Excessive & Multiple Event ID 4673 on Event Viewer Security logs

June 12, 2017, 3:38 am

≫ Next: Application Monitoring not working on Windows 10 (DLP agent 14.6)

≪ Previous: Installing a 2nd management server+console for DCS

$

0

0

I need a solution

How can we stop the below issue.

A privileged service was called.

Subject:
    Security ID:        XXX
    Account Name:        XXX
    Account Domain:        XXX
    Logon ID:        0x8CA1B

Service:
    Server:    Security
    Service Name:    -

Process:
    Process ID:    0x1b04
    Process Name:    C:\Program Files\Symantec.cloud\EndpointProtectionAgent\12.1.7166.6700.105\Bin\ccSvcHst.exe

Service Request Information:
    Privileges:        SeTcbPrivilege

we have already updated to the latest SEP Small Business Edition. - No more updates.

Still we are getting the above on the server causing accounts to be locked out daily.

0

---

Application Monitoring not working on Windows 10 (DLP agent 14.6)

June 12, 2017, 10:56 am

≫ Next: Obsolete Clients keep repopulating in Manager

≪ Previous: Excessive & Multiple Event ID 4673 on Event Viewer Security logs

$

0

0

I need a solution

Application Monitoring not working on Windows 10 (DLP agent 14.6)

Is this a known issue?

Maybe it (Application Monitoring) 'worked' until the 'Windows 10 threshold release' or something, but stopped after the Anniversary Release of Windows 10.

Is anyone else facing the same problem?

0

1497299411

Obsolete Clients keep repopulating in Manager

June 12, 2017, 2:21 pm

≫ Next: Proxy ASG Overview Files Blocked

≪ Previous: Application Monitoring not working on Windows 10 (DLP agent 14.6)

$

0

0

I need a solution

A recent divesture saw approximately 200 machines we formerly managed spun off to a new company that we no longer have any direct LAN connectivity to.

I noticed the machines were still showing in the manager and I deleted them all.

Four hours later and a couple of dozen had shown back up.

My assumption is the new company has not gotten around to reimaging the machines as they were supposed to, but how can I block these machines from showing up and HOW are they continuing to show up.

0

Proxy ASG Overview Files Blocked

June 12, 2017, 7:40 pm

≫ Next: SEP clients upgrading by themselves

≪ Previous: Obsolete Clients keep repopulating in Manager

$

0

0

I need a solution

Hi Friends,

Proxy ASG overview page has some counters like Files Blocked, Websites Blocked.

The Files Blocked count is very huge. I have not enabled inbuilt AV so I should not be getting any files blocked.

Is there a way to check whats those files were that were blocked?

Regards

Ravi

0

SEP clients upgrading by themselves

June 13, 2017, 2:37 am

≫ Next: Symantec Endpoint Protection (SEP) client-only patches

≪ Previous: Proxy ASG Overview Files Blocked

$

0

0

I need a solution

I am carrying out a staged SEP client upgrade from 12.1.X to 14.0.2349 using SEPM (recently upgraded to 14 MP1.

I am using the automatic upgrade method and doing it a group at a time.  I have created a temporary group which has the 14.0.2349 installation package assigned to it and am moving clients across to pick up the upgrade, then moving them back to their original group once it's complete.

I've started noticing some clients are already upgraded to 14.0.2349 when I come to check their group without having done anything. I double checked their group doesn't have the latest installation package assigned.  So what else could be causing this? 

0

Symantec Endpoint Protection (SEP) client-only patches

June 13, 2017, 6:14 am

≫ Next: PGP Command Line logging?

≪ Previous: SEP clients upgrading by themselves

$

0

0

I need a solution

The new Symantec Endpoint Protection (SEP) 12.1.6 MP8 client-only patches  is missing the upgrade client version for  12.1.7166.6700 (RU6 MP7)??

Any idea

0

PGP Command Line logging?

June 13, 2017, 6:56 am

≫ Next: LiveUpdate settings

≪ Previous: Symantec Endpoint Protection (SEP) client-only patches

$

0

0

I need a solution

Does PGP Command Line logs all commands and what was encrypted by calling PGP command? Where?

Regards,

Vladimir

0

LiveUpdate settings

June 13, 2017, 9:22 am

≫ Next: DCS Server / vShield Manager

≪ Previous: PGP Command Line logging?

$

0

0

I need a solution

Anyone enable their Live Update Scheduling?

What are the implication if it will turn on?

0

1497382765

---

DCS Server / vShield Manager

June 13, 2017, 10:00 am

≫ Next: Image files in email messages show up as attachments

≪ Previous: LiveUpdate settings

$

0

0

I need a solution

Hello,

I appreciate if anyone know if it's possible to use a DCS Server with a vShield Manager (without NSX), to administrate the virtual endpoints without installation of agents. Or it is definitely necessary a NSX?

I have this configs:

VM and DCS platforms:

• Esxi 5.5 -> 10 hosts (Windows servers)
• vCenter 6.0 -> 1 Datacenter
• vShield Manager 5.5.4
• DCS Server 6.7

vShield Manager was registered with a vCenter, and I deployed the vShiedl App, Endpoint and Data security.

I can't see my SVA in DCS server:

Thanks!

Felipe Medina.

0

Image files in email messages show up as attachments

June 13, 2017, 11:52 am

≫ Next: Upgrade from 12.1 to 14 on Domain Controller blocks clients

≪ Previous: DCS Server / vShield Manager

$

0

0

I need a solution

I have Outlook 2016 in a stand alone configuration (not corporate policy, just my laptop). When I receive email messages that have images embedded in them they always show up as attachments, not where they are supposed to in the message. When I send messages to someone else outside the organization with PGP they aren't seeing the same issue, even when we respond back and forth.

I am not certain what may be causing it to be treated this way or how to solve the issue.

0

Upgrade from 12.1 to 14 on Domain Controller blocks clients

June 13, 2017, 1:04 pm

≫ Next: Inability to pin the Symantec Console onto my screen

≪ Previous: Image files in email messages show up as attachments

$

0

0

I need a solution

I recently did an upgrade for a customer from 12.1 to 14. I upgraded the Enpoint Protection Manager on the server and then pushed out version 14 to all the servers and workstations on the network. Everything upgraded successfully, but after the upgrade none of the workstations were able to communicate with the domain controller. We had to uninstall Endpoint Protection from the domain controller. After that, the workstations were able to connect and regained network and internet access.

No changes were made to any policies in the manager as part of this upgrade, and everything worked find prior to the upgrade.

Can anyone point me to where I might look to make it so I can get Enpoint Protection reinstalled on the domain controller and still allow clients to be able to communicate with it? My first thought was to add the domain controller as an excluded host in the Intrusion Protection policy, but I've compared with our policies for other customers and that isn't something that is done all the time.

0

Inability to pin the Symantec Console onto my screen

June 13, 2017, 1:46 pm

≫ Next: Mac SEP Uninstall option

≪ Previous: Upgrade from 12.1 to 14 on Domain Controller blocks clients

$

0

0

I need a solution

I've upgraded to SEP 14.0 MP2 last week.  Previously, versions of the SEP management console were able to be pinned or placed on my desktop.  I don't(can't) put the link to the console on my desktop.  Therefore, in order for me to get into the management console client I have to go to   HTTPS://SERVERNAME:9090    and download the client  EVERYTIME. 

How can I pin it to my desktop?

0

Mac SEP Uninstall option

June 13, 2017, 11:44 pm

≫ Next: Allowing ports through the firewall SEP 12.1.6 RU6 MP5

≪ Previous: Inability to pin the Symantec Console onto my screen

$

0

0

I need a solution

Hi,

Currently I am using SEP 14 MP2. Is there any method to remove or grey out the "Uninstall" option? We do not allow our user to uninstall the SEP.

Thanks.

0

Allowing ports through the firewall SEP 12.1.6 RU6 MP5

June 14, 2017, 12:39 am

≫ Next: Applications blocking

≪ Previous: Mac SEP Uninstall option

$

0

0

I need a solution

I use a password holding program (Dashlane) and have been having issues with the passwords not be auto populating.

Their support have advised that I need to check certain ports are open on my firewall, however I cannot see how to ensure certain ports are open on my SEP

 i am running an unmanaged client

The instructions I have from Dashlane are:

In your firewall configuration, please add the following ports to the exceptions list:

• • 11456
  • 15674
  • 17896
  • 21953
  • 32934

Please make sure that the following processes are allowed (“whitelisted”) by your firewall:

• • C:\Users\%Username%\AppData\Roaming\Dashlane\Dashlane.exe
  • C:\Users\%Username%\AppData\Roaming\Dashlane\DashlanePlugin.exe

0

Applications blocking

June 14, 2017, 12:41 am

≫ Next: New install then migration

≪ Previous: Allowing ports through the firewall SEP 12.1.6 RU6 MP5

$

0

0

I need a solution

I have created the firewall rule like this and stopped all the apllications(Rule 0)(URL's) like youtube and facebook etc.But i want to enable some of the applications like below for that i have added one more rule(Rule1) in same policy.But those applications not working.Please tell me how to allow these URl's.

https://idisburse.icicibank.com:447/idecisions/ilo...     
http://www.mca.gov.in/mcafoportal/viewCompanyMaste...
https://aps.icicibank.com/ICICIWeb
http://10.24.153.133:6501/idecisions/ilogin  
http://banking.kdms.in/ICICILOAN/login.aspx
http://kdms.in/axisbankCRF/Login.aspx
http://192.168.84.190:9080/webdesktop/faces/login/...
http://banking.kdms.in/axisng/Transactions/Employe...
https://ssup.uidai.gov.in/home
https://ap2.salesforce.com/

0

• Untitled121.png
• Untitled122.png

---

New install then migration

June 14, 2017, 1:53 am

≫ Next: PGP Public Key

≪ Previous: Applications blocking

$

0

0

I need a solution

Hi,

We have 12.1.6 installed on a windows 8.1 pc and all clients are connected and all policies installed via group policy from our domain controller. As this won't install onto a windows 10 machine we

are looking at upgrading to the latest version but I know this won't install the management console onto a desktop version of windows. So we are looking at installing this onto our Windows Server 2012

what I need to know is the correct way to migrated these exsisting pc.

First step would be to install version 14 onto the windows server 2012, question is where do I get the software and do i have to log onto the web console and hit the upgrade button to initiate this?

Will this have any effect on the pc's already running 12.1.6 version? 

How do i migrate to the new version on the separate server?

Does the web console create a new license key when i press the upgrade button?

Has anyone encountered any issues doing a migration (firewalls getting old version of pc's etc)?

Any help and advice be appreciated

Brenden

0

PGP Public Key

June 14, 2017, 2:34 am

≫ Next: Connect Remote Sites using GUP

≪ Previous: New install then migration

$

0

0

I need a solution

We have running a PGP server.. so all email to a specific domain will be encrypted with a specific key.. but all incoming email from a specific domain should be decrypted again with a general company pgp key.

But..

If we email to a specific domain, it goes great.. The email will be encrypted.

But, when we recieve an PGP email from a specific domain, it won't decrypt. We see that the rule is checked, but it can't found the PGP public key.

The Public key is imported in the key store. But it looks like it is connected to a specific email address PGP@company.tld instead to everyone in the organization.

How can I change this?

0

Connect Remote Sites using GUP

June 14, 2017, 3:03 am

≫ Next: Symantec Bright mail gateway

≪ Previous: PGP Public Key

$

0

0

I need a solution

Hello,

I was looking for a solution to connect RemoteClients to my SEPM. I know from McAfee that I can use an Agenthandler to connect a different subnet and the clients communicate to the management server using this agent handler.

My first understanding of a GUP was that I can realize it the same way. At least for updating the policies and virus definitions.

In the picture you can see, what I want to realize. The GUP should work as a connection between two networks. The SEP Clients only have connection to the GUP, but not the the SEPM.

I already configured one client to work as gup but I cannot connect the other SEP clients. First I need to know if its generally possible?

Thanks

0

Symantec Bright mail gateway

June 14, 2017, 3:49 am

≫ Next: Error during install additional management server to an existing site

≪ Previous: Connect Remote Sites using GUP

$

0

0

I need a solution

Hello,

I want to create report for SBG (Symantec bright mail gateway). so, which type of information i should cover in that report.

0

Error during install additional management server to an existing site

June 14, 2017, 4:00 am

≫ Next: DB Schema Update for 12 to 14

≪ Previous: Symantec Bright mail gateway

$

0

0

I need a solution

Hi everyone

I have installed in my production system SEPM 14 MP2 on Windows Server 2008 R2, with embedded database, and everything works fine.

Now, I'm trying to install additional management server (same version SEPM 14 MP2) to an existing site (on Windows Server 2012 R2), and installation done succesfully,
Now, during management server configuration wizard I get the following error "Error 11501: Unable to connect to the database."

I notice that I have embedded database (not sql) on primary server.

Does anyone know what I need to do, how to continue with configuration wizard ?

Screenshot:

http://oi65.tinypic.com/21owyet.jpg

0