed correctly in Symantec Endpoint Protection Manager for clients whose zone has a fractional hour offset.
Solution: The time changed on Symantec Endpoint Protection is now reflected correctly in Symantec Endpoint Protection Manager.

"Per group" option on the Virus Infection and Virus Clean reports is missing.
Fix ID: 1396514
Symptom: The Detection Action Summary report does not show the actions taken as a percentage of the total number of detections, nor does it show those statistics on a per-group basis.
Solution: The Detection Action Summary report now has a new table showing the number of repaired, suspicious, and infected detections per group. It also shows those numbers as a percentage of the total detections for any one group.

Attempting to view scans, risks, or computer status logs results in the inability to select a specific group.
Fix ID: 1407987
Symptom: The dialog box and selection control jumps back to Global.
Solution: Resolved by narrowing the width of dropdown list by 10% so that the max dropdown list width is 90%.

Report files containing Japanese characters sent from Symantec Endpoint Protection Manager are corrupted.
Fix ID: 1157909
Symptom: Scheduled report files (*.mht files) sent from Symantec Endpoint Protection Manager are corrupted.
Solution: Updated the encoding to use the correct method, eliminating the issue.

After upgrading to MR3, "Invalid log record: Too few fields" appears in logs.
Fix ID: 1416913
Symptom: Unnecessary log messages and alerts are generated.
Solution: Removed unnecessary logging

"Query Failed" displays when exporting specific log data.
Fix ID: 1426052
Symptom: This happens only when Symantec Endpoint Protection Manager uses MSSQL 2005, and does not happen if Symantec Endpoint Protection Manager uses Embedded DB. From the "Monitors" tab, any attempt to export "Log Type" Compliance Logs, Enforcer Client, Default filter, Past 24 hours, View log, or Export queries fails.
Solution: Removed the duplicate column and added a lost column in SQL query statement used during export process.

Apostrophe cannot be displayed on exported scan logs
Fix ID: 1366835
Symptom: Specific characters encoded in the first line of the exported log files are not displayed.
Solution: Fixed the display issue of specific characters in the log export.

After deployment of MR3, performance issues with Remote Consoles
Fix ID: 1437482
Symptom: Console slowness from remote consoles.
Solution: Changed default settings and attributes to resolve the performance issue.

Exported computer status logs report missing and incorrect information.
Fix ID: 1414968
Symptom: Computer status logs show complete information in Symantec Endpoint Protection Manager Monitors page, but when the data is exported, it is missing column information.
Solution: Exported logs now contain all columns and data.

Exported Scan Log summaries show End Date/time references of 12/31/1969 for some scans.
Fix ID: 1406234
Symptom: Exported Scan Log summaries show End Date-time references of 12/31/1969 for some scans.
Solution: Display the log entries with state 'In Progress' other than '12/31/1969' or '01/01/1970'.

Symantec Endpoint Protection Manager does not accurately list Active Directory OU members - Duplicate Clients in temp and OU groups.
Fix ID: 1410087
Symptom: Duplicate entries appear in temporary group and also in OU group.
Solution: Improved and optimized the replication process which handles finding and reporting the duplicate Computer Mode and User Mode entries.

When Symantec Endpoint Protection Manager is using a custom server certificate, client auto-upgrade fails.
Fix ID: 1314772
Symptom: The server certificate is an internally signed certificate using Microsoft Certificate Authority Server. The server CSR file was created using IIS to request a digital server certificate. After the CA-signed certificate was imported into IIS, the entire certificate (public and private key) was exported to a .pfx file. That .pfx file was imported into the policy manager under Admin > Servers > Manage Server Certificate. The
certificate was applied prior to any client deployments. When deploying the client , the following appears: "Signature verification error: 2148073478" "Invalid Signature."
Solution: Re-sign all of the affected files when Symantec Endpoint Protection Manager updates certificate.

Symantec Endpoint Protection Manager client status icons are displayed incorrectly.
Fix ID: 1409105
Symptom: Client online status is not shown properly.
Solution: Improved the registration of clients with Symantec Endpoint Protection Manager so that now the reporting of which clients are online is accurate.

Symantec Endpoint Protection Manager Monitor logs have incorrect packet details.
Fix ID: 1382330
Symptom: Symantec Endpoint Protection Manager Monitor logs have incorrect data.
Solution: Fixed the SQL statement used to ensure the details are correct.

Symantec Endpoint Protection clients register with Symantec Endpoint Protection Manager in User mode instead of Computer Mode.
Fix ID: 1421859
Symptom: Client packages exported with computer mode and a preferred group set appear in the wrong group and in user mode after install.
Solution: That behavior is as designed if installing as a workgroup user, but registration now ensures that it does not accidentally change an entry from computer mode to user mode.

[0x80020000] error when navigating to Clients > Policies > Communications settings.
Fix ID: 1457416
Symptom: Navigating to a group's communication policy could crash the server under certain conditions.
Solution: When accessing a default list, provide an empty one if site doesn't exist.

Exception is generated every 14 seconds after replication failure.
Fix ID: 1458441
Symptom: Repeated exceptions appear in the scm-server-0.log.
Solution: When accessing a default list, provide an empty one if site doesn't exist.

"Make all removable drives read-only" rule composed solely of wildcards causes all drives (including non-removable) to be read only.
Fix ID: 1298890
Symptom: If an Application and Device Control "Make all removable drives read-only" composed only of wild cards "*" and no other defining parameters is assigned, the local hard drive (C:) is now Read-Only, as is any other media (removable or otherwise).
Solution: Only removable drives are made read only when selecting this option.

An inherited Live Update policy displays an incorrect Live Update policy setting.
Fix ID: 1403339
Symptom: An inherited LiveUpdate policy displays an incorrect LiveUpdate policy setting, which is confusing.
Solution: Incorrect settings have been eliminated when inheriting LiveUpdate policies.

Symantec Endpoint Protection Manager does not accurately list Active Directory OU members
Fix ID: 1380112
Symptom: Member display may not work properly in Symantec Endpoint Protection Manager during an Active Directory server synch. New users may fall into a Temporary group.
Solution: Fixed Active Directory sync issue.

Importing an AntiVirus/AntiSpyware policy from a migrated Symantec AntiVirus server group into a new domain fails.
Fix ID: 1195565
Symptom: The import fails, the policy does not appear, and no error or exception is visible.
Solution: The command scan policy component is now kept as private metadata when AntiVirus/AntiSpam policies are migrated from a Symantec AntiVirus server.

Host Integrity rule title changes from "Symantec AntiVirus Corporate Edition" changes to "AhnLab V3 Internet Security" after migration to Symantec Endpoint Protection Manager.
Fix ID: 1414333
Symptom: This is a policy migration issue from Symantec Sygate Policy Manager 5.1.x to Symantec Endpoint Protection Manager 11.0.x. If you make a Host Integrity policy of AntiVirus Enforcement on Symantec Sygate Policy Manager 5.1.8, then select "Symantec AntiVirus Corporate Edition" as the antivirus product to be checked, it will be changed to "AhnLab V3 Internet Security" after migration to Symantec Endpoint Protection Manager 11.0.x.
Solution: Fixed the command scan policy component when we migrate antivirus policies from a legacy Symantec AntiVirus server.

Last Update Time does not match heartbeat time.
Fix ID: 1294572
Symptom: The Last Update Time is set when a site marks a client as offline. This looks as if the client were actually checked in at that time, but that is not the case.
Solution: The "Last Online Time" (Clients properties) or the "Last Check-in" (Computer Status log) or the "Last update time" (Computer Status log details) refer to the same client property. This time is updated when one of the client's properties changes. For example, this time is updated to the current time when a client goes from online to offline, from offline to online, or when any one or more of its properties as shown in its Computer Status log details changes. This date/time value, therefore, is the time of last change on the client and is not updated every heartbeat. Use the "Online" property to determine whether a particular client is still communicating with Symantec Endpoint Protection Manager.

Logged out client systems are missing the green dot icon when viewed from Symantec Endpoint Protection Manager.
Fix ID: 1195364
Symptom: Symantec Endpoint Protection Manager does not show the green dot icon for clients which are offline.
Solution: Altered the queries used during the Symantec Endpoint Protection Manager client audit process to fix this issue.

Tomcat hangs when generating a scheduled report.
Fix ID: 1379201
Symptom: The Java task that generates reports for either scheduled reporting or notifications hangs when it is unable to access IIS, and returns error code 502 or 503.
Solution: Reporting's custom error pages are all static now. Other custom error pages are all IIS default pages.

Discrepancies between the client and server on the Known Security Risk Exceptions list.
Fix ID: 1201020
Symptom: Symantec Endpoint Protection Manager Console shows fewer known risks than the client user interface.
Solution: Symantec Endpoint Protection Manager Console now loops to retrieve all known risks that match the client's data.

While exporting the "Search for Applications" results, invalid characters or missing rows appear in the results of the query.
Fix ID: 1439734
Symptom: Exported CSV file contains invalid characters or only has the header row.
Solution: Certain characters were causing problems with exporting to CSV. By removing these characters, the issue was resolved.

"Display notification icon" should only be available when "Display client UI" is enabled
Fix ID: 1223896
Symptom: The "Display notification icon" checkbox is still available after unchecking "Display client user interface."
Solution: The "Display notification icon" checkbox is disabled and unchecked when you uncheck "Display client user interface."

"Object cannot be found [0x16010000]" error when navigating to Admin > Install packages.
Fix ID: 1429789
Symptom: In Symantec Endpoint Protection Manager, navigating to Admin > Install packages causes an "object cannot be found" [0x16010000] error. When trying to export a client package encounter, the same error appears.
Solution: Three-part solution involving updates to the client packages, UI improvements, and improvements to ensuring deleting and reading of the client packages.

Cannot Set the Expiration Option to "Never" in Symantec Endpoint Protection Manager.
Fix ID: 1440744
Symptom: In Symantec Endpoint Protection Manager, it is not possible to set an Administrator's password to "Never Expire." It remains set at the 60 days radio button.
Solution: Can now set this option to Never.

Logs seem to continue to grow with no end.
Fix ID: 1212700
Symptom: Ersecreg.log and exsecars.log log file continue growing.
Solution: Improved the logging.

Symantec Endpoint Protection Manager client data is blank when client is logged off.
Fix ID: 1422562
Symptom: The tabs "Clients" and "User info" at client properties are blank.
Solution: Improved the registration of clients with Symantec Endpoint Protection Manager so that now the reporting of which clients are online is accurate.

"Daisy chain" replication of Symantec Endpoint Protection Manager causes incomplete data in the replication partners.
Fix ID: 1405310
Symptom: Replication from a third site fails after installation of Symantec Endpoint Protection Managers that "daisy chain" multiple sites. Certain components such as packages and policies are missing. Some packages cannot be exported due to missing policies. The following error may occur: "Failed to replicate."
Solution: All incomplete data in replication partners have been fixed.

During upgrade, Symantec Endpoint Protection Manager deletes user-created batch files found in the 'bin' folder.
Fix ID: 1413514
Symptom: Missing batch files.
Solution: Fixed the function responsible for deleting the files by replacing it with a function more mindful of possible user-created batch files housed in this folder.

User is unable to delete old client packages.
Fix ID: 1431008
Symptom: Nothing happens after attempting to delete old 32-bit client packages.
Solution: Corrected the issue with additional software package deployment checks.

Cannot delete a custom installed feature set.
Fix ID: 1371772
Symptom: When trying to delete a custom feature set, the following error appears: "This feature is currently in use; you cannot delete it!"
Solution: Improved the process of deletion.

Symantec Endpoint Protection Manager Application and Device Control log view is missing the "user" column.
Fix ID: 1430747
Symptom: Symantec Endpoint Protection Manager does not present the user account in the "Details" of the selected event.
Solution: Added User column in Results and Details page of ADC log.

Symantec Endpoint Protection Manager Time/OS Time mismatch in non-DST Time zones.
Fix ID: 1268881
Symptom: Symantec Endpoint Protection Manager does not account correctly for time zones without Daylight Saving Time.
Solution: Changed the function used to return the correct current time.

When using the Find Unmanaged Clients function, the client install fails. Errors appear in the server log.
Fix ID: 1374314
Symptom: User cannot copy the package files to the export folder. The product fails to prepare the package.
Solution: Destination folder did not exist when unzipping the full.zip to the export path. The fix was to create the folder.

Replication fails and "Object cannot be found: [0x16010000]" error when going to Admin > Servers.
Fix ID: 1417598
Symptom: User sees an "Object can't be found" error in Symantec Endpoint Protection Manager when entering the Admin >Servers tab.
Solution: Symantec Network Access Control now always replicates all sites.

Policy is not updated consistently.
Fix ID: 1387071
Symptom: Switching to a group detail panel does not change the group name.
Solution: Problem was caused by invalid translation of the code. This is now correctly parsed and resolves the issue.

Homepage shows "Still Infected" count even though all infections are cleared on Computer Status log.
Fix ID: 1408109
Symptom: When you clear infections using the Computer Status log "Clear Infected Status" option, it is still possible to see "Still Infected" counts in the Homepage "Action Summary by Detection Count."
Solution: Added additional checks and updated queries used on the Homepage.

Symantec Endpoint Protection Manager hangs when generating a scheduled report.
Fix ID: 1362174
Symptom: Error appears when generating a scheduled report.
Solution: Added static .htm error pages for PHP and updates to IIS configuration.

Symantec Network Access Control

Wireless Zero Configuration and related services stop with Network Access Control in Transparent mode.
Fix ID: 1409097
Symptom: Wireless Zero Configuration and Wired Auto Configuration services stop when Network Access Control is set to Transparent mode on the client.
Solution: Improved handling of the Identity response to eliminate the need to stop the Microsoft services and to prevent the "authentication failed" message in policy-based transparent mode.

Slow login with Symantec Endpoint Protection and Novell client software.
Fix ID: 1396418
Symptom: User may experience a three-second login delay if they use the Novell client or use login scripts, even if an 802.1x environment is not used.
Solution: Make the wait timeout value configurable through Symantec Endpoint Protection Manager and disable the SNACNP.DLL if 802.1x is not configured in policy.

Snac.exe stops responding when connecting to wireless AP in home environment, but not office.
Fix ID: 1435705
Symptom: When a user attempts to connect to the Linksys wireless router at home, snac.exe stops responding.
Solution: The SSID length that was passed into memory was too large.

Snac.exe stops after about 30 seconds.
Fix ID: 1409297
Symptom: Snac.exe stops after about 30 seconds, and a popup message appears.
Solution: Symantec Network Access Control service was unable to receive incoming EAP packets, causing a false alarm. In turn, Symantec Network Access Control service was restarting. Compatibility updates for necessary drivers have been made to resolve this issue.

Snac.exe application fault.
Fix ID: 1425246
Symptom: During startup, computers that were upgraded to MR3 show the message "Faulting application SNAC.EXE, version 11.0.3001.155, faulting module ntdll.dll, version 5.1.2600.5512, fault address 0x0001b1fa."
Solution: Fault has been resolved.

Gateway Enforcer failover causes ARP flood.
Fix ID: 1323897
Symptom: Symantec Network Access Control sends many ARP packets to both internal and external networks when failover occurs.
Solution: Added data to the end of the ARP packet when it is forwarded by Enforcer. When another Enforcer receives this packet, it sees the added data and does not forward the packet again.

"Add Trusted External IP Range" feature changes do not take effect.
Fix ID: 1448412
Symptom: IP address or IP range info is not saved.
Solution: When adding a new IP address or IP range in the trusted list, it now takes effect immediately.

Users are unable to connect to network via Gateway Enforcer when using Jiangnan VPN.
Fix ID: 1444422
Symptom: When connecting to the network via the Jiangnan VPN, you are unable to successfully communicate with Symantec Endpoint Protection Manager or authenticate to the network.
Solution: Fixed the dll causing the issue.

Unable to add more than 300 trusted IP addresses.
Fix ID: 1448404
Symptom: Cannot add more than 300 rows successfully.
Solution: Can now add more than 300 rows successfully.

The syntax checking for Gateway Enforcer protocol filtering does not work correctly.
Fix ID: 1250187
Symptom: The syntax checking for Gateway Enforcer protocol filtering does not work correctly. It will not allow you to type in "allow 802.3" and "allow 224.0.1.0/255.255.255.0", both of which are valid entries.
Solution: Change was made to allow 802.3 for one independent protocol string, but not in protocol range.

Client authentication will not fail to second RADIUS server if first RADIUS server is down.
Fix ID: 1448406
Symptom: With LAN Enforcement using Symantec Network Access Control 6100 Enforcer 11.0.2000, the first attempt at client authentication will fail because LAN enforcer does not switch RADIUS server from 1 to 2 immediately.
Solution: Change RADIUS server timeout to 3 seconds so that Enforcer will not send out RADIUS reject due to too many identity packets being received.

Enforcer fails to match correct action rule during startup with Transparent Mode.
Fix ID: 1448410
Symptom: In transparent mode, when the computer is starting up, the computer sends HI Pass, EAP unavailable, and Profile Unavailable.
Solution: Mismatching of Client GUID issue has been fixed.

Thirty second delay in client sending EAP packets results in unavailable resources.
Fix ID: 1447050
Symptom: The Symantec Network Access Control module does not send EAP packet until 30 seconds after the network card service starts. Due to this, if any network service has to be started immediately after the logon screen and before Symantec Network Access Control finishes authentication, it will not be available and may cause downloaded failures (for logon scripts, for example).
Solution: Delay has been resolved.

LAN enforcer MAB local database can only store 450 MAC addresses.
Fix ID: 1448400
Symptom: With a large amount of MAC addresses, an error message appears saying that the file size is too big.
Solution: Modified the MAC range control to allow a user to input a large number of MAC addresses.

LAN Enforcer does not fail over to secondary Radius server when primary Radius server goes offline.
Fix ID: 1440873
Symptom: When the primary Radius server goes offline, the LAN Enforcer does not fail over to the secondary Radius server, resulting in clients not being authenticated.
Solution: Resolved Radius failover function of LAN Enforcer for MAB authentication.

Readme items
The help topics for Damper settings state specifically that "Client List Changed" only has one setting, "Auto."
Fix ID: 1365700
Symptom: The help states specifically that "Client List Changed" only has one setting, "Auto".
Solution: For full details see readme section titled "The Configure Notifications help includes some incorrect information".

Page 60 in MR4 Admin guide contains an incorrect description of last icon
Fix ID: 1453627
Symptom: The last icon is a user mode icon. The PDF incorrectly states that it is in computer mode.
Solution: Added a readme item correcting the Admin guide error.

Maintenance Release 3 (MR3)

Component versions in MR3

Major Components
Symantec Endpoint Protection	11.0.3001.2224
Client Management Component	11.0.3001.2224
Symantec Network Access Control	11.0.3001.155
Symantec Endpoint Protection Manager	11.0.3001.2224

Minor Components
Auto-Protect	10.2.6.5
Behavior Blocking	3.3.7.004
COH	6.1.6.3
Common Client	6.3.7.009
DecABI	1.1.1.39
Defutils	3.3.20.0
QServer	3.6.16
SyKnAppS	2.5.0.12
SymEvent	12.5.3.3
SymNetDrv	7.2.3.302
WpsHelper	11.0.717.804

Symantec Endpoint Protection client fixes

Corrupted string in User Information when using Japanese string

Fix ID:

Symptoms:

Solution:

Cannot create an "ignore" exception for some proactive detections

Fix ID:

Symptoms:

Solution:

20-20 Design software does not load properly with Sysplant enabled

Fix ID:

Symptoms:

Solution:

Symantec Endpoint Protection service stops and starts repeatedly on Windows 2000 Terminal Server

Fix ID:

Symptoms:

Solution:

Unable to configure Application Control for Binary or DWORD registry values

Fix ID:

Symptoms:

Solution:

Symantec AntiVirus to Symantec Endpoint Protection 11.0 migrated scheduled LiveUpdate settings are not properly reflected in the Symantec Endpoint Protection 11.0 user interface

Fix ID:

Symptoms:

Solution:

Terminal servers run multiple instances of ProtectionUtilSurrogate.exe

Fix ID:

Symptoms:

Solution:

Cannot schedule LiveUpdate on a unmanaged 64-bit client

Fix ID:

Symptoms:

Solution:

After upgrading from Symantec AntiVirus, the Symantec Endpoint Protection 11.0 client appears to have continuous QuickScans running

Fix ID:

Symptoms:

Solution:

High CPU utilization on Terminal Servers with multiple active sessions

Fix ID:

Symptoms:

Solution:

Lexware software fails with Application and Device Control

Fix ID:

Symptoms:

Solution:

Mitek's Truss Engineering design software fails to load with Application and Device Control installed

Fix ID:

Symptoms:

Solution:

Location Awareness fails to switch locations correctly when using wireless connections

Fix ID:

Symptoms:

Solution:

Unable to stop users from stopping a scan when configuring the client to be able to snooze a scan

Fix ID:

Symptoms:

Solution:

Microsoft Dynamics application crashes in RDP session with Network Threat Protection enabled

Fix ID:

Symptoms:

Solution:

Active Scan fails to launch after definitions are updated

Fix ID:

Symptoms:

Solution:

Clients that cannot access the Group Update Provider (GUP) for updates fail over to Symantec Endpoint Protection Manager

Fix ID:

Symptoms:

Solution:

Unable to run Ice Sword rootkit detection tool with Symantec Endpoint Protection installed

Fix ID:

Symptoms:

Solution:

Symantec Endpoint Protection client does not write an event when NTP is re-enabled

Fix ID:

Symptom:

Solution:

Symantec Endpoint Protection client fails to communicate with manager when explorer.exe is not loaded

Fix ID:

Symptoms:

Solution:

Multiple Systray icons appear after launching Citrix applications

Fix ID:

Symptoms:

Solution:

"Log files written to USB drives" only logs the first file copied

Fix ID:

Symptoms:

Solution:

Uninstalling the email tools does not remove ccEmlPxy.dll

Fix ID:

Symptoms:

Solution:

Cannot save Word 2003 file changes to a cluster server

Fix ID:

Symptoms:

Solution:

Firewall rules created through learned applications do not block and write to log

Fix ID:

Symptoms:

Solution:

SMC –stop command fails when User Account Control (UAC) is enabled

Fix ID:

Symptoms:

Solution:

System log entry shows "Stop serving as the GUP" though client was never a GUP

Fix ID:

Symptoms:

Solution:

With Remote Registry Service disabled, Symantec Endpoint Protection 11.0 MR2 fails to install

Fix ID:

Symptoms:

Solution:

Risk declared as clean but still shows a red 'X'

Fix ID:

Symptoms:

Solution:

IPS detections do not contain the IP of the local machine

Fix ID:

Symptoms:

Solution:

SymCorpUI.exe hangs while scanning

Fix ID:

Symptoms:

Solution:

SMC crash on Windows XP Service Pack 2 with Nortel VPN Client installed

Fix ID:

Symptom:

Solution:

Location Switching Criteria "Aventail SSL VPN" fails

Fix ID:

Symptom:

Solution:

ccApp causes a runtime error during e-mail download

Fix ID:

Symptoms:

Solution:

Consortium Conference Client Forum fails to open with Symantec Endpoint Protection installed

Fix ID:

Symptoms:

Solution:

Windows 2008 dropping network shares with AutoProtect enabled

Fix ID:

Symptoms:

Solution:

Cannot change System Recovery settings with Application and Device Control

Fix ID:

Symptoms:

Solution:

Delay occurs when logging out of a Remote Desktop session with Symantec Endpoint Protection installed

Fix ID:

Symptoms:

Solution:

Symantec Endpoint Protection client reports that Network Threat Protection is active even though it is not installed

Fix ID:

Symptoms:

Solution:

Initial DHCP traffic is allowed even if a rule in place is configured to block all traffic

Fix ID:

Symptoms:

Solution:

Users can snooze scans indefinitely

Fix ID:

Symptoms:

Solution:

PTV America's VISSIM software fails to load with Application and Device Control installed

Fix ID:

Symptoms:

Solution:

Application and Device Control installed with ZENRIN its-moNAVI causes an application crash

Fix ID:

Symptoms:

Solution:

Location Awareness displays as disabled in the client's troubleshooting user interface

Fix ID:

Symptoms:

Solution:

Symantec Endpoint Protection user interface hangs when the operating system is set to Traditional Chinese language input

Fix ID:

Symptoms:

Solution:

Cannot deploy a client package without the out of date definition warnings appearing

Fix ID:

Symptoms:

Solution:

Symantec Endpoint Protection 11.0 MR2 MP2 Outlook e-mail plug-in strips attachments

Fix ID:

Symptoms:

Solution:

Certain DOS applications fail with Application and Device Control enabled

Fix ID:

Symptoms:

Solution:

Oracle Discover 3.1 fails with Application and Device Control installed

Fix ID:

Symptoms:

Solution:

Symantec Endpoint Protection Manager fixes

Symantec Endpoint Protection Manager incorrectly parses the client inventory data forwarded from Symantec AntiVirus Reporting agents

Fix ID:

Symptoms:

Solution:

Manager Server Configuration Wizard does not accept special characters

Fix ID:

Symptoms:

Solution:

Unable to configure the definition warning message in the manager

Fix ID:

Symptoms:

Solution:

Symantec AntiVirus server names and client groups are not listed for some server groups when using the Symantec Endpoint Protection Manager migration wizard

Fix ID:

Symptoms:

Solution:

The Symantec Endpoint Protection Manager password lifetime is hard coded

Fix ID:

Symptoms:

Solution:

The list of Known Security Risk Exceptions is longer on the Symantec Endpoint Protection client than it is in Symantec Endpoint Protection Manager

Fix ID:

Symptoms:

Solution:

An export button is missing from the export search data dialog box

Fix ID:

Symptoms:

Solution:

Symantec Endpoint Protection Manager fails to update virus definitions or policies to clients

Fix ID:

Symptoms:

Solution:

Inconsistent notifications when configuring Risk outbreak notifications using a damper control

Fix ID:

Symptoms:

Solution:

GUP fails to update clients

Fix ID:

Symptoms:

Solution:

Symantec Endpoint Protection Manager limited administrators can still perform administrator tasks

Fix ID:

Symptoms:

Solution:

Administrators log off time is always the same as the last log-in time

Fix ID:

Symptoms:

Solution:

Installing Symantec Endpoint Protection Manager to a custom web site will remove similarly named directories from the default Web site

Fix ID:

Symptoms:

Solution:

Symantec Network Access Control Appliance shows online and connected to Symantec Endpoint Protection Manager even though required Symantec Network Access Control upgrade is not installed

Fix ID:

Symptoms:

Solution:

Port 1812 error when installing Symantec Endpoint Protection Manager

Fix ID:

Symptoms:

Solution:

Synchronization and import errors occurs when deleting a Directory Server from the first Symantec Endpoint Protection Manager

Fix ID:

Symptoms:

Solution:

In the Policies tab, the feature "Replace the Policy" doesn't work for the IPS policy

Fix ID:

Symptoms:

Solution:

Unable to configure Symantec Endpoint Protection Manager to send e-mail notifications on a non-standard port

Fix ID:

Symptoms:

Solution:

An option to save reports is not available in Symantec Endpoint Protection Manager

Fix ID:

Symptoms:

Solution:

Scheduled LiveUpdate for Symantec Endpoint Protection Manager does not work within specified time frame

Fix ID:

Symptoms:

Solution:

Special characters in client computer description cause error

Fix ID:

Symptoms:

Solution:

After migrating Symantec Endpoint Protection Manager, policies and content are not being pushed to the client

Fix ID:

Symptoms:

Solution:

Replication of the databases takes up large amounts of drive space

Fix ID:

Symptoms:

Solution:

The reporting dashboard doesn't specify the amount of data that is being displayed

Fix ID:

Symptoms:

Solution:

Computer Status Log [Detail] and [Export] link do not have correct date/time

Fix ID:

Symptoms:

Solution:

Symantec Endpoint Protection Manager auto log sweep does not log when it runs

Fix ID:

Symptoms:

Solution:

Host Group name does not change in the Firewall Policy interface

Fix ID:

Solution:

Find Unmanaged Computers not returning Symantec AntiVirus version installed after discovery

Fix ID:

Symptoms:

Solution:

Downloaded Command filter in reporting does not report anything

Fix ID:

Symptoms:

Solution:

Symantec Endpoint Protection Manager Administrator is able to view restricted data

Fix ID:

Symptoms:

Solution:

"Failed to export to Group" when exporting installation packages

Fix ID:

Symptoms:

Solution:

Installing Symantec Endpoint Protection Manager to a SQL database with a custom DSN port, Symantec Endpoint Protection Manager log on will fail until Symantec Endpoint Protection Manager is configured to use a static port

Fix ID:

Symptoms:

Solution:

The "change password" link is missing from the Admin\Tasks

Fix ID:

Symptoms:

Solution:

Query fails on the computer status log page when the max limit is set to 1000 rows

Fix ID:

Symptoms:

Solution:

Limited Admin restricted to one group can view all learned applications globally in a Symantec Endpoint Protection Manager site

Fix ID:

Symptoms:

Solution:

Several policy changes generate broken links

Fix ID:

Symptoms:

Solution:

"Unable to read xml file" error in SesmLU.log when Symantec Endpoint Protection Manager using non-default data folder

Fix ID:

Symptoms:

Solution:

Temp files build up on server when backing up sem5 database

Fix ID:

Symptoms:

Solution:

OU import fails with errors when importing from the domain level through LDAP

Fix ID:

Symptoms:

Solution:

Restored backup does not sync Settings.LiveUpdate file and Symantec Endpoint Protection Manager user interface configuration

Fix ID:

Symptoms:

Solution:

Cannot deploy clients to Organizational Units that have commas in the name

Fix ID:

Symptoms:

Solution:

Risk log does not show up in Symantec Endpoint Protection Manager

Fix ID:

Symptoms:

Solution:

Tomcat hangs when generating scheduled report

Fix ID:

Symptoms:

Solution:

Symantec Endpoint Protection Manager > Monitor > Logs does not maintain report after command initiated using custom filter

Fix ID:

Symptoms:

Solution:

Assigning a policy to a group takes too long

Fix ID:

Symptoms:

Solution:

Symantec Endpoint Protection Manager OU Import issues if "Description field" contains escape characters \n, \u, \N, or \O

Fix ID:

Symptoms:

Solution:

System Administrator cannot view reports created by Administrators in Symantec Endpoint Protection Manager

Fix ID:

Symptoms:

Solution:

Display filter does not retain changed settings after closing Symantec Endpoint Protection Manager

Fix ID:

Symptoms:

Solution:

Exporting the Application and Device Control Logs crashes due to invalid characters

Fix ID:

Symptoms:

Solution:

Symantec Network Access Control fixes

Gateway Enforcer set to Fail Open and disable settings will not save after reboot

Fix ID:

Symptoms:

Solution:

Maintenance Patch 2 for Symantec Endpoint Protection Maintenance Release 2 (MR2 MP2)
This section describes the fixes in Maintenance Patch 2 for Maintenance Release 2.

About Maintenance Patch 2
This Maintenance Patch cannot be installed over the 11.0.0 or 11.0.1 versions of Symantec Endpoint Protection Manager. It must be installed over Maintenance Release 2, either with or without Maintenance Patch 1. For information about how to obtain the latest build of Symantec Endpoint Protection, read the following document: Obtaining an upgrade or update for Symantec Endpoint Protection 11.x or Symantec Network Access Control 11.x.

Components included in Maintenance Patch 2

Major components

Component	Version
Symantec Endpoint Protection	11.0.2020.56
Client Management Component	11.0.2020.21
Symantec Network Access Control	11.0.2020.8
Symantec Endpoint Protection Manager	11.0.2020.26

Minor components

Component	Version
AMS	6.12.0.148
Auto-Protect	10.2.4
Behavior Blocking	3.3.7
COH	6.1.2.3/6.1.3.20
Common Client	106.3.6.9
DecABI	1.1.1.39
DefUtils	3.3.11.0/3.3.16.0
ECOM	61.3.0.17
QServer	10.1.8.8000
SyKnAppS	2.5.0.12
SymEvent	12.5.3.3
SymNetDrv	7.2.1.110
Teefer2	11.0.1836.12
WpsHelper	11.0.717.804
VxMs (MSLight)	5.1.1.0

New fixes in Maintenance Patch 2

Symantec Endpoint Protection Manager fixes

Unable to delete older Install Packages after migrating to MR2

Fix ID:

Symptom:

Solution:

After migrating to Symantec Endpoint Protection Manager MR2, unable to export MR2 client install packages

Fix ID:

Symptom:

Solution:

Domains that have been deleted from Symantec Endpoint Protection Manager are still showing up in Reporting

Fix ID:

Symptom:

Solution:

Centralized Exception appears 14 times in Symantec Endpoint Protection Manager interface

Fix ID:

Symptom:

Solution:

Domain administrator can view groups that belong to another domain

Fix ID:

Symptom:

Solution:

A case sensitive security check prevents the command/policy publishing from completing

Fix ID:

Symptom:

Solution:

The antivirus definition version shown in the Symantec Endpoint Protection Manager console does not match the definition version shown in the client UI

Fix ID:

Symptom:

Solution:

Mdef25builder blocks other Symantec Endpoint Protection Manager processes

Fix ID:

Symptom:

Solution:

Internal site-wide "is LiveUpdate running" flag is set incorrectly

Fix ID:

Symptom:

Solution:

Slow imports from Active Directory OUs and creating locations

Fix ID:

Symptom:

Solution:

0Kb .dax files appear on the Symantec Endpoint Protection Manager

Fix ID:

Symptom:

Solution:

Symantec Endpoint Protection client fixes

Application List not saved properly after restart

Fix ID:

Symptom

Solution:

Application error CCMExec.exe when upgrading from 10.2 MP1

Fix ID:

Symptom

Solution:

Symantec Endpoint Protection client does not switch from External location when switching from wireless to Ethernet connections

Fix ID:

Symptom

Solution:

Number of files in the SharedUpdates directory does not decrease

Fix ID:

Symptom

Solution:

Intermittent ccSvcHst error on shutdown

Fix ID:

Symptom

Solution:

Petrel2008 software doesn't launch when Symantec Endpoint Protection Application & Device Control installed

Fix ID:

Symptom

Solution:

IntelliJ IDEA software does not function with Application and Device Control installed

Fix ID:

Symptom

Solution:

Ping time and CPU utilization increase with Symantec Endpoint Protection MR2 on Vista

Fix ID:

Symptom

Solution:

Symantec Endpoint Protection Manager shows in reports that agent has Network Access Control installed when it does not

Fix ID:

Symptom

Solution:

On Windows 2000 without Terminal Services, users may receive a default profile during logon

Fix ID:

Symptom

Solution:

Sysplant.sys causes application Quintiq to crash

Fix ID:

Symptom

Solution:

Point Patch 1 for Symantec Network Access Control Maintenance Release 2 Maintenance Patch 1
Point Patch 1 is a patch specific to Symantec Network Access Control. It can only be installed over Maintenance Release 2 with Maintenance Patch 1.

Symantec Network Access Control fixes in Point Patch 1

Symantec System Health Agent (SHA) is not running after restart

Fix ID

Symptom:

Solution:

NAP Enforcer: Ignoring "Verify Client UID" does not work

Fix ID:

Symptom:

Solution:

Agent built-in authentication fails when upgrading a Windows XP SP2 computer to Windows XP SP3

Fix ID:

Symptom:

Solution:

NAP Agent does not communicate with Enforcer if "DHCP Enforcement" configured after Symantec Network Access Control Agent started on XP SP3

Fix ID:

Symptom:

Solution:

Maintenance Patch 1 for Maintenance Release 2 (MR2 MP1)
This section describes the fixes in Maintenance Patch 1 for Maintenance Release 2.

About Maintenance Patch 1
This Maintenance Patch cannot be installed over the 11.0.0 or 11.0.1 versions of Symantec Endpoint Protection Manager. It must be installed over Maintenance Release 2. For information about how to obtain the latest build of Symantec Endpoint Protection, read the following document: Obtaining an upgrade or update for Symantec Endpoint Protection 11.x or Symantec Network Access Control 11.x.

Components included in Maintenance Patch 1

Component	Version
AMS	6.12.0.148
Auto-Protect	10.2.4.2/10.2.4.3
Behavior Blocking	3.3.6.7/3.3.6.8
ccEraser	20072.0.1.7
COH	6.1.2.3/6.1.3.20
Common Client	106.3.6.9
DecABI	1.1.1.39
Defutils	3.3.11.0/3.3.16.0
Deuce Engine	2007-06-06-1
ECOM	61.3.0.17
Intelligent Updater	5.0 (Release .006)
LiveUpdate	3.3 (Release .002)
LiveUpdateAdmin	2.1.2 (Release .002)
LiveUpdateCCPA	1.0 (Release .002)
LOTS Manager	3.3 (Release .001)
Microdefs	2.5 (Release .007)
SyKnAppS	2.5.0.12
SymEvent	2.5.3\3
SymNetDrv	7.2.1
Teefer2	11.0.1836.12
WpsHelper	11.0.717.804
VxMS (MSLight)	5.1.1.0

New fixes in Maintenance Patch 1

Symantec Endpoint Protection Manager fixes

Symantec Endpoint Protection Manager fails to update virus definitions or policies to clients

Fix ID:

Symptom:

Solution:

In a replication environment, after a few days, both sites' Symantec Endpoint Protection Manager publishing tasks show exceptions

Fix ID:

Symptom:

Solution:

Newly added site slows down server and console

Fix ID:

Symptom:

Solution:

When the Symantec Endpoint Protection Manager replication data is over 2 GB, replication fails

Fix ID:

Symptom:

Solution:

The unmanaged detector does not reflect the client status correctly

Fix ID:

Symptom:

Solution:

In environments with more than 1,000 groups, updating content takes a long time

Fix ID:

Symptom:

Solution:

Computer Status shows "No Definitions" for clients that do have current definitions

Fix ID:

Symptom:

Solution:

Symantec Endpoint Protection Manager creates 0-byte .DAX files, causing clients to request full definition update

Fix ID:

Symptom:

Solution:

Policy creation failure due to package broken links

Fix ID:

Symptom:

Solution:

Site Properties dialog fails to open

Fix ID:

Symptom:

Solution:

Network Providers in My Network Places has more than one instance of Symantec SNAC Network Provider

Fix ID:

Symptom:

Solution:

Symantec Endpoint Protection client fixes

RTVscan.exe crashes with faulting module msvcr80.dll fault add: 0x000046b4

Fix ID:

Symptom:

Solution:

Normal Users cannot disable firewall, even when allowed to by administrator

Fix ID:

Symptom:

Solution:

A request for a restart is displayed even though no updates are needed

Fix ID:

Symptom:

Solution:

Outlook stops unexpectedly when using "Next Item" button repeatedly

Fix ID:

Symptom:

Solution:

Maintenance Release 2 (MR2)
This section describes the new features and fixes included in Maintenance Release 2 of Symantec Endpoint Protection 11.0 and Symantec Network Access Control 11.0.

About Maintenance Release 2 for Symantec Endpoint Protection and Symantec Network Access Control
Symantec Endpoint Protection 11.0.2 and Symantec Network Access Control 11.0.2 provide enhancements on top of the existing 11.0 functionality to support the Microsoft Windows 2008 Server. In addition to providing compatibility with the new operating system, this release adds compatibility to the Microsoft Network Access Protection (NAP) framework. Fixes for customer problems and minor enhancements since the release of Symantec Endpoint Protection and Symantec Network Access Control are included this release. This release also adds support for Windows Vista Service Pack 1 and XP Service Pack 3.

New features

Support for Microsoft Windows 2008 Server clients
Support for Windows Server 2008 Standard/Enterprise/Datacenter/Web (32-bit or x64 edition), including Server Core installation, has been added to the Symantec Endpoint Protection and Symantec Network Access Control clients. Symantec Endpoint Protection Manager and the deployment tools have also been modified to support the management of Symantec Endpoint Protection and Symantec Network Access Control clients that run on Windows Server 2008. However, the management components cannot be installed on a computer running Windows Server 2008.
Compatibility with Microsoft Network Access Protection (NAP) Framework
Customers can build Symantec Network Access Control-only or multi-vendor policy compliance solutions using Microsoft's Network Access Protection (NAP) technologies. This feature lets customers leverage a standards-based (TNC-compliant) and Microsoft-supported network access control framework. This framework supports 802.1x, DHCP, Microsoft VPN, and IPSec technologies to control network access.

In addition to the previously supported methods, Symantec Network Access Control customers gain the use of IPSec as a compliance method. IPSec is an endpoint-centric method designed to build trust relationships between domain members.

For customers who want to leverage this technology, a major advantage for Symantec Network Access Control is the ability to control all aspects of admission control policy in a single policy console, instead of requiring customers to deploy multiple policy servers and management plug-ins.
Improved resource utilization in Symantec Endpoint Protection client and Symantec Endpoint Protection Manager
The MR2 release reduces the client footprint and resource utilization of the Symantec Endpoint Protection Manager in order to enhance the user experience, especially in small and medium-sized business environments. Administrators have the option to increase the space and memory allocation of the server to fit their business environment.
Enhanced Device Control supports Device ID
This feature lets you set a policy for a specific device that is allowed or not allowed to be attached to the endpoints, which helps ensure that USB memory sticks are not used unless they are approved by your security policy.

Components included in Maintenance Release 2

Component	Version	Comments
Auto-Protect	10.2.3	Certified on Windows 2008
Behavior Blocking	3.3.6\008
ccEraser	20072.0.1.7
COH	6.1.3\020
Common Client	6.3.6\009
DecABI	1.1.1
Defutils	3.3 (Release .002)
Deuce Engine	2007-06-06-1
ECOM	20071.3
Intelligent Updater	5.0 (Release .006)
LiveUpdate	3.3 (Release .002)
LiveUpdateAdmin	2.1.2 (Release .002)
LiveUpdateCCPA	1.0 (Release .002)
LOTS Manager	3.3 (Release .001)
Microdefs	2.5 (Release .007)
SyKnAppS	2.5	Certified on Windows 2008
SymEvent	12.5.3\3
SymNetDrv	7.2.1	Certified on Windows 2008

New fixes in Maintenance Release 2

Symantec Endpoint Protection Manager fixes

Symantec Endpoint Protection embedded database takes too much hard disk space

Fix ID:

Symptom:

Solution:

How to shrink the embedded database using the Dbunload tool

Port leak on Symantec Endpoint Protection Manager

Fix ID:

Symptom:

Solution:

Port Leak in Symantec Endpoint Protection Manager

Fix ID:

Symptom:

Solution:

Localized Symantec Endpoint Protection Manager migration from 11.0.0 to 11.0.1 erases LiveUpdate Inventory

Fix ID:

Symptom:

Solution:

Unexpected exception occurs on Symantec Endpoint Protection Manager

Fix ID:

Symptom:

Solution:

Site replication fails due to deadlocks

Fix ID:

Symptom:

Solution:

Database deadlocks causing multiple problems

Fix ID:

Symptom:

Solution:

Symantec Endpoint Protection Manager user name and password in clear text in registry during LiveUpdate Policy Rolldown

Fix ID:

Symptom:

Solution:

Database sweep does not remove content which is marked for deletion on replication site

Fix ID:

Symptom:

Solution:

Group Folders are not created or take too long to create

Fix ID:

Symptom:

Solution:

Import of policy from one Symantec Endpoint Protection Manager domain to another fails

Fix ID:

Symptom:

Solution:

Agents do not appear in Symantec Endpoint Protection Manager

Fix ID:

Symptom:

Solution:

Agent logs are not being replicated between Symantec Endpoint Protection Managers

Fix ID:

Symptom:

Solution:

AntiVirus logs appear to cause out of memory error that kills Symantec Endpoint Protection Manager

Fix ID:

Symptom:

Solution:

High CPU utilization when Symantec Endpoint Protection Manager builds definitions

Fix ID:

Symptom:

Solution:

AntiVirus and Antispyware policy templates

Fix ID:

Symptom:

Solution:

Symantec Endpoint Protection Manager loses connection with client

Fix ID:

Symptom:

Solution:

Client groups do not function properly

Fix ID:

Symptom:

Solution:

Symantec Endpoint Protection Manager LiveUpdate does not update content after system clock was previously set to a future date

Fix ID:

Symptom:

Solution:

Disaster Recovery procedure conflicts with remote software and is difficult to follow

Fix ID:

Symptom:

Solution:

Procedures to migrate embedded database to remote SQL server causes communication with client to break

Fix ID:

Symptom:

Solution:

Virus Definitions bar chart and IPS Signatures chart on Symantec Endpoint Protection Manager home page do not display

Fix ID:

Symptom:

Solution:

Cannot export agent packages from Symantec Endpoint Protection Manager Web console

Fix ID:

Symptom:

Solution:

ClientRemote Utility not functional

Fix ID:

Symptom:

Solution:

Communication between Symantec Endpoint Protection Manager and client breaks after moving clients to a different Organizational Unit (OU)

Fix ID:

Symptom:

Solution:

Users deleted from Symantec Endpoint Protection Manager groups that are synchronized from Active Directory (AD)

Fix ID:

Symptom:

Solution:

Cannot connect remotely to Symantec Endpoint Protection Manager that is installed behind a firewall with Network Address Translation (NAT)

Fix ID:

Symptom:

Solution:

LiveUpdate downloads are not always randomized

Fix ID:

Symptom:

Solution:

Changing remote console port blocks Symantec Endpoint Protection Manager/Symantec Endpoint Protection communication

Fix ID:

Symptom:

Solution:

Migration – After restoring database after migration, two management servers appear in Symantec Endpoint Protection Manager

Fix ID:

Symptom:

Solution:

Command to cancel scans does not cancel all scans

Fix ID:

Symptom:

Solution:

On Symantec Endpoint Protection Manager Home Page, status of Symantec Endpoint Protection client shows AntiVirus Engine is off

Fix ID:

Symptom:

Solution:

Symantec Endpoint Protection Manager hangs when performing certain operations

Fix ID:

Symptom:

Solution:

Import of certain OU information from LDAP server fails

Fix ID:

Symptom:

Solution:

Windows 2000 Symantec Endpoint Protection clients appear as Unknown Computers in Symantec Endpoint Protection Manager

Fix ID:

Symptom:

Solution:

Some non-shared policies cannot be disabled

Fix ID:

Symptom:

Solution:

Corrupted XML in the Symantec Endpoint Protection Manager database

Fix ID:

Symptom:

Solution:

Cannot log into to Symantec Endpoint Protection Manager after upgrading JRE to 1.6.x

Fix ID:

Symptom:

Solution:

Need error handling when multiple attempts of clients to download LiveUpdate content from server fail

Fix ID:

Symptom:

Solution:

Devices may not work when Extreme switch is used in network environment

Fix ID:

Symptom:

Solution:

Home and Monitors tabs don't work correctly if TEMP and TMP environment variables point to different folders

Fix ID:

Symptom:

Solution:

Online status of administrators always shows Offline

Fix ID:

Symptom:

Solution:

Need to apply limits to all events to ensure hard disk does not get filled up

Fix ID:

Symptom:

Solution:

Centralized Exceptions does not function in exceptional situations

Fix ID:

Symptom:

Solution:

Symantec Endpoint Protection Manager Process Event Log entries populated on Windows SBS Server

Fix ID:

Symptom:

Solution:

Cancelling "Add Package" operation causes unexpected error message and/or system hang

Fix ID:

Symptom:

Solution:

Symantec Endpoint Protection client cannot be added to specified group if group name contains spaces

Fix ID:

Symptom:

Solution:

Cannot save report "Attacks Over Time"

Fix ID:

Symptom:

Solution:

Cannot configure "Check Floppies for Boot Viruses" from the Symantec Endpoint Protection Manager

Fix ID:

Symptom:

Solution:

Maximum size of incoming log queues is too large (256GB)

Fix ID:

Symptom:

Solution:

Server GUI changes after clients send "User Information Collection"

Fix ID:

Symptom:

Solution:

LiveUpdate Help button unresponsive

Fix ID:

Symptom:

Solution:

Non-translated character strings on Report pages

Fix ID:

Symptom:

Solution:

Incorrect Help information and links from Symantec Endpoint Protection Manager

Fix ID:

Symptom:

Solution:

Computer Name with Chinese characters displays incorrectly

Fix ID:

Symptom:

Solution:

Reports generated in Chinese .MHT format display a blank page when opened with Internet Explorer

Fix ID:

Symptom:

Solution:

User cannot separate port numbers with spaces from Remote and Local Ports drop-down list

Fix ID:

Symptom:

Solution:

Garbage characters in Server Reporter panel

Fix ID:

Symptom:

Solution:

Truscan log column truncated

Fix ID:

Symptom:

Solution:

Incorrect font displayed on Symantec Endpoint Protection Manager Admin page

Fix ID:

Symptom:

Solution:

Symantec Endpoint Protection client fixes

TMP folders in virus definitions folder eventually consume all available drive space

Fix ID:

Symptom:

Solution:

Symantec Endpoint Protection Outlook Plug-in breaks all Outlook attachments

Fix ID:

Symptom:

Solution:

Symantec Endpoint Protection client scans do not scan any or all files

Fix ID:

Symptom:

Solution:

Windows blue screen error

Fix ID:

Symptom:

Solution:

64-Bit Windows 2003 Server blue screen error

Fix ID:

Symptom:

Solution:

Symantec Endpoint Protection client maintains accelerated heartbeat for too long

Fix ID:

Symptom:

Solution:

Symantec Endpoint Protection client migration problems

Fix ID:

Symptom:

Solution:

Update Schedule for Symantec Endpoint Protection client is not updated

Fix ID:

Symptom:

Solution:

Installing Application Control without Proactive Threat Scan blocks nothing

Fix ID:

Symptom:

Solution:

With Sysplan enabled, SMC.exe crashes after Windows login

Fix ID:

Symptom:

Solution:

Symantec Endpoint Protection client GUI crashes when importing rules to an unmanaged Symantec Endpoint Protection client

Fix ID:

Symptom:

Solution:

Migration from SPA 5.1 to Symantec Endpoint Protection 11.0 causes firewall to fail to load

Fix ID:

Symptom:

Solution:

Failed migration from 10.1 MR7 to 11.0 MR1 on French Operating Systems

Fix ID:

Symptom:

Solution:

System crashes when application/device control is installed

Fix ID:

Symptom:

Solution:

Symantec Endpoint Protection client does not scan files with certain special characters

Fix ID:

Symptom:

Solution:

Legacy scheduled scans run on client after migration to Symantec Endpoint Protection, but cannot be viewed or modified from the Symantec Endpoint Protection Manager

Fix ID:

Symptom:

Solution:

Current date of Proactive Threat Protection definitions is not displayed on the Symantec Endpoint Protection client

Fix ID:

Symptom:

Solution:

Application Device Control Exclusions

Fix ID:

Symptom:

Solution:

Tray icon crashes when user logs in to computer

Fix ID:

Symptom:

Solution:

Host Integrity firewall rule does not detect Norton Internet Security 2008

Fix ID:

Symptom:

Solution:

Symantec Endpoint Protection client configuration information is not stored correctly

Fix ID:

Symptom:

Solution:

Checkpoint VPN software breaks Symantec Endpoint Protection Manager/client communication

Fix ID:

Symptom:

Solution:

After installing Symantec Endpoint Protection client to computer that has Cisco VPN/Checkpoint (True Vector Driver), computer cannot connect to VPN Server

Fix ID:

Symptom:

Solution:

Cisco's stateful firewall does not start with Symantec Endpoint Protection client (Antivirus/Antispyware only) installed

Fix ID:

Symptom:

Solution:

Some Third-Party applications fail to load when Symantec Endpoint Protection client is installed

Fix ID:

Symptom:

Solution:

Symantec Endpoint Protection client does not correctly exclude Windows mount points

Fix ID:

Symptom:

Solution:

Proactive Threat Protection displays incorrect status on Symantec Endpoint Protection client

Fix ID:

Symptom:

Solution:

Proactive Threat Scan errors after Symantec Endpoint Protection client service starts

Fix ID:

Symptom:

Solution:

Symantec Client Firewall migration tool does not run when an older version of Java is installed

Fix ID:

Symptom:

Solution:

No notification of location change

Fix ID:

Symptom:

Solution:

Unmanaged Symantec Endpoint Protection client should not have option to Update Policy

Fix ID:

Symptom:

Solution:

Active Response is triggered even when the IDS signature is set to allow

Fix ID:

Symptom:

Solution:

Tray Icon color is grey on Windows 2000 Computers

Fix ID:

Symptom:

Solution:

Fix ID:

Symptom:

Solution:

DBCS characters in Symantec Endpoint Protection client Security Logs do not display correctly

Fix ID:

Symptom:

Solution:

Untranslated strings

Fix ID:

Symptom:

Solution:

Symantec Network Access Control client fixes

Symantec Network Access Control Enforcer Plugin service fails

Fix ID:

Symptom:

Solution:

Checkpoint VPN client connections blocked by Agent Symantec Network Access Control service

Fix ID:

Symptom:

Solution:

Focus removed from current window on Symantec Network Access Control-enabled Symantec Endpoint Protection clients

Fix ID:

Symptom:

Solution:

Migrating Symantec Network Access Control 11.0 client to Symantec Network Access Control 11.0 MR1 client without restart crashes computer

Fix ID:

Symptom:

Solution:

Symantec Network Access Control MR1 CD (CD2) gives error when running setup.exe

Fix ID:

Symptom:

Solution:

Symantec Network Access Control client does not switch to normal DHCP address after passing Host Integrity check

Fix ID:

Symptom:

Solution:

Japanese Symantec Network Access Control client remains in quarantine after it passes Host Integrity check

Fix ID:

Symptom:

Solution:

Symantec Network Access Control Gateway Enforcer Advanced Configuration settings overwritten when new policy is applied to client

Fix ID:

Symptom:

Solution:

Symantec Network Access Control Enforcer "User_Class" disabled after stopping and starting Enforcer

Fix ID:

Symptom:

Solution:

Tray icon on Symantec Network Access Control client has invalid configuration option

Fix ID:

Symptom:

Solution:

DHCP Symantec Network Access Control Enforcer does not detect changed remote host name in log

Fix ID:

Symptom:

Solution:

Incorrect message appears on Symantec Network Access Control client when performing check

Fix ID:

Symptom:

Solution:

Misleading Symantec Network Access Control Enforcer client log entry

Fix ID:

Symptom:

Solution:

Maintenance Patch 1 for Maintenance Release 1 (MR1 MP1)
This section describes the fixes in Maintenance Patch 1 for Maintenance Release 1.

About Maintenance Patch 1
Maintenance Patch 1 updates only Symantec Endpoint Protection Manager. It does not need to be installed to clients.

This Maintenance Patch cannot be installed over the original 11.0.0 version of Symantec Endpoint Protection Manager. It must be installed over Maintenance Release 1, or onto a computer with no Manager installed. For information about how to obtain the latest build of Symantec Endpoint Protection, read the following document: Obtaining an upgrade or update for Symantec Endpoint Protection 11.x or Symantec Network Access Control 11.x.

You can use the Maintenance Patch 1 installer to install the Manager on computers that do not already have Symantec Endpoint Protection Manager. The Manager contains client installation packages for Symantec Endpoint Protection Maintenance Release 1.

Symantec Endpoint Protection Manager fixes

Agents do not appear in Symantec Endpoint Protection Manager

Fix ID:

1178101

Symptom:

Agents do not show up correctly in Symantec Endpoint Protection Manager. If Symantec Endpoint Protection Manager is restarted, agents will show up correctly. However, after Active Directory synchronizes with Symantec Endpoint Protection Manager, the agents will display offline again. This occurs every 24 hours.

Solution:

Modified the order of how objects are processed so that agents appear correctly as "online" in Symantec Endpoint Protection Manager.

Port leak on Symantec Endpoint Protection Manager

Fix ID:

1183253

Symptom:

Symantec Endpoint Protection Manager becomes deaf as clients download updates, CLOSE_WAIT sockets are not closed, and the server is out of ports and becomes deaf to the console. As this continues, at some point you can no longer remote desktop to the server. When the server is full, 3500 sockets are in CLOSE_WAIT, almost all the rest are in TIME_WAIT, and there are 15 or so talking to the database and clients. As time passes, the CLOSE_WAIT sockets slowly rise.

Solution:

Symantec Endpoint Protection Manager process no longer has CLOSE_WAIT states after clients download updates, preventing the leaked ports from monopolizing all the server's ports.

Symantec Endpoint Protection Manager Management Console Home Page: Virus Definitions Bar chart and IPS Signatures chart do not display

Fix ID:

1190971

Symptom:

Charts on the Home Page appear blank.

Solution:

Modified code to ensure that chart information is displayed as expected on the Home Page.

Group Folders are not created or take too long to create

Fix ID:

1191851, 1201662

Symptom:

When you have a large number of existing groups, creating new groups fails as SemSvc.exe runs a check on all existing folders (one folder for each group). After over an hour, the new group is not created. When viewing created groups, some contain 2 files, while others contain over 20 files. In some instances, creating a group would take over an hour.

Solution:

Added a condition that optimizes creation of groups, so that groups and group folders are created and created in a timely manner.

Import of policy from one Symantec Endpoint Protection Manager domain to another fails

Fix ID:

1183186

Symptom:

After clicking "Import" to import a policy from one Symantec Endpoint Protection Manager domain to another, the action fails with no error message. This particularly happens when attempting to import firewall policies that use rules which apply to host groups that are not present in the new domain, or when importing policies from a migrated Symantec AntiVirus server group into a new domain.

Solution:

Import action failed because new domain did not contain the same host group names. This issue is resolved by implementing the following: create host group if it doesn't exist in new domain; adding error handling messages if an error does occur, and merging host groups if user selects to overwrite existing policy for already existing groups.

Maintenance Release 1 (MR1)
This section describes the fixes in Maintenance Release 1 of Symantec Endpoint Protection 11.0 and Symantec Network Access Control 11.0.

Components

Component	Version
AutoProtect	10.2.2.5/10.2.2.6
AVComp	2.0.58.0
Behavior Blocking	3.3.3.015
ccEraser	20072.0.1.6
COH	6.1.2.054
Common Client	106.6.3.2
DecABI	1.1.0.37
Defutils	3.3.11.0
Deuce Engine	3.0.2.2007-06-06_01
ECOM	71.1.0.11
Intelligent Updater	5.0.25
LiveUpdate	3.3.0.61
LiveSubReg	2.4.2
LiveUpdateAdmin	2.1.77
LiveUpdateCCPA	1.0.2
LOTS Manager	3.3.0.61
Microdefs	2.5.36.0
Packager	1.2.3.924
QServer	3.5.76
SAV	11.0.1000.1112
SAV for Linux	1.0.3.8
Scan And Deliver	2005.15.0.14
SESCMC	11.0.1000.1091
SESM	11.0.1000.1049
SyKnAppS	1.5.3.7
SymEvent	12.4.0.25
SymNetDrv	7.2.0.15
SymSentry	2.1.101
SymStat	24.0.0.0
Teefer2	11.0.690
WpsHelper	11.0.717.804
VxMS (MSLight)	5.0.71.0

Symantec Endpoint Protection fixes

Compatibility with Checkpoint VPN

Fix ID:

964738

Symptom:

Installation of Checkpoint VPN will either fail or VPN client will not function when Device Control is installed with Symantec Endpoint Protection client.

Solution:

Modified white list to remove incompatible reference to sr_service.exe

Performance of Outlook e-mail Protection

Fix ID:

1087587

Symptom:

Performance degradation on system when Outlook Auto-Protect plugin is enabled.

Solution:

Modified the Outlook plugin so that it scans attachment when they are selected for open rather when the message is selected to be read

Accessing remote network shares after the installation of Symantec Endpoint Protection

Fix ID:

1124570

Symptom:

Altering the installation of Symantec Endpoint Protection with Network Threat Protection, users cannot access remote network shares.

Solution:

Modified default rule set for the "Self Managed" client to prevent traffic from being blocked.

Wireless communication blocked by default with stand-alone client

Fix ID:

1146977

Symptom:

Rule generated that allows EAPOL was set to block by default. Stand-alone client does not have access to set this rule in the UI.

Solution:

Modified the UI so that a stand-alone user can change the EAPOL to allow or block. It is set to allow by default on the stand-alone client.

Symantec Endpoint Protection client install fails at 75% install

Fix ID: 1

149379

Symptom:

Symantec Endpoint Protection client install fails at 75% install

Solution:

Removed component attempting to stop and restart the service. A reboot prompt will occur when Symantec Network Access Control is installed so that the Wireless Zero Configuration service can stop and start with the operating system rather than having the Symantec Network Access Control install attempt to perform the action.

Windows NT Event contains many LiveUpdate entries

Fix ID:

1154429

Symptom:

LiveUpdate Events fill Windows System Log with multiple entries.

Solution:

Created a local cache of content sequence numbers. Logs are not created unless the LiveUpdate product inventory is changed.

Access to network share are lost after installing Symantec Endpoint Protection client on Windows Server

Fix ID:

1154729

Symptom:

Access is lost to Windows Server 2003 shares after files are copied to the server that has Symantec Endpoint Protection client installed on it

Solution:

AutoProtect was modified to detect such conditions and prevent the deadlock from occurring

Symantec Management Client (SMC.exe) uses more cpu when user is not logged into system.

Fix ID:

1131386

Symptom:

SMC service spikes the CPU then reaches a steady state of 40-50% cpu when the users logs out.

Solution:

SMC spiked the cpu looking for a logged in user. Modified the search function so that it will use less cpu time.

Importing OU structure from eDirectory LDAP server

Fix ID:

1129941

Symptom:

Importing OU structure from eDirectory synchronizes the root objects but does not pull objects beneath the root.

Solution:

Modified the search parameters to return the normal and operational parameter as an operational parameter so that objects will be imported correctly.

Synchronization with Active Directory fails when conflict records exist.

Fix ID:

1138805

Symptom:

Organizational Units do not import correctly from Active Directory if conflict entries are encountered during the import process.

Solution:

Modified importing code so that invalid entries are skipped. Skipped entries are logged to the debug log.

Client connecting with Symantec Endpoint Protection Manager

Fix ID:

1123148

Symptom:

Kernel memory leak in WPS Helper driver prevents IIS from accepting connections.

Solution:

Resolved memory leak

Floppy drive scanning

Fix ID:

1161393

Symptom:

Floppy drives are scanned on shutdown even though administrator selects them not be scanned

Solution:

The option will be set correctly to the desired configuration

Description for Auto-Protect setting was switched.

Fix ID:

1162823

Symptom:

The Auto-Protect setting "Scan when a file is accessed or modified" was incorrectly switched with the setting, "Scan when a file is accessed".

Solution:

Changed the UI so that each setting has the correct description.

GroupWise 7.X installation fails with Symantec Endpoint Protection installed.

Fix ID:

1165265

Symptom:

Installing Symantec Endpoint Protection with Application and Device Control prevents GroupWise 7.x from launching correctly.

Solution:

Modified application and device control policy so that it was using the correct operating system folder.

Deployment Wizard prompts for username and password on every computer

Fix ID:

1167447

Symptom:

Deployment Wizard (Client Remote) is prompting for username and password for each computer that is selected to have the client deployed to even when the credentials are the same.

Solution:

Now using the authentication cache to eliminate unnecessary re-entering of user/password info when deploying multiple clients. This is similar to the way that ClientRemote worked in 10.x

Error when running Configuration Wizard to install an additional site for replication

Fix ID:

1175545

Symptom:

When running the Management Server Configuration Wizard to install an additional site for replication (using SQL 2005), the wizard interrupts with a data truncation error.

Solution:

Handled DateTime field correctly with French version of SQL

Symantec Endpoint Protection Manager no longer downloads definitions after being updated with rapid release .jdb file.

Fix ID:

1163481

Symptom:

After updating Symantec Endpoint Protection Manager with a rapid response .jdb file, it would no longer process the newer certified definitions brought down through LiveUpdate.

Solution:

Modified the logic on Symantec Endpoint Protection Manager so that it processed the .jdb definitions as the newest definitions.

Protective Threat Protection signatures not updating on client

Fix ID:

1167523

Symptom:

Symantec Known Application list not updating when client was configure to get content from Symantec Endpoint Protection Manager.

Solution:

Setting the correct values for LiveUpdate server when client is pulling content from Symantec Endpoint Protection Manager.

SEP client is not showing icon in the system tray

Fix ID

: 1145044

Symptom

: The yellow shield icon in the system tray was not being displayed. All users will see is the green circle when the client is communicating with the manager.

Solution

: Corrected logic condition which caused icon to not be displayed.

Logging into Symantec Endpoint Protection Manager when it is installed on the same system as Backup Exec Continuous Protection Server causes error

Fix ID

: 1142597

Symptom

: Communication error is received when attempting to log into Symantec Endpoint Protection Manager after Symantec Endpoint Protection Manager is installed on the same computer as Backup Exec Continuous Protection Server.

Solution

: This was caused by a port conflict on 8443. Installation wizard was modified to detect the port in use and to select an alternate port. This

solution

will work for any application that has already bound port 8443.

Compatibility issue with Microsoft SQL profiler tool

Fix ID

: 1146828

Symptom

Solution

: Resolved compatibility issue with sysplant driver.

Client User Interface status will show red when the Lotus Notes e-mail protection is not installed.

Fix ID

: 1139886

Symptom

: The status on the main client user interface will display red when the Lotus Notes plugin is not installed with the client.

Solution

: Modified the client status so that it will exclude the Lotus Notes e-mail protection if it is not installed on the client.

Application Control is disabled when Network Threat Control is disabled

Fix ID

: 1008642

Symptom

: When user selects to disable Network Threat Protection, Application Control protection is disabled.

Solution

: Modified controls so that disabling Network Threat Protection does not disable Application Control

Device Control is disabled when Network Threat Protection is disabled

Fix ID

: 1008655

Symptom

: When user selects to disable Network Threat Protection, Device Control protection is disabled.

Solution

: Modified controls so that disabling Network Threat Protection does not disable Device Control

Deploying clients to active directory groups

Fix ID

: 1123131

Symptom

: Deploying client packages to computers appearing in a active directory group appear in the temporary group.

Solution

: Modified the sylink file so that it is not overwritten by an "unmanaged" sylink file.

Startup Scan running after Migration from SCS to SEP v11.0

Fix ID

: 1127065

Symptom

: A startup scan runs even though it was originally set to disabled prior to the migration.

Solution

: Modified the attribute on migration so that the startup scan would not run if configured to not do so.

Stand-alone client install does not function when exported from Symantec Endpoint Protection Manager

Fix ID

: 1148518

Symptom

: All files and folders were missing the first character when files are extracted to the temp directory. This prevented the client installation package from executing correctly.

Solution

: Modified path export function to remove extra patch separator so that all files had the correct characters

Locked Auto-Protect settings do not propagate to client

Fix ID

: 1153011

Symptom

: Client GUI used the read-only attribute to prevent changes from being made rather than displaying a grey state

Solution

: Client GUI will display the proper locked state when access to control is set to lock from Symantec Endpoint Protection Manager.

Block rule for CD/DVDs no longer functions after migrating SEP v11.0 over SSEP 5.1 server

Fix ID

: 1154818

Symptom

: Block rule for CD/DVDs does not trigger after migrating to SEP v11.0 from SSEP 5.1.

Solution

: Updated the upgrade mechanism to set new domain for devices so that policy is successful migrated.

Missing Network Threat Protection component when logging in as restricted user

Fix ID

: 1155546

Symptom

: Network Threat Protection does not show up in main client UI after switching from an administrator account to a restricted account.

Solution

: Modified session processing logic so that it was tolerant to error in operating system API.

Symantec Auto-Upgrade Agent service fails to start

Fix ID

: 1167997

Symptom

: Error Message(s): Service Control Manager popup error: "At least one service or driver failed during system startup"

Error Event ID 7000 in the Windows system event log.

Source: Service Control Manager.

Description: The Symantec Auto-upgrade Agent service failed to start due to the following error: "The system cannot find the file specified."

Solution

: No longer setting the smcinst.exe service to Automatic when the service is already installed

Client Group information in the Troubleshooting section displays the client group name only

Fix ID

: 1168861

Symptom

: The entire path of the client group is not displayed in the troubleshooting section.

Solution

: Modified the display so that the entire client group path will be shown.

Schedule Scans not running when user is logged off

Fix ID

: 1169275

Symptom

: On windows 2000 systems, schedule scans were not running when user logged off, if configured to do so.

Solution

: Modified logon code to check for smcgui rather than vptray.

Client UI would not display new definition date

Fix ID

: 1171767

Symptom

: On Windows Vista, SEP Client UI would not update virus definition date after they were downloaded

Solution

: Modified check for VirusDefs so that the directory change notification was received correctly

Exporting client troubleshooting data

Fix ID

: 1054802

Symptom

: Information that appeared in the client Troubleshooting section could not be exported

Solution

: The ability to export troubleshooting data has been added to the SEP client

Displaying clients in the Virus Definition Distribution table

Fix ID

: 1104932

Symptom

: Clients that did not have Network Threat Protection module installed are listed in the Virus Definition Distribution Table.

Solution

: The report correctly filters out clients that should not be displayed if the technology is not installed

Configuring missed LiveUpdate events

Fix ID

: 1105014

Symptom

: Client UI did not include the setting to allow a LiveUpdate event to be run when the computer was off during the scheduled time.

Solution

: The client scheduled LiveUpdate UI was updated to include the missed event option.

Setting policy to allow user to modify LU schedule

Fix ID

: 1110115

Symptom

: Setting the option "Allow the user to manually launch LiveUpdate", would not enable this feature on the client

Solution

: Setting the option in the Console will allow the end user to modify the LiveUpdate schedule

Firewall does not enable when changing locations

Fix ID

: 1139747

Symptom

: Firewall does not enable when it computer changes to a new location if the user disabled it in the old location

Solution

: Firewall will be enabled when it detects a new location

System Lockdown generates a large amount of log events that are forwarded to the management server

Fix ID

: 1139876

Symptom

: A large number of the same events will appear in the control logs when System Lockdown is configured in log only mode. Most of these events will be for the same files.

Solution

: A damper control has been added which will prevent identical log entries from displaying if they occur within the same 60 seconds.

RTVScan.exe application error

Fix ID

: 1162150

Symptom

: An error dialog appears with the following information; RTVscan.exe Application Error - Unknown exception (0xc00000fd) occurred in the application at location 0x65ec9abc

Solution

: Modified shutdown thread to wait for proper termination rather than depend on a delay cycle

Client updates definitions from quarantine location

Fix ID

: 1053078

Symptom

: Client does not switch to using LUA to download definitions when it is in a quarantine location

Solution

: Client will successfully switch the policy to allow it to pull definitions from LUA

Auto-Protect option is not set correctly on the client

Fix ID

: 1108152

Symptom

: Enabling the option to "Check floppies when the computer shuts down" would disable the feature on the client.

Solution

: Modified settings for the configuration file so that it was applied correctly at the client

Showing the correct status on the client UI for AntiVirus and antispyware

Fix ID

: 1117515

Symptom

: When a restricted user opens the main client UI, they see red X's for AntiVirus and antispyware status as well as protective threat protection

Solution

: Since restricted users do not have the rights on the system to change the status, the red X is not displayed.

Report "Clients with Latest policy" does not show clients with older policies

Fix ID

: 1158086

Symptom

: Report "Clients with Latest policy" does not show clients with older policies.

Solution

: Added the latest policy serial number as a reference so that all policies would be displayed.

Viewing reports with the time range, "Past 24 hours" results in an error message

Fix ID

: 1159662

Symptom

: On the first of the month, if any log or report is selected with the time range set to "Past 24 hours" the user will get a message, "

Your Start Date must be greater than the end date

Solution

: Modified logic in the filter to correctly adjust for the shift in days

Symantec Network Access Control fixes

Incompatibility with Symantec Network Access Control and L2TP VPN connection

Fix ID:

1158037

Symptom:

Incompatibility with Symantec Network Access Control and L2TP VPN connection.

Solution:

Symantec Network Access Control was modified to detect whether PPTP or L2PT VPN connections are being used so that original EAP dlls are used rather than SymRasMan.dll for authentication

References:
This document is available in the following languages:

Available Translations:

Document ID: 2007121216360648
Last Modified: 11/04/2009
Date Created: 12/12/2007
Product(s): Endpoint Protection 11
Release(s): Endpoint Protection 11.0, Endpoint Protection 11.0.1, Endpoint Protection 11.0.2, Endpoint Protection 11.0.3, Endpoint Protection 11.0.4