Hello,

I write this message because I have to install a SEP manager and SEP client and my client ask me a question about license.

My client wants to know if it is possible to get back a license for a SEP client when we remove SEP on a computer client with Windows 7 Operating Systems.

Best Regards,

Brice

Hey guys,

I have obtained the responsibility to manage the PGP Universal Server in our organization. I have a general understanding of encryption mechanisms, but I'm going to improve them and I have to get familiar with the Universal Server.

My forerunner never has checked the functionality of the ADK and therefore my manager has instructed me to test any possible scenario in connection with encrypted files or emails if a corresponding employee leaves the company how to get access to the encrypted items with ADK usage.

So I already read the ADK guidelines...

https://support.symantec.com/en_US/article.TECH149...

which describes pretty well how to access files, a mounted disk or a whole computer. But I find no proper description, how to open a foreign mailbox or to read the encrypted mails with the ADK key.

So my questions are:

• How can I access encrypted mails of leavers in Outlook with ADK?
• How does this all behaves if the mails are encrypted and archived by Enterprise Vault as well?
• How will it work in Discovery Accelerator in case of a security audit?

Thanks in advance.

regards,

Christian 

Hey guys,

I have one PGP user who has got trouble with his PGP Desktop application. It started with having policy issues. He tried to send a mail to a non-PGP user. Unfortunately he receives a NDR that this is not possible, due to policy reasons, there is no keyring for the recipient. So the application was not able to decide to use encryption or not, it always tries to encrypt for all recipients.

Then I removed the PGPpolicy.xml files from "%appdata%\PGP Corporation\PGP"
After a restart the PGP Desktop seems to download the policies again, but the former situation of alltime encryption occurs as well.

Then I removed both *.xml files from "%appdata%\PGP Corporation\PGP" to trigger a full re-enrollment.

Unfortunately the PGPtray.exe is not willing to come up. Even after a restart. The first uninstallation try failed as well, the process did not finish. After a repair of the application I was to install a newer version of PGP Desktop (I recognized that he still used 10.1.0.860 while the other users already got 10.2.1.5033). I even tried the 10.3.2 MP11 after a clean installation. PGPtray.exe keeps beeing lazy and a start of the PGP desktop app provides this error...

User is not on VPN, can access all other resources, can access https://myPGPserver.com/b/l.e

I have looked up the eventvwr, but unfortunately I did not find obvious error messages.

How could I solve this one?

Universal server: 3.2.1 MP5

Thanks in advance.

regards,

Christian

We are unable to login to our SEPM console or start the service. The Catalina logs shows an issue connecting to the database which is loctaed a dedicated sql server.

[TraceMgr] Opening log file S:\Program Files\Symantec\Symantec Endpoint Protection Manager\tomcat/logs\ajaxswing.log
Protecting dada/output/agent folder with ACLs ...
Has valid SAV license
Info>> No SNAC license file in S:\Program Files\Symantec\Symantec Endpoint Protection Manager\tomcat\etc\license
Inside startup service Init
Could not connect to the database, wait for 1 second to retry... caller: getDataSourceDBConnection

Could not connect to the database, wait for 1 second to retry... caller: getDataSourceDBConnection
Could not connect to the database, wait for 1 second to retry... caller: getDataSourceDBConnection
Could not connect to the database, wait for 1 second to retry... caller: getDataSourceDBConnection
Could not connect to the database, wait for 1 second to retry... caller: getDataSourceDBConnection
Could not connect to the database, wait for 1 second to retry... caller: getDataSourceDBConnection
Could not connect to the database, wait for 1 second to retry... caller: getDataSourceDBConnection
Could not connect to the database, wait for 1 second to retry... caller: getDataSourceDBConnection
Could not connect to the database, wait for 1 second to retry... caller: getDataSourceDBConnection
Could not connect to the database, wait for 1 second to retry... caller: getDataSourceDBConnection
Could not connect to the database, wait for 1 second to retry... caller: getDataSourceDBConnection
Could not connect to the database, wait for 1 second to retry... caller: getDataSourceDBConnection
Could not connect to the database, wait for 1 second to retry... caller: getDataSourceDBConnection
Could not connect to the database, wait for 1 second to retry... caller: getDataSourceDBConnection
Could not connect to the database, wait for 1 second to retry... caller: getDataSourceDBConnection
Could not connect to the database, wait for 1 second to retry... caller: getDataSourceDBConnection
Could not connect to the database, wait for 1 second to retry... caller: getDataSourceDBConnection
Could not connect to the database, wait for 1 second to retry... caller: getDataSourceDBConnection
Could not connect to the database, wait for 1 second to retry... caller: getDataSourceDBConnection

This has only started happening yesterday evening, no changes have been made to the DB's or SEPM, any ideas?
 

We are unable to login to our SEPM console or start the service. The Catalina logs shows an issue connecting to the database which is loctaed a dedicated sql server.

[TraceMgr] Opening log file S:\Program Files\Symantec\Symantec Endpoint Protection Manager\tomcat/logs\ajaxswing.log
Protecting dada/output/agent folder with ACLs ...
Has valid SAV license
Info>> No SNAC license file in S:\Program Files\Symantec\Symantec Endpoint Protection Manager\tomcat\etc\license
Inside startup service Init
Could not connect to the database, wait for 1 second to retry... caller: getDataSourceDBConnection

Could not connect to the database, wait for 1 second to retry... caller: getDataSourceDBConnection
Could not connect to the database, wait for 1 second to retry... caller: getDataSourceDBConnection
Could not connect to the database, wait for 1 second to retry... caller: getDataSourceDBConnection
Could not connect to the database, wait for 1 second to retry... caller: getDataSourceDBConnection
Could not connect to the database, wait for 1 second to retry... caller: getDataSourceDBConnection
Could not connect to the database, wait for 1 second to retry... caller: getDataSourceDBConnection
Could not connect to the database, wait for 1 second to retry... caller: getDataSourceDBConnection
Could not connect to the database, wait for 1 second to retry... caller: getDataSourceDBConnection
Could not connect to the database, wait for 1 second to retry... caller: getDataSourceDBConnection
Could not connect to the database, wait for 1 second to retry... caller: getDataSourceDBConnection
Could not connect to the database, wait for 1 second to retry... caller: getDataSourceDBConnection
Could not connect to the database, wait for 1 second to retry... caller: getDataSourceDBConnection
Could not connect to the database, wait for 1 second to retry... caller: getDataSourceDBConnection
Could not connect to the database, wait for 1 second to retry... caller: getDataSourceDBConnection
Could not connect to the database, wait for 1 second to retry... caller: getDataSourceDBConnection
Could not connect to the database, wait for 1 second to retry... caller: getDataSourceDBConnection
Could not connect to the database, wait for 1 second to retry... caller: getDataSourceDBConnection
Could not connect to the database, wait for 1 second to retry... caller: getDataSourceDBConnection

This has only started happening yesterday evening, no changes have been made to the DB's or SEPM, any ideas?
 

I recently had an issue where some micorosoft patching broke the LUA and it's database to the point where I could not use the inbuilt troubleshooting tool to create logs for symantec. 

Would it be possible to build the tool into the symhelp tool to do basic checks on the LUA and collect logs required for troubleshooting. 

I wanted to share with you about the most powerful tools that all IT peeps need to be aware of. It can help you to troubleshoot. It can help you to find what files are being written to the hard drive. It also can help you to monitor what is happening in the background.

And what are these tools?

They are Sysinternals!

A handful of small applications that will make your lives & jobs a LOT easier. Be the Geek of the department. (or something like that)

The best thing about these tools, do you know what it is? It's FREEWARE!

My favourite are:

* AdExplorer - Active Directory Explorer is an advanced Active Directory (AD) viewer and editor.
* BgInfo - Fully-configurable program automatically generates desktop backgrounds that include important information about the system (IP addresses, computer name, network adapters, etc)
* DiskMon - Utility captures all hard disk activity or acts like a software disk activity light in your system tray.
* SysMon - Monitors and reports key system activity via the Windows event log.

And the best ones that I use most of the time...

* Process Explorer - Find out what files, registry keys and other objects processes have open, which DLLs they have loaded, and more. This uniquely powerful utility will even show you who owns each process.
* Process Monitor - Monitor file system, Registry, process, thread and DLL activity in real-time.

You can download one of them from Microsoft Sysinternals website - https://technet.microsoft.com/en-gb/sysinternals/bb545027

Or download the whole thing - Sysinternals Suite - https://technet.microsoft.com/en-gb/sysinternals/bb842062

So what tools do you use to troubleshoot? Do share!

Dear all,

i have recently joined a company who installs Symantec Encryption Desktop (Ver:10.3.2) but for some reason never bothered setting up the server as well, as a result when users forget their password or have it reset by the Help desk if the single sign on component doesn't pick that up ok users are locked out of their PC - for good, and all documents are lots not to mention the issue for a user who can't work till a new one is built.

when i installed mine, i was given at the end of the install a "Whole Disk Recovery Token" which i could use in case i am locked out. is there any way i can generate that again to all my existing users? from the GUI or command line?

all the posts i have read were talking about having also a server which can generate such which i obviously don’t have. i want to be able to go one user at a time and simply generate the key and save it securely so when they call me when locked out i can save them.

Thank you in advanced

Oren

Hi to all,

I need to unistall SEP 12 on widows 7, whe I try to uninstall SEP requires a password.

I' tryed to disable password request by regedit but I cant find how to.

Following my registry tree

Following SMC detail

How can I disable password request?

Thanks

Thinking of installing IT Analytics. Do you have it installed and what are the pros and cons?

Thanx

Bonjour,

SVP, je veux savoir si la version de SEPM RU6 MP3 s'installe sur Express SQL 2008.

Salutations

I'm running Windows 8, and have been using Endpoint Protection that I received though my university when I was a grad student. I am now trying to upgrade to Windows 10, but when I try to do the upgrade, Windows is telling me that I need to uninstall Endpoint Proetection to proceed. However when I try to unistall Endpoint Protection the uninstall wizard cannot complete, and either fails or starts to rollback once the process has been nearly completed.  So I'm now stuck  - I can't uninstall Endpoint Protection and I therefore can't upgrade to Windows 10. Any thoughts on how to get Endpoitn Protection unistallated would be much appreciated.

Thanks!

Home system.  Unmanaged client. In a workgroup of 3 pcs (no Macs), with wireless connectivity through the router to smart phones (2) and Android tablets (2) and a Chromcast dongle.  Wired printer direct to the router.  Just recently in the last two weeks, I started getting this now famous, "Symantec has been blocked for the following application svchost.exe" warnings every 3-4 minutes.  Only appears on one PC.  Searched around these forums - many problems similar to mine but not exactly alike.  Looked at IPv6 implementation - it's turned off.  The first line is a good sample of the logged entry...

So, what is it looking for?  I've attached screenshots of the traffic log, tryng to figure out exactly what device this PC is looking for.  The address:  239.255.255.250 responds to ping but it's outside my network.  Looks sketchy but perhaps it's in the "multicast" range - is that the Chromecast dongle?  It's said you need to do detective work to find out what device  (uPNP) the computer is looking for.  But my question is:  What's exactly meant by "detective work?"

If I can't figure this out, I'd be willing to "ignore" the alert.  How can I set SEP to ignore this alert so that I'm not constantly pestered by it?

Thanks.

Herbo

See Symantec Case # 09837979 

Please enable fthe following features on Windows Servers which habe the SEP Cloud  Agent installed:

• Allow better firewall tuning doirectly on the server. Do not refer to report creation on the cloud console
• Allow to watch live on the client/agent what happens on firewall traffic. It should be possible to see blocked/allowed events and then allow blocked events by adding the blocked ports directly to the exclusion/allowed list (firewall rules). This shoudl be refelected on the cloud console. The cloud console should allow to turn per server rules/exceptions into generic rules applicable to other servers as well.
• IMPORTANT: it must be possible to temporarily disable the firewall directly on the server. This si possible for desktop clients. Why not also for servers? Very important for troubleshootingt
• Firewall rules should be allowed based on executables. This was the case in SEP 12.1 (non-cloud)

Thanks

Daniel

Hi all , I just wanted to confirm is there any limitation on the maximim number of clients that can be installed via remote push with SEPM 12.1.6 MP3 .

For example if the total number of clients increases X remote deployment will fail or is it not.

thanks

Hi,

We have 18 machines running various operation systems (Windows 7/8/10, Windows Server 2008 R2/2012/2012 R2) and most are failing to update automatically. If LiveUpdate is run manually on these machines, they update properly. Most of the time it is the IPS Signatures, SONAR Content, and the Download Protection Content that are out of date, but the Antivirus Content is also becoming an issue. The machines are rebooted vary infrequently due to them being mission critical servers, but when they are it rarely rectifies the issue. Most of the desktops are experiencing the same issues as the servers too, and they are rebooted more often. I don't believe it to be a problem with the SEPM itself because there are some machines that are kept completely up-to-date and they have (more or less) the same configuration as the other machines. I've looked everywhere but have been unable to find a resolution. 

Thank you for any help/advice in advance.

Hi Guys,

I have to uninstall more than 50 agents DCS:SA v. 6.5 MP1. I tried in five Windows and all is frozen with the next image:

Before attempting to uninstall, i entered in safe mode and disable the IPS with the command sisipsconfig -ipsstate off.

Please, which is the correct procedure for a successfull unistall..?  (Windows and Linux).

Thanks.

Hi Everyone,

How are you doing?

I need a help to configure my application and device control policy to block access to IPhone devices, but still charging normally.

Actually, I’ve configured a policy to block by class ID and it’s working fine, but just for IPhone I can’t charge my device.

I got the class ID using dev viewer and I know that others smartphones has the same class ID (example: Samsung Galaxy S5) and for these devices the policy is blocking as I want and charging normally.

Does anyone know about that?

This issue is only for IPhone devices?

Thanks for all!

Regards,

Lopes

We have been using PGP Desktop and WDE for awhile now in the enterprise and are working on integrating smart cards for physical and system access. As part of this, of course, we would like to use the smartcard to get past the PGP Bootguard screen.

I am testing with (2) Win7 x64and (1) Win10 x64 and three different USB readers. I have verified that the boot mode is BIOS and not UEFI.

I am using SED 10.3.2 MP11 on all three.

SCM SCR3310 (roundish black and grey with wire)
SCM SCR3500 (foldable usb stick format)
Identive CLOUD 2700 R (white square with wire)

The first thing I notice is that there seems to be a bug where SED will crash when a USB reader is pulled. This has happens every time on the three machines I am testing with.

In my testing the first question I see is "why does my "smartcard keys" section in SED not always contain a key? This prevents me from being able to "Add User Key" on the PGP Disk screen. The second question is: "When I do have a key, why can't I add it to the WDE?"

So to start off with, when I plug in a smartcard, SED comes up with the "Import Certificate Assistant" asking for the card passphrase (pin).

__________________________________________________

If I click cancel it will ask me a total of three times (on Win10) before giving up. It will ask once on Win7. Either way, it generates three keys which appear to be the same three IDs even on different machines. The three keys are in the "All keys" and "smartcard keys" sections.

When the card is unplugged, two of those keys will immediately become italicized visually (but the green check "unverified" only happens sometimes?). The third key remains verified, and this is the key that is available on the PGP WDE when "Add User Key" is clicked.

__________________________________________________

If I use the "Import Certificate Assistant" instead of cancelling, I enter my pin twice (once for SED and once for the card) and it generates a key on the keyring. On Win7, the certificate imports in about 4 seconds.

On Win10 it gets stuck on "generating." I waited 5 minutes and canceled. The "cancelling" status stayed. Again, I wait for 5 minutes and then pulled the card. Another minute later the cancel button is "un-greyed" or I see a popup message "An error has occurred: bad parameters." At this point the "All keys" section may or may not contain an imported key from the smartcard. But when I plug the card back in, SED often hangs up and becomes unresponsive. If there is an imported key in "All keys" it will not be in the "smartcard keys" section so I assume that adding it to the smartcard keys is the item or is supposed to occur after what is failing.

That at least partially answers the question. If there is no key in "smartcard keys" then the "Add User Key" button will not be enabled on the PGP WDE screen.

In testing I have deleted the keys it adds in order to try it again. Without the card plugged in, it warns me that either a public or a private key is being deleted. I am not sure why it would be one or the other. If the card is still plugged in, I have seen a message indicating that the private key will be deleted *from the card itself* and so I unplugged the card before deleting the key because I don't know if it will really do it. I can tell visually which keys are generated from my card because the last name is always in caps.

Referencing these links shared by Mike Ankeny (Thank you) I tried to generate a new key on the smartcard. The checkbox is there and is populated by the smartcard manufacturer and model (NXP JCOP31 80K) but the box is greyed out. That shows me that SED recognizes the card (and the fact that the personal cert from it has already been imported.) This could be simply my lack of knowledge about it; maybe a smartcard is not a valid token type to generate a key on.

Moving toward adding a key to the WDE:

On a machine that has a smartcard key and WDE, I select the PGP Disk tab and the disk. The "Add User Key" button is greyed out unless the smartcard is plugged in AND the "smartcard keys" section contains the key. If I have those two items it allows me to click the button and select the key in the list. There is only #3 (of 3 created) in the list. The "Smartcard keys" tab at the top of the key selection box is the only one I can choose. But once I choose the key and enter the disk passphrase, I see the message "Unable to add the user to the disk group" and the user is not added. There is nothing in the SED log about why it does not work.

I was able to add the user once by unplugging the card while on the PGP Disk screen and using the dropdown above the WDE user list and choosing the key (again it was the only one available but the ID is #1 of 3 created). Then it added the user. I deleted the user from the WDE and played with it a bit and not been able to repeat that process successfully with the card in the reader. I was able to pulling the card while on the PGP Disk screen (the button didn't disable), and when I added the key at that time there was no complaint. The key stuck with the WDE through a boot, however none of my USB readers would light up at the bootguard screen (on laptop) and the bootguard F7 token entry didn't take. According to the helpfile:

Note: Token authentication in PGP BootGuard requires pressing Ctrl+Enter instead of just Enter. You may also experience some delay during the authentication of tokens in PGP BootGuard. For Windows systems booting in UEFI mode, token-based authentication is not available.

But the "Ctrl + Enter" option does nothing but type an extra invalid character (shown if characters are displayed).

On a tower machine the reader would light up, but the other results were the same.

Ocassionally when testing, unplugging and re-plugging the card SED would fail to update the key status on the keys screen. The card would be plugged in and yet the keys would remain unverified and the smartcard keys would show nothing. When this happened I would have to stop and restart SED and the PGP services.

I would love to know what I'm missing if anyone has insight.