Hi - I'm probably doing something stupid here, but am working on a test HI policy to identify clients not rebooted for more than 60 days.
I have attached the policy requirement - it's a 'compare file age to' operation and the target file is c:\pagefile.sys, but when testing the policy it fails because the file is not found (screenshot also attached)
Am I doing sonething wrong, or is there an issue with HI checking files like this?
Thank you
Kevin
Hi all,
I am trying to set-up VIP 2fa with OWA 2010 on TMG 2010.
I followed the guide for Enterprise Gateway 9.8.0, generated the JavaScript and entered into the usr_pwd_pcode.htm file and restarted the TMG Firewall service and now get the error in the attached.
Any ideas?
We just switch to SEP's firewall and found the firewall's traffic log logs everythijng, both allowed and blocked, I can't find a way to disable the log or just record the blocked traffic. Is it possble to do that?
Hi all,
I've been having issues with the Encryption 10.3.2 software as it pertains to the Windows 10 updates. For the last few months, the Windows 10 update isn't able to update through the encryption software. This has resulted in Windows re-downloading the updates and restarting my computer daily. If this can be addressed without too much hassle, I wouldn't mind keeping the encryption software on my computer.
If there isn't a fix for the Windows Update problem, then the problem is slightly more difficult as my computer was encrypted by my school (now 1500 miles away) and I am unable to personally decrypt my drive. I don't have anything valuable on my SSD since I store everything on a cloud so I'm open to restoring to factory settings/reformatting, as long as I know that the encryption software would also be removed and that it wouldn't hinder this process.
Could you advise me on how to proceed?
Thanks!
I needed to remove PGP from a Windows 7 laptop. I unencrypted the 480GB drive without issue and then uninstalled PGP and rebooted – the laptop then blue-screened and has never successfully booted since.
I ran Windows Repair Disk to no effect - told me the partition existed but with 0 MB. Hoping to salvage the data, I pulled the drive and tried to mount it to another Windows laptop via a SATA-to-USB adapter - Windows replied that the drive needed to be formatted before it could be used. I tried the same on an Ubuntu laptop - the error message stated the 120GB drive couldn’t be mounted.
Catch that? The drive I had was 480GBs but it was now reading as only 120GBs. About 3 months ago, I cloned my old 120GB to a new 480GB and then used DISKPART to expand it out – worked perfectly, no issues at all since then either.
So, my working theory is: PGP was installed on a 120GB drive and essentially “seized up” due to some sort of programmatical error when it was uninstalled from the same drive, which was now somehow much larger. This in turn corrupted the partition or MBR somehow.
The data on the drive is of significant importance and (of course) my back-up failed as well, so I would welcome any suggestions. Thank you in advance.
Hello all,
I would need your kind suggestions on below two Category for Executing the Script:
1. SCRIPT CONTENT (As per my understanding, we need to paste the Script here)
2. EXECUTE THE COMMAND (Use %F% to specify the script file name)
And what should be given here in the Execute command Category..
As we had tried multiple times with file name and location of the shared drive for the file to execute.
Still the Script seems to be not downloading through policy or executing when applied through Policy from SEPM.
But the same script works fine when just executed directly from the shared location.
Some one who had already worked on HI Script configuration, please advise....
I had migrated the DLP enforce to another server. The INCIDENT_SNAPSHOT variable in email notification response rule is showing old server name insteading of new server name in the URL. How can I fix that?
Is the date broken again? we're seeing same issue? please help.
Hi All,
How to add Destination IP to Proxy Access Logs for Explicit proxy? I have trid to added fields (cs-ip) below but destination ip has display ip of proxy.
Fields: localtime time-taken c-ip sc-status s-action cs-ip sc-bytes cs-bytes cs-method cs-uri-scheme cs-host cs-uri-stem cs-username s-hierarchy s-supplier-name rs(Content-Type) cs(User-Agent) sc-filter-result sc-filter-category x-virus-id s-ip s-sitename
"[14/Nov/2017:21:36:37 +0700]" 6 10.0.2.10 200 TCP_NC_MISS 10.0.2.177 362 936 GET http sal.isanook.com http://sal.isanook.com/sa/c - - sal.isanook.com image/gif "Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like Gecko" PROXIED none - 10.0.2.177 http.proxy"[14/Nov/2017:21:36:37 +0700]" 6 10.0.2.10 200 TCP_NC_MISS 10.0.2.177 362 936 GET http sal.isanook.com http://sal.isanook.com/sa/c - - sal.isanook.com image/gif "Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like Gecko" PROXIED none - 10.0.2.177 http.proxy"[14/Nov/2017:21:36:37 +0700]" 6 10.0.2.10 200 TCP_NC_MISS 10.0.2.177 362 937 GET http sal.isanook.com http://sal.isanook.com/sa/c - - sal.isanook.com image/gif "Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like Gecko" PROXIED none - 10.0.2.177 http.proxy"[14/Nov/2017:21:36:37 +0700]" 7 10.0.2.10 200 TCP_NC_MISS 10.0.2.177 362 937 GET http sal.isanook.com http://sal.isanook.com/sa/c - - sal.isanook.com image/gif "Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like Gecko" PROXIED none - 10.0.2.177 http.proxy"[14/Nov/2017:21:36:37 +0700]" 6 10.0.2.10 200 TCP_NC_MISS 10.0.2.177 362 936 GET http sal.isanook.com http://sal.isanook.com/sa/c - - sal.isanook.com image/gif "Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like Gecko" PROXIED none - 10.0.2.177 http.proxy"[14/Nov/2017:21:38:38 +0700]" 1 10.0.2.10 200 TCP_ACCELERATED 10.0.2.177 39 223 CONNECT tcp www.facebook.comtcp://www.facebook.com:443/ - - 10.0.2.177 - "Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like Gecko" PROXIED none - 10.0.2.177 http.proxy"[14/Nov/2017:21:38:44 +0700]" 1 10.0.2.10 200 TCP_ACCELERATED 10.0.2.177 39 233 CONNECT tcp staticxx.facebook.com tcp://staticxx.facebook.com:443/ - - 10.0.2.177 - "Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like Gecko" PROXIED none - 10.0.2.177 http.proxy"[14/Nov/2017:21:38:47 +0700]" 2 10.0.2.10 200 TCP_ACCELERATED 10.0.2.177 39 215 CONNECT tcp cx.atdmt.com tcp://cx.atdmt.com:443/ - - 10.0.2.177 - "Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like Gecko" PROXIED none - 10.0.2.177 http.proxy
Thank you,
Teerasak
When I attempt to use 2fa with Amazon login the code created by VIP Access on my Android phone never works. The time is automatically set and Google Authenticator always works.
Hello,
During peak internet traffic times, we are noticing(through pcaps on client and proxy) that it takes the proxy sometimes up to 7 seconds to send an HTTP GET request to the internet, on behalf of the client.
Let me make clear that we do not see this during non-peak internet traffic times.
This obviously leads to very slow web browsing performance and has been confirmed with speed tests(sometimes 0.2Mbps, while the pipe is 20Mbps) and general internet browsing from the client PC.
What I can say for sure is that, sometimes, the Proxy receives the HTTP GET request from the client, ACKs the client's GET request, and then sits and waits for 5-7 seconds before sending out the GET request to the internet on behalf of the client.
Has anyone seen this behavior before? This is having a huge impact on our users.
Thank you,
Al
So about a week ago I upgraded my SEP 12.1.6 MP7 SEPM to 12.1.6 MP9...since that time I have been getting the following error via a SEPM email notification:
Server SEP12DevServer health status: poor.
Reason: Memory on your Symantec Endpoint Protection Manager server is running low.
Status reported on Nov 13, 2017 8:48:58 PM.
Since this is a dev server, and never has more than 50 clients connected at a time, I had been running blissfully along with 2GB of RAM. Since the upgrade to MP9, I have been getting the memory error above, so I upgraded the memory (it's a VM running server 2012) to 6GB, and I'm still getting the email notification. Any thoughts if this is a memory leak issue, or does MP9 really need more RAM? Maybe a reinstall/repair? Here are the top few processes on that server:
Thanks for your time,
-Mike
Im on version 7.5, for some reason when closing out of the app the threshold number gets reset and and doesnt save the manual score I put in. When I re open a prompt comes up with a validation error stating i need to change the value of a positive integer between 25 and 89 when selecting premium antispam settings. Ive been adding the default of 72. Anyone come across this issue?
I have downloaded Symantec endpoint protection from my University website. The University recommends it. However when I open the site on my laptop it says that it needs a reboot. I have restarted the computer several times but it continues to say the same.
Also how can I be sure that the Firewall is operational and I am protected,
Thank you
The SEP client at Mac machine grabs the definition update from LUA. Only a few machines at the same Mac client group unable to install the Network Threat Protection definition. Showing Definition N/A. Logs between the machine that is getting updates and from the machine that is failing are exactly same.
Had tried all the suggestion from Symantec support (run intelligence update, reinstall the SEP14 MP2 and upgrade to SEP14 RU1), but no help at all.
I have does exceptions on the SEPM the D through Z drivers but still not working. Windows server are 2008. Can you please provide the solution for the same.
I need help in installing the certificate in SEE 11.1.3
Hello,
I need a solution to an issue I have been facing since long, I have 100's of systems divided in containers in SEPM as per the location they are residing.
My query is, is there a way that I can add a license file to SEPM and guide it to be only deployed to a single container and not all containers specified in SEPM.
I ran into an issue, where I added licese file in SEPM and it was deployed across all containers randomly exhausting the license count. I need to deploy licese to a single container and not to all containers created at SEPM to bifurcate the systems.
Thanks in Advance !!
bonjour;
au niveau de la console SEPM après la mise à niveau (Upgrade) de la solution Symantec endpoitn protection de la version 12.1.6MP4 vers la version 14MP1;
je n'ai pas trouvé les packages d'installations de la nouvelle version " Console SEPM --> Admin -->install Package --> client install pachages"
Alors j'ai voulu l'jouter manuellement " Symentes Endpoint protection manager 14MP1 --> SEPM --> Package --> SAV32.INFO"
un message d'erreur s'affiche à la fin de l'action (prière trouver ci-joint le message d'erreur)
In addition to upgrade SEP to SEP 14.0 RU1 or SEP 12.1 RU6 MP9 that have any other way, we can do?
can we know the version under the 14.0 RU1 or SEP 12.1 RU6 MP9 would be affected by AVGater ?