I have noticed that the agt_risk.log (and other logs) is not updateing from agt_risk.tmp file.
We need log files to be able to load them into splunk.
Any idea why it is not updating and how can we change the update interval of External Logging?
Hi All,
When SSL interception is enabled in the Proxy , will user password and other credentials will stored in the Proxy ?.
Any official document talking about this ??
Thanks in Advance
Symantec have provide DOC9422 on how to use patch Management to deploy feature updates:
When Symantec Endpoint Encryption (SEE) is installed there are further complications for a Windows 10 installation, described in HOWTO125875:
It is straightforward using these two articles to work out how to use the Patch Management Solution to deploy Feature updates to SEE encrypted computers.
Described are the changes made to upgrade Windows 10 Professional from Creators Update (1703) to Fall Creators Update (1709), with SEE 11.1.3 MP1 already installed (the prerequisite SEE version before upgrading to 1709). Additionally this is straight English US only – language issues are not dealt with, nor are enterprise/education/home editions of Windows, although this would not be too difficult to accomplish.
Note: Once these changes are made the modified Feature Update policy will not work on devices without SEE installed – a separate policy will be required. (It would be possible to further extend the scripts to do both if that is what was required)
First follow DOC9422 to download and setup 1709 installation
Then download the Win8_10_Upgrade_SEE11.1.3MP1.zip file from HOWTO125875. Unzip the files and place with 1709 installation files in package location on Notification Server – same as for Windows ISO file from DOC9422.
Next edit two files on the Notification server in package location. Symantec have used batch scripts for both of these:
Windows10x86Professional1703.bat (the ‘batch file’)
WinRS3-upgrade-SE11.cmd (the ’command file’)
It helps at this point to have both files open to follow along.
The batch file provided in Patch Management solution has the following setup.exe command (at line 161):
"%volume%:\setup.exe" /auto upgrade %languageOption% /quiet /showoobe none /noreboot /telemetry disable /dynamicupdate disable /Postoobe %STscript%setupcomplete.cmd & SET LASTERR=!errorlevel!Replace this will a call to the command file that executes the script for install on SEE 11.1.3 MP1 encrypted machines. This is simply this call, passing as parameter the correct drive letter to where the installation files are located - thebatch filehelpfully sets a variable for this (%volume%):
call WinRS3-upgrade-SEE11.cmd %volume%:Then edit the command file and update the setup.exe call. The original line in the command file is:
call %1\setup.exe /reflectdrivers %SEETempPath% /postoobe %SEETempPath%\setupcomplete.cmdPick the items from the batch file that you want in the command file setup.exe call. If you wanted the %languageOption% (Adding language packs to the installation) then you will need to pass this from the batch file on the call (as %2%). Keep all of the switches that are already in the command file as they relate to SEE , and include the last bit from the ‘&’ as this captures the exitcode needed for Patch Management Solution to identify if the upgrade was a success or not. The resulting update to the command line call will look something like this:
call %1\setup.exe /auto upgrade /quiet /showoobe none /noreboot /telemetry disable /dynamicupdate disable /reflectdrivers %SEETempPath% /postoobe %SEETempPath%\setupcomplete.cmd & SET LASTERR=!errorlevel!
To deal with passing the exitcode back to the batch file, as the very last line in the command file add this line:
EXIT /B %LASTERR%And finally in the batch file right after the call to the command file add this line to store the exitcode in the correct batch file variable:
SET LASTERR=%errorlevel%And that’s it. The setup line is replaced in the batch file and the exitcode is correctly returned
Hi,
We have made external reporting setup to be able to send log files to splunk.
However we notice that the log file is not updating. The update frequency is set to 30 seconds and we can see .tmp file being updated but not the log file.
Any idea how we can change the settings so it is updating frequently.
Kind regards
Hi all,
I simply cannot install endpoint security from my windows 10 pro. Tried in another machine also with windows 10 and nothing.
Seems it has been removed, but trying to install another antivirus app in this case , trend micro, appears the message that says; remove symantec manually, still on system
Steps i made;
Tried to uninistall normaly from add remove programs
tried clean wipe application
tried cedar application
tried deleting manually folders and files;
"Tracking was hard, I had to cross reference two files C:\$WINDOWS.~BT\Sources\Panther\setupact.log & C:\$WINDOWS.~BT\Sources\Panther\_APPRAISER_HumanReadable.xml" seen in a post
Anyone please can help me ? This friday i will be out of support and licence. Symantec decided to end support of windows xp, w2008 and w2003, and i need to install another security platform.
Thanks
Pedro
Dear all,
When I try to scroll on WebPages with an updated IE 11 on Windows 7 - I observe the loading of the pages is not really fluid when I scroll (the page is still downloading. WebPages with active content inside (Advertisements) takes a long time to load.
If I change to another pac-file linked to another proxy solution, the problems are not present. I can scroll through the pages even they are downloading and the time to load is very quick.
Any ideas what I could check?
Thank a lot.
Crocky
Hi,
When runnig the "agent_upgrade.bat" file on a computer to try and upgrade the agent from 14.6. to 15.0.1 I am receiving the following error:
MSI (s) (00:88) [10:11:56:524]: Doing action: MsiProcessDrivers
Action ended 10:11:56: RegisterComPlus. Return value 0.
MSI (s) (00:E4) [10:11:56:664]: Invoking remote custom action. DLL: C:\windows\Installer\MSI4464.tmp, Entrypoint: ProcessDriverPackages
Action start 10:11:56: MsiProcessDrivers.
DIFXAPP: ENTER: ProcessDriverPackages()
DIFXAPP: INFO: 'Component' is 'vfsmfd.inf'
DIFXAPP: INFO: Component state 0x3 -> 0x2
DIFXAPP: INFO: 'ComponentId' is {03C8264B-B361-435E-A6B5-C565F24D4A6E}
DIFXAPP: INFO: 'Flags' is 31
DIFXAPP: INFO: component path is
DIFXAPP: INFO: user SID of user performing the install is 'S-1-5-21-2054966371-109381095-1963001494-194691'.
DIFXAPP: INFO: creating HKEY_USERS\S-1-5-21-2054966371-109381095-1963001494-194691\Software\Microsoft\Windows\CurrentVersion\DIFxApp\Components\{03C8264B-B361-435E-A6B5-C565F24D4A6E} (User's SID: 'S-1-5-21-2054966371-109381095-1963001494-194691') ...
DIFXAPP: ERROR 0x57 encountered while creating subkey for component '{03C8264B-B361-435E-A6B5-C565F24D4A6E}'
DIFXAPP: RETURN: ProcessDriverPackages() 87 (0x57)
CustomAction MsiProcessDrivers returned actual error code 1603 (note this may not be 100% accurate if translation happened inside sandbox)
I created a custom report to retrieve what's installed for all workstations and servers. I am retrieving it from the add/remove program in control panel. However, the report showed an older version of the software along with the new version of the software. For example, yesterday I had an older version of FireFox 58.0.1, updated to 58.0.2. Today ran the report and it's showing both version as installed. This happened for Chrome as well. I want to know why that is happening and how to fix it. Does this depend on the software because I updated my 7-zip but then the report showed just the latest version and not the old version with the new version.
My SQL script is below.
SELECT DISTINCT arp1.DisplayName, arp1.DisplayVersion AS 'Version', arp1.InstallDate, c1.Name AS 'Computer Name', id1.[OS Name], id1.[OS Type]
FROM vRM_Computer_Item c1
JOIN Inv_AddRemoveProgram arp1 ON c1.Guid = arp1._ResourceGuid
JOIN Inv_AeX_AC_Identification id1 ON c1.Guid = id1._ResourceGuid
WHERE arp1.DisplayName not like '%Security Update%'
and arp1.DisplayName not like '%Update for%'
and arp1.DisplayName not like '%UpdateAssistant%'
and arp1.DisplayName not like '%Updater%'
and arp1.DisplayName not like '%LiveUpdate%'
and arp1.DisplayName not like '%Advisor Update%'
and arp1.DisplayName not like '%Code Update%'
and arp1.DisplayName not like '%Update x64%'
and arp1.DisplayName not like '%help%'
and arp1.DisplayName not like '%redist%'
and arp1.DisplayName not like '%proof%'
and arp1.DisplayName not like '%pack%'
and arp1.DisplayName not like '%suppo%'
and arp1.DisplayName not like '%viewer%'
and arp1.DisplayName not like '%MUI%'
and arp1.DisplayName not like '%hotfix%'
and arp1.Publisher not like '%Altiris%'
and arp1.DisplayName not like '%Altiris%'
After downloading VIP Access on my laptop, I was unable to open the application.
Instead, the following error message popped up: "The ordinal 7332 could not be located in the dynamic link library C:/Program Files (x86)/Symantec/VIP Access Client/VIPUIManager.exe"
Hey all,
I've been poking around the forums looking for a solution and there are no obvious answers. The native Bluetooth application on Windows is called fsquirt.exe and is added in the Application Monitoring section of our DLP instance but we aren't getting any transfers. After some more investigating it's been mentioned that MTP (WudfHost.exe) is what does the actual transfers so I added that to the application monitoring and I am not getting results..
Our goal is to create a policy that will prompt a notification if someone transfers a document that meets certain requirements but we aren't getting any visual of bluetooth traffic.
Thanks,
Drew
Hello
It is possible to disable a computer for a time interval when the Symantec Endpoint is not updated with the latest updates from the management console?
If it is possible how I can do that?
Thanks.
Recenlty realized on older version of Altiris, I had mapped drives in inventory in table Inv_HW_Logical_Disk. When running an SQL against ne db, I found that info missing. Researching, came across and article that stated inventory does not capture printers and mapped drives: https://support.symantec.com/en_US/article.TECH145268.html. Creating a neew policy as outlined did not work I need a vb script to get HKEY Current User\Network subkeys (name) and its corresponding strvaluename "remotePath" and its value.
I was able to get this on some pcs woth powershell, but on most it is not returning all mapped drives. Better success on WIn 7 and less so on Win 8.1 and 10. Possibly restriction on powershell running.
After trying to work with many vb scripts and piece it together, I am still nowhere.
So, I need a script to replace what Altiris Inventory USED to do. I already have the custom table with some info from the powershell script, but perhaps vb would be better.
For each Drive letter, I need the RemotePath value. For example L: RemotePath value is \\oi-oitnst-m3-e.njes.state.nj.us\softwarelibrary
THE GUID of the table is e30cf469-1720-4452-b3bc-7248d42a861a and the columns are Name ( the mapped drive letter (subkey) and ProviderName ( the path value).
I do not script so this is quite difficult. Any help would be appreciated
I have a single site server, and I have successfully created an image. Now, the image is stuck as a "Pending Package". The sync was attempted this morning, but it failed and the package was marked in Site Servers as "invalid"; now, it's just stuck at "Pending".
On the site server, the .gho/.ghs files are available in C:\Program Files\altiris\Altiris Agent\Package Delivery\{4a9deb21-ca50-4b36-8c4a-e845c006a96b}\cache, but the Package Server tab on the agent shows it stuck in "Checking Package".
Everything else works normally, and the logs show nothing suspicious.
Thoughts?
Thanks!
Hello,
Symantec has known about the Storage Space drive issue with Surface Laptops for over 6 months. It was reported in July 2017, confirmed again (many times) in November 2017, December 2017 and January 2018 through posts in the forums.
When is there going to be a solution available for the installation of Symantec 14.x onto Storage Space Drives - specifically the ones found in the MS Surface Laptop? And what happens when MS and Dell both start using the Storage Space Drive option in the rest of their laptop systems?
I'm sure as a company Symantec doesn't want to give up any ground in the marketplace but it has been over 6 months and no updates or progress notifications.
Check it out for yourself - all of the new MS Surface systems with 1tb HD's are *only* coming with the storage space drive configured from the factory...
C.
I have a single site server that serves as both my PS and TS. Every once in a while, I see this in the log. Thoughts?
<event date='02/14/2018 17:44:32.4200000 -05:00' severity='1' hostName='dept-deployss' source='ConnectionProfile' module='AeXNetComms.dll' process='AeXNSAgent.exe' pid='1308' thread='1372' tickCount='19990031'><![CDATA[Failed to read revision from profile '{94573FCF-607C-4668-88AA-2F06E03C8BB8}', error: The system cannot find the file specified (0x00000002)]]></event>Hi,
I had an old server version 12.1.7004.6500 which has crashed. I have sylinked all clients to a server 14MP2. When the clients were sylinked, I could see that they have connected with the SEPM 14MP2. Problem I am having is that no information is available on the SEPM. Information such as Client security patch version, current virus definitions etc. The Last Time Status Changed is actually the date when the sylink was done.
Can you please help. Thanks!
Hi all,
We get exception in submit incident ticket component when email monitoring executes and incoming email is processed. However, entries are created in reportprocess and imincidentticket tables. But no task are created. What can be the problem? Servicedesk version: 7.5.3001.78
When I use to send email to my clients on daily basis. Then, It takes too much time to send the content. And, after some moment, When I look back to the sent box of my Zoho mail customer service account, it shows that the email is not delivered to all recipients.
Hi, We recently move to a new server and we got a new IP. After the move we are having issues sending emails to some of our customers because of the following error:
Reporting-MTA: dns; server.******.com
Action: failed
Final-Recipient: rfc822; *******@*******.com
Status: 5.0.0
Remote-MTA: dns; mail-in2.*******.com
Diagnostic-Code: smtp; 554 5.7.1 Global Bad Senders
Our Server IP Address :
185.153.220.204
185.153.220.205
Please help me immediately.
Thanks.
bonjour;
je cherche l'emplacement des tables de "QUICK rapports" au niveau de SQL server 2012 "installée pour SEPM14MP1",
et des documents concernant les tables SQL installées pour SEPM
