This readme has been translated into other languages. Your browser may automatically have switched to your chosen language. If it has not switched, click one of the links below.

You can find the latest information about migration at the following Web site:

http://www.symantec.com/endpointsecurity/migrate

The management server automatically upgrades a Symantec Sygate Protection Agent version 5.1 to a Symantec Endpoint Protection MR4 client by using a 32-bit client installation package, and not a 64-bit client installation package. This occurs only if you are migrating from Symantec Sygate Enterprise Protection MR8 MP1 or earlier to Symantec Endpoint Protection MR4.

The SSEP 5.1 MR8 agent cannot determine whether to request the 32-bit client installation package or the 64-bit client package for download from the management server. Therefore, the 32-bit client computer might receive the wrong package.

To work around this issue, create a group for 32-bit computers and a group for 64-bit computers. Then, deploy the appropriate package to each group.

Legacy Symantec AntiVirus and Symantec Client Security servers create and use a shared directory. The location of the shared directory is \\Program Files\SAV. The name of the share is VPHOME. In some instances, after migration to Symantec Endpoint Protection client, this directory and share is retained with read-only permission.

If you install a Symantec Network Access Control unmanaged client on a computer, and then install a Symantec Endpoint Protection client as an upgrade on the same computer, you must manually restart the computer. No restart prompt appears. The Symantec Endpoint Protection client status is colored red until this restart occurs.

To run Symantec Protection Center or the Symantec Endpoint Protection Manager Web console, you must enable mixed content in Internet Explorer. To enable mixed content, click No in the Security Warning dialog box that appears when you first log on.

[1873313]

Making these changes is not currently supported. Symantec recommends that you leave the text size at the default setting of Medium.

[1925419]

If you edit host configuration settings in Symantec Brightmail Gateway, the server stops responding. You must restart Symantec Protection Center from the initial launch page.

[1987516]

In some situations, Symantec Protection Center requires the use of a proxy server. To configure the proxy server, edit the portal.properties file to include the appropriate settings. The portal.properties file is located in the <install_SEPM_directory>\tomcat\portal folder. These properties are specified only on the server. Nothing needs to be done on the client.

You can set the following properties:

[1991950]

If you choose the Right-To-Left Document option in Internet Explorer, an extra space is displayed at the left end of the text.

[1925425]

If you install the Symantec Endpoint Protection Manager on a French version of Windows Server 2008 or Windows Vista, some folder names appear in English.

If you use a proxy server to connect to Symantec LiveUpdate, you can configure Windows Authentication for the proxy server. In the Server Properties dialog box for the proxy server, on the Proxy Server tab, check Use Windows Authentication. When you enable Windows Authentication, use <user>@ <domain> or domain\user for the user name format.

The default port for non-encrypted communication (HTTP) with the Symantec Endpoint Protection Manager has been changed from 80 to 8014. Encrypted communications (HTTPS) continue to use port 443. This port setting applies to all types of Enforcers.

If you configure the console timeout feature on Windows Server 2008, the console might stop responding and not close properly. Also, the management server might not open the Home, Monitors, and Reports pages. This problem occurs when Windows Server 2008 User Account Control is enabled.

To work around this issue, disable the Windows User Account Control.

This issue occurs only on computers that run Sun JDK 6 upgrade 4 or earlier. To solve the issue, upgrade the JDK to version 6 update 5 or later. Version 6 update 14 is recommended. This issue is caused by a known Sun defect (id 6514454).

If the computer that logs on remotely does not have a JDK , Symantec Endpoint Protection automatically installs the correct version of the JDK.

If the database goes down for any reason, the management server notifies an administrator at the email address that you specify. However, if you do not specify the email address, the management server does not send a notification.

You can specify the email address when you install the management server or when you create an administrator account.

Client computer names that contain an equal sign (=) or double quote (") in the Computer description display an error in the scm-server-0.log.

If you set up two sites as replication partners, you must allow access for the replication servers in each site in the Server Properties dialog box. If you do not allow access, replication fails.

To allow access to the replication partner servers, see Chapter 14, Managing servers, of the Administration Guide for Symantec Endpoint Protection Manager and Symantec Network Access Control. Review the section on "Granting or denying access to remote consoles."

Symantec Endpoint Protection Manager provides I18n support for Microsoft SQL Server 2005 and later but not Microsoft SQL Server 2000. To provide I18n support for SQL Server 2000, the management server must enable batch mode processing.

A location awareness criterion that is based on a Check Point VPN connection is only supported with a Check Point VPN client version R56 or later.

If a network currently supports Check Point VPN client version R55 or lower, you must upgrade the Check Point VPN client to version R56 or later. Check Point VPN client version R56 or later supports location awareness on the Symantec Endpoint Protection Manager.

In Maintenance Release 2 or later, you can use the management console to change the number of content revisions to keep on the management server.

In previous versions of the Symantec Endpoint Protection Manager, you can change the number of content revisions by setting the scm.lucontentcleanup.threshold parameter in the conf.properties file. In Maintenance Release 2 or later, the parameter is removed from the file.

The default for the number of content revisions to keep is 3. If you upgrade from a previous release, the management console uses the scm.lucontentcleanup.threshold (if you set it in a previous release) instead.

The Symantec Endpoint Protection Manager server supports a uni-lingual user interface. This means that a specific language operating system can only install and run that same language on the Symantec Endpoint Protection Manager console. You must configure the user locale to be the same as the operating system language to use the Symantec Endpoint Protection Manager console.

If you repaired the Symantec Endpoint Protection Manager through the Support Information window in Add or Remove Programs, you cannot log on to the Symantec Endpoint Protection Manager again.

After you configure database maintenance options, the new options are applied at midnight, and not immediately.

To configure the management server to apply the database maintenance options immediately, you can configure the conf.properties file.

If an existing Symantec Sygate Enterprise Protection 5.x database is upgraded to this release, in rare cases the wrong details information may display. This problem only occurs if a great many client log entries were generated in the database in a very short span of time.

Do not add the name of an administrator by using double-byte characters in the Symantec Endpoint Protection Manager. If you use double-byte characters, the administrator can no longer log into the Symantec Endpoint Protection Manager console with an Internet browser. The attempt to log into the Symantec Endpoint Protection Manager console fails. However, the administrator can still log into the Symantec Endpoint Protection Manager Java console directly rather than using an Internet browser.

Tomcat does not recognize the localhost loopback IP address in IPv6. This problem occurs on computers that run Windows 2008, Windows Vista, and Windows 7. To work around this issue, use the IP address 127.0.0.1 in the URL instead of localhost.

For example, when you use http://localhost:9090/servlet/ConsoleServlet? ActionType=ConfigServer&action=CleanGroupPolicy to delete policy data in the Symantec Endpoint Protection Manager database, you should use 127.0.0.1 in the URL instead of localhost.

On Windows 2008 computers, a Java Development Kit (JDK) issue causes the Symantec Endpoint Protection Manager console to crash when you type simplified Chinese characters in a field. On 64-bit versions, this problem occurs when you type any number of characters. On 32-bit versions, it occurs only after you type 26 characters in a field. This problem occurs with Java Development Kit 1.6 and later, and may occur with earlier versions.

If you set up two sites as replication partners, and then add a secondary server to the first site, replication from the second site will not find the secondary server at the first site.

Solution: Restart the first site's primary server and re-run replication. The restart will reload the "localPartner" structure and replicate it.

[1958522]

Whenever a site updates to a new certificate, all partners must trust this new certificate before they can do replication with the updated site. Follow the instructions in the Manage Server Certificate wizard to import and trust the certificate.

[1884408]

This section describes general policy-related issues.

The client may take a long time to download content from the Symantec Endpoint Protection Manager if it tries to connect to an invalid management server IP address. This condition can occur for a management server that has multiple IP addresses. Some management servers have multiple IP addresses because they have multiple NICs or VPN software installed. In the console, the default management server list for each management server contains all the available IP addresses for that server. In many cases, only one of those IP addresses is valid.

After the policy changes, the client randomly selects a server in the management server list from which to download the latest policy for load-balancing purposes. The client might not be able to connect to the server with that particular IP address. The client then tries to connect to each server in the management server list until it finds a valid server. These connection attempts delay the downloading of content.

To work around this issue, define a new management server list for the server. As an alternative, remove all the IP addresses from the existing list that the clients cannot reach. Then assign the management server list to a group: click Clients > Policies followed by Communication Settings.

An unmanaged client cannot update any policy that has been deployed with older management server versions and a third-party tool. Although the third-party management tool has to update the policy in the content package, the client does not process the legacy policy file. This problem occurs if you run Symantec Endpoint Protection Manager Maintenance Release 2 or earlier with the Symantec Endpoint Protection clients Maintenance Release 4.

To work around this issue, update the management server to Maintenance Release 4 first before you deploy the policy file to the clients.

If you import a policy, provide a name that is no longer than 255 characters. Using a longer name results in an empty policy name.

This section includes the known issues information related to LiveUpdate policies.

The client may not apply virus definition content when you add all of the content types simultaneously on a client running a non-English operating system. If this condition occurs, you can fix it by adding the virus definition content again.

Some content may not be downloaded to the Symantec Endpoint Protection Manager computer during the first LiveUpdate session. To download the missing content, re-run the following command: LUALL

If your network environment already supports the proxy servers that are compliant with the HTTP 1.1 protocol or later, you can disregard this entry. After you have tried to download LiveUpdate for the first time, the following message may appear:

LU1863: Insufficient free disk space. There is not enough free disk 

space for LiveUpdate to operate properly. Please free up disk space

 on your computer and run LiveUpdate again.

You may have insufficient disk space. However, it is much more probable that this message appears in error because the proxy server is unable to send the correct Contents-Length header field. This error message may appear on Symantec Endpoint Protection Manager, a Symantec Endpoint Protection client, or a Symantec Network Access Control client. You may want to verify that the disk drive to which you downloaded LiveUpdate has sufficient disk space. If you verified that the disk drive has sufficient space, then most likely a proxy server caused the problem. If a proxy server receives an HTTP reply that does not include a Content-Length header field, then the above-listed message erroneously appears. The erroneous message appears on the computer on which the LiveUpdate has been downloaded.

The proxy servers that are compliant with HTTP 1.1 protocols automatically include Content-Length header-entity fields. The proxy servers that are compliant with HTTP 1.0 protocols do not automatically include Content-Length header-entity fields. You may want to ensure that the proxy servers in your network are compliant with the HTTP 1.1. protocol.

See the documentation that accompanies the proxy server for more information on how to make a proxy server compliant with HTTP 1.1 protocols.

LiveUpdate site settings are not replicated. These settings affect what Symantec Endpoint Protection Manager downloads and then distributes to clients. These settings include the following:

As a result, if you use replication, manually set LiveUpdate site settings so that they match on each replicating server.

If a managed client's virus definitions or Intrusion Prevention signatures are out-of-date and you have disabled all update methods for managed clients in the Symantec Endpoint Protection Manager, then the managed client does not report out-of-date content to the user. Managed client users are not warned in any way that their content is out of date.

After upgrading Symantec Endpoint Protection Manager to Symantec Endpoint Protection Manager with Symantec Network Access Control, LiveUpdate does not automatically update the Host Integrity templates.

To update the templates, you must explicitly check the Host Integrity templates check box in the Content Types to Download dialog box in the Symantec Endpoint Protection Manager console. In the console, click Admin, and then click Servers. Under View Servers, select a site, and then click Site Properties. Click the LiveUpdate tab, and then click Change Selection in the Content Types to Download group box.

This section includes the known issues information related to Antivirus and Antispyware policies.

Auto-demand scans do not apply Security Risk Exceptions to scans of Windows mount points or drives. So when the client scans volume content it does not exclude the specified files and folders.

For example, suppose that drive E:\ is mounted to C:\Mount and you create an exception for C:\Mount\Foo\. If the client scans E:\Foo\ or C:\Mount\Foo\, the on-demand scan does not exclude the folder content. And if you create an exception for E:\Foo\ and the client scans C:\Mount\Foo\, the folder content does not get excluded. However, if the client scans E:\Foo\, the on-demand scan does exclude the folder content.

Auto-Protect scans do not apply Security Risk Exceptions to scans of Windows mount points or drives. So when the client scans volume content it does not exclude the specified files and folders.

For example, if drive E:\ is mounted to C:\Mount and you create an exception for C:\Mount\Foo\, the Auto-Protect scans do not exclude the E:\Foo\ or the C:\Mount\Foo\ folder content.

If an excluded folder or file is a mount point, such as C:\Mount\Foo\, you must manually add the alternate path with the drive letter (such as E:\Foo\) to the Centralized Exceptions policy .

To find the paths for Exchange Server folder and file exceptions, refer to the following registry locations:

For more information, refer to the knowledge base article at the Technical Support Web site, which is located at the following URL: www.symantec.com/techsupp/

The default policy that you add includes the following changes:

All types of Auto-Protect are enabled.

The High Security policy includes the following changes

[1978461]

On the Miscellaneous > Notifications tab, if the Display a warning when definitions are outdated setting is unchecked, the client might still display an outdated definitions message. You might need to specify a greater number of days and remediation attempts the client allows.

[1958302; 1958306]

This section includes the known issues information related to Network Threat Protection policies.

On virtual machines running Windows Vista, copying large files to network shares might take longer when Symantec Endpoint Protection's Network Threat Protection (NTP) is enabled. Disabling IPv6 improves performance.

When you add a new rule to a firewall policy , you can filter the learned applications. Filtering helps you more easily select an application for the rule. If you enter a path name for the application and click Next, the filter does not find the application. Instead, enter the executable name without the path to filter the applications.

If you click the Add a firewall policy command, it can take up to 1.5 minutes for the Firewall Policy Overview page to appear. This occurs if the management server contains 500 or more groups. The problem occurs because it takes time for the Firewall Policy Overview page displays all the groups and locations that the existing firewall policies are assigned to.

On the firewall policy Overview page, under Groups Using This Policy, the text "The group list is currently hidden" appears instead of the groups.

The system does not check syntax when you create custom IPS signatures in the management console. If the syntax is incorrect, the client generates the following message in the message console on the client:

FATAL: failed to apply a new IPS Library

The following error also appears in the client system logs:

Failed to apply IPS policy.

When you create custom IPS signatures, make sure that you follow the syntax rules in the context-sensitive help. A best practice is to create the rules and then run them in a test environment before you apply them to a production environment.

When you create and assign a Custom Intrusion Prevention signature, incorrect words appear in the Assign Intrusion Prevention Policy dialog box. In that dialog box, references to "Policy" should be "signature.

The Symantec Endpoint Protection Manager lets you delete a custom IPS variable without a warning, even if a signature still uses the variable. Before you delete a variable, make sure that you have removed it from the content of all signatures in a signature group.

In the Intrusion Prevention policy, you can add a single signature as an exception that the policy ignores. To add the exception, in the Intrusion Prevention policy, click Exceptions, and then click Add.

From the list of signatures that appear, you can select a single signature or select all. If you select a single signature, the Next button should be enabled, but is not.

To work around this issue, click Select All. The Next option is enabled. You can then select individual signatures and the Next option continues to be enabled.

[2003309]

This section includes the known issues information related to Proactive Threat Protection policies.

When a proactive threat scan detects a process that runs from a network or a mapped drive, the event appears in the client computer's log. However, the management server does not register this event, so the event does not appear in the logs in the management console. You also cannot create an exception for the process because it does not appear in the list of detected processes for centralized exceptions.

Application and Device Control Policies let you create Application Control rules. Application Control rules let you block registry keys from being created on client computers. If you create an Application Control rule that blocks all access to HKEY_LOCAL_MACHINE (HKLM) registry entries, and if a user uses Regedit.exe to create a registry entry under HKLM, Regedit.exe crashes. This crash happens only on Windows Vista.

The Application and Device Control policy blocks storage volumes on Windows XP only and not on the Windows 2000 or Windows Vista operating systems.

The Application and Device Control policy does not block human interface devices (HIDs) such as PS2 devices. This functionality is by design. The human interface device blocking functionality works as follows:

If you configure a rule in an Application and Device Control policy to block DVD drives, the rule only blocks hardware DVD drives. It does not block virtual DVD drives. The policy blocks the hardware DVD drives by using a globally unique identifier (GUID). Virtual drives do not have GUIDs.

Hardware links (available in Windows Vista) cannot be blocked or triggered using Application Control and Device Control Protection. This issue affects Symantec Endpoint Protection users who try to create Application and Device Control Policies that are applied to hard links to files, folders, or applications on Windows Vista 32-bit platforms. You know that this problem has occurred if your rules do not trigger.

Do not use symbolic links for clients that run Windows Vista. Apply Application and Device Control policy rules directly to a partition or a path.

This occurs because the tool used for adding white list items is in the system context, and not the user context. For example, adding the Windows XP entry '%temp%' refers to 'c:\Windows\Temp' and not 'c:\Documents and Settings\<username>\Local Settings\Temp'.

Best practice: When adding white list entries, use the explicit path whenever possible.

[1944583]

This is caused by a difference in the way that Windows 7 codes its read requests, as opposed to how they are coded in Windows XP. Symantec does not anticipate a fix and recommend against attempting to block entire folders.

[1987652]

This section includes information about Host Integrity policies, which are available only with Symantec Network Access Control.

When you run Windows XP with none of its service packs installed, and use Microsoft Internet Explorer version 6.0 with none of its service packs installed, and you save a Symantec Endpoint Protection report, you are prompted to save the report as a .php file.

To solve this issue, install a service pack for Windows XP and one for Internet Explorer version 6.0. If you do not want to install the service packs, you can save the report as prompted. Then, change the file name extension to .mht before you view it.

Enable some Internet Options to view the information on the Home page, Monitors page, and Reports page in the Symantec Endpoint Protection Manager. Click Custom Level on the Security tab of the Tools > Internet Options menu to find these settings.

Enable the following settings when using Internet Explorer 6:

Enable the following settings when using Internet Explorer 7:

A scheduled email report that is generated and then sent to Microsoft Outlook may not be formatted correctly. The report may contain missing line feeds behind the different sections. This issue occurs only when the recipient's Microsoft Outlook software has a setting enabled. In the E-mail Options pane, uncheck the Remove extra line breaks in plain text messages checkbox. When this option is turned off, the email message that is sent with the report is formatted correctly.

The following text shows the content of an email that contains the formatting issue:

Report scheduled by: admin 

Report generated on: 2007-04-04 21:31:19 Report type: System Report Report 

description: Test description

The following text shows the correct formatting of the email content:

Report scheduled by: admin 

Report generated on: 2007-04- 04 21:31:19 

Report type: System Report 

Report description: Test description

The Home page, Monitors page, and Reports page do not load on computers where the database server has a DBCS name that is too long. In this case, ODBC does not register the database correctly, so it does not load the reporting-related pages. If possible, keep names to 15 characters or less. Alternatively, use the Start menu > Symantec Endpoint Protection Manager > Management Server Configuration Wizard. You can then use an IP address for the database server instead of the DBCS host name.

If the tabs do not appear across the top of the page when you log onto the Symantec Endpoint Protection Manager reporting functions through a Web browser, try clearing the Internet Explorer temporary files cache. Delete temporary Internet files in Internet Explorer 6 by clicking Delete Files under the Temporary Internet files group box on the General tab of the Internet Explorer Tools > Internet Options menu. In Internet Explorer 7, click Delete under Browsing History.

To print the background colors when you print a report, open the Internet Explorer Tools > Internet Options menu and check Print background colors and images on the Advanced tab.

On the computers that run Windows 2000 Server, Service Pack 3, the Site Status report always shows 0% memory usage. This error also occurs if you access the Site Status information by clicking Health Status under Site Status on the Symantec Endpoint Protection Manager console. When you use Symantec Endpoint Protection, this information is located on the Summary tab. If you use only Symantec Network Access Control, this information is located on the Home page. The information displays correctly if the computer is updated to run Service Pack 4.

Reporting components fail to work on Windows 2008 R2 computers that use a specific an IP address for the Symantec Web server in the IIS. To work around this issue, you can do either of the following:

For Mac client computers, if a virus is detected and moved to the Quarantine, the Symantec Endpoint Protection Manager console displays the virus as both Still Infected and Quarantined. The Still Infected action does not automatically update for Mac clients.

To work around this issue, you can manually clear the Still Infected action by running the Update Content and Scan command from Symantec Endpoint Protection Manager for the client computers.

For more information, see "Updating definitions and rescanning" in the Administration Guide for Symantec Endpoint Protection and Symantec Network Access Control.

In the console, you can view virus definitions on the Home page by clicking Virus Definitions Distribution. If you view multiple virus definitions, Internet Explorer may close unexpectedly. This issue occurs if you run Internet Explorer 6 SP 2 or earlier.

To work around the issue, upgrade to Internet Explorer 6 SP 3 or later.

[1928731]

On the Home page, you can click the Unacknowledged notifications link in the Status Summary pane and view the notifications. However, if you then click the Home page again, the Home page might not appear. This is only an issue on Windows XP with Service Pack 3 running Internet Explorer 7 or 8.

Solution: Change the security setting for your Internet zone to Medium-low or Low. Medium or High blocks the display of the Home page.

[2005768]

When an administrator is deleted, the person doing the deletion will be asked if the reports belonging to the deleted administrator should be saved. If the response is "yes," the reports that the deleted administrator owned will have their ownership changed. The new ownership will show as:

"OriginalName+'(AdminName)'". For example, there is a scheduled report named "Monday_risks_report," created by the admin JSmith. This report name now appears as "Monday_risks_report(JSmith)".

[2130563]

A LiveUpdate policy that is created and then assigned to a group may display the incorrect default port number. The default port number is 2967. This default port number may appear as 0 in the System Log on the client computer.

If the schedule is changed for how often LiveUpdate runs on unmanaged clients, the change does not take effect until the smc process is restarted, or until the computer is restarted. For example, if the schedule is to run LiveUpdate weekly, and then is changed to run daily, you must restart the process or computer.

Symantec recommends against running MS Verifier on Windows 7. If the user's computer crashes, shows a BSODs, or has another failure, the solution is to restart the computer.

[1637526, 1673014, 1674146, 1678618]

The Advanced options for Scheduled Updates contain a feature that is called Missed Update Options that does not work. The Scheduled Updates feature lets Symantec Endpoint Protection users specify how often to run LiveUpdate to check for updates from LiveUpdate servers. As part of the Scheduling, you can set a retry interval with the Missed Event Options. If a client does not successfully run LiveUpdate at the scheduled time, the client uses the retry interval to keep trying to run LiveUpdate for a specified amount of time. If this feature is important to you, the workaround is to update the scheduled frequency with which clients run LiveUpdate. This setting is located at Change Settings > Client Management Configure Settings > Scheduled Updates (tab) > Advanced.

If the Symantec Endpoint Protection client with Network Access Control is installed, the client does not allow the client access to a remote network server. Therefore, if you have Symantec Endpoint Protection clients with Network Access Control that run on Microsoft Vista, you must create a firewall rule on the Symantec Endpoint Protection Manager that allows access to remote servers.

The Symantec Network Access Control client status field is only used when that client is connected to either an Enforcer appliance or an Integrated Enforcer. The Symantec Network Access Control client displays the status value "Allowed" even when it is not connected to an Enforcer appliance or an Integrated Enforcer. The Symantec Network Access Control client displays "Approved" or "Quarantine" when it is connected to the Enforcer appliance or the Integrated Enforcer and the Host Integrity check has passed or failed, respectively.

The Symantec Network Access Control client has no Traffic log. You can only see the Traffic log on the Symantec Endpoint Protection client. This log appears on both the peer client and on the authenticator client. For the Symantec Network Access Control client, the administrator can check the Enforcer client log on the Symantec Endpoint Protection Manager to view peer-to-peer authentication behavior.

Some networks use port address translation for TCP or UDP communications that occur between computers on a private network and computers on a public network. Each computer on the private network uses a different port number for the same IP address to connect to the public network. The public network only receives communications from the single IP address. Peer-to-peer authentication does not work with these modified IP addresses that originate from a single host.

Assigning a firewall policy that enables peer-to-peer authentication to Symantec Endpoint Protection clients and then assigning a Host Integrity policy to Symantec Network Access Control clients might block Symantec Network Access Control clients' access to shared folders on Symantec Endpoint Protection clients. The condition occurs after a Host Integrity compliance check completes.

If the COM+ service has stopped for any reason, after you install the Symantec Endpoint Protection client software, the SMC service cannot start. To work around this issue, you can do one of the following:

This has only been observed on Windows 7, and only intermittently. To work around this issue, restart the client manually.

[1987639]

If Proactive Threat Protection definitions are corrupted or missing, the Proactive Threat Protection portion of the client user interface does not turn red and does not automatically download new definitions to repair itself. After some time, a red dot appears on the Symantec Endpoint Protection notification area icon, and the client user interface states that Proactive Threat Protection is disabled.

To work around this issue, the user can click Fix. Symantec Endpoint Protection then downloads new Proactive Threat definitions and corrects the problem.

[1934245]

If you run a scan command on a Mac client, the Command Status Details window displays mismatched scan status and details. This situation occurs when the scan is in progress and the software cannot determine the state of the scan. You can safely disregard this mismatch.

[1893054]

On Mac OS X 10.5 or 10.6, if you upgrade the client software, the installation wizard displays an Install option instead of an Upgrade option. Click Install to complete the installation.

[1922671]

Symantec Endpoint Protection for Mac does not provide location awareness. To work around this issue, you can modify the location-specific settings for the Default location for a group that contains Mac computers.

[1989028]

On the Clients page of Symantec Endpoint Protection Manager, the name and logon client of a Mac client computer may not display properly. This situation occurs if the hostname or the user account of the Mac computer contains extended Unicode characters.

[1982630]

If you set up an internal LiveUpdate server, your Mac client computers cannot get updates by following a UNC path. You must provide an FTP server or a Web page (HTTP) for Mac clients to get updates from an internal LiveUpdate server.

[1998197]

Virus definitions on a Windows client are considered out of date as follows: the date of the definitions on the client is compared with the date of the definitions on the server.

Mac client definitions are considered out of date by comparing the date of the definitions on the client with today's date.

This situation occurs because Mac clients always get their updates from an internal LiveUpdate server, not from the management server.

[2013252]

To uninstall Norton AntiVirus or Norton Internet Security on a Mac client computer, you can use the uninstaller that is provided on the product disc. The uninstaller is located in the SEP_MAC folder at the root of the product disc.

You must uninstall Norton AntiVirus for Mac before you can install Symantec Endpoint Protection for Mac.

[2014091]

Auto-Protect does not scan the files inside a Stuffit archive file. This situation occurs even if you check the option to scan compressed files in an Antivirus and Antispyware policy.

You can, however, perform a manual scan of the files.

Symantec Endpoint Protection Manager can lock or unlock the Auto-Protect settings on client computers in server control, mixed mode, and client control. This works properly on Windows clients, but fails on the Mac clients that are in client control.

To work around this issue:

[2018385]

The administrator may require a password for the -stop, -importconfig, -exportconfig parameters for the smc command. When a user or a script runs the password-protected smc command and the supplied password is wrong, the smc command incorrectly returns an error code of 0, which states that the password was successful. Use a method other than the smc return value to check if the command was successful.

After failing to authenticate from a computer running Windows, further authentication requests from the switch might be blocked for a minimum of 20 minutes. This issue is due to a hard-coded Windows 20-minute blocking period that prevents the network from being overloaded with potentially unsuccessful authentication requests. During this blocking period, the system does not respond to EAPOL-Identity messages from the switch.

This blocking period applies to Windows Vista, Windows Server 2008, and Windows XP. If the re-authentication period in the switch is set to less than 20 minutes, Windows still blocks authentication requests for 20 minutes. If the re-authentication period in the switch is set to more than 20 minutes, Windows blocked authentication requests for the amount of time that is set in the switch.

To change the hard-coded value in Windows, see Microsoft KB957931 (http://support.microsoft.com/kb/957931).

If you or your administrator configure a client for 802.1x authentication with the Cisco supplicant on a Cisco switch, the switch blocks all outgoing traffic for more than one minute. For this reason, the client computer may take more than one minute to get an IP address after it moves to a different VLAN.

If you or your administrator configure a client as a built-in supplicant for 802.1x authentication with an Aruba switch and WPA2 (Wi-Fi Protected Access) and AES encryption, the client deauthenticates the user after 30 minutes. The client is disconnected from the network. The user must restart the client machine to be authenticated again.

If you configure a Gateway Enforcer to allow non-Windows clients to access the network, you can detect and check for devices that run the Macintosh and Linux operating systems, but the detection of other network devices, such as IP telephones or network printers, is not supported. When a Gateway Enforcer is configured to allow non-Windows clients, such devices are always blocked.

Because of the start time of the Symantec Network Access Control service, the network connection status in the Local Area Connection window may at times inaccurately display that client authentication failed on XP operating systems. After using a Microsoft supplicant to authenticate to Symantec Network Access Control, if you right-click My Network Places and select Properties to view Network Connections, the Local Area Connection may still display "Authentication failed," even though the authentication was successful. Refresh the window from the View menu to see the correct status.

The first time that a client in transparent mode authenticates to a LAN Enforcer, client authentication fails. You see the Enforcer close the port and report that the profile check is unavailable. Specifically, the following condition on LAN Enforcer for any supported switch causes this failure: p n/a p f n/a p Authentication succeeds when the client reauthenticates. As a result, clients in transparent mode need to authenticate twice during the first authentication to LAN Enforcer. Client users can manually perform this authentication.

In clients with on operating system older than Microsoft Vista, the client cannot download a roaming profile when it uses 802.1x authentication. This issue can be resolved by upgrading to Vista or later. For details, see this Microsoft article:

http://support.microsoft.com/Default.aspx?kbid=935638

A client computer running Symantec Endpoint Protection client and configured to authenticate using 802.1x and Protected Extensible Authentication Protocol (PEAP) and then moved to an on-demand environment where the On-Demand Client is downloaded and installed, might pass the Host Integrity check but fail the profile status check and be moved to the quarantine VLAN instead of the production VLAN

This issue affects computers that run Windows XP and Vista. No solution currently exists for this issue.

The user interface on the On-Demand client can show that network access is allowed when it is not. This issue happens when the client policy is set to check for the latest profile before it reports PASS to Host Integrity. It should report "Network access is NOT allowed," but instead reports "Network access is allowed." This issue will be fixed in the next release.

If the DNS server is configured incorrectly on the client, downloading the Windows On-Demand client takes longer than normal. This issue applies to ActiveX delivery of the client. The solution is to configure a valid DNS server or not to specify a DNS server.

This issue only appears on Windows Server 2008 Enterprise, but it is more secure to use a normal file path (for example: c:\download) than an environment variable (for example, %windir%). It is also possible to use the environment variable with FTP or HTTP without authentication if you are downloading to a path defined by an environment variable.

Third-party supplicants are not supported in transparent mode.

This behavior will be changed in a future release.

This behavior will be changed in a future release.

Firefox 2.x is no longer supported by Mozilla. The solution is to upgrade to Firefox 3.x or higher.

Some configurations of Windows Fundamentals for Legacy PC do not install the Local Management Support component. This component is required for some Host Integrity scripts such as the Secure Workstation policy. The Symantec Network Access Control client reports it cannot find secedit.exe when a policy that requires the Local Management Support component is run. To work around this problem, make sure that the Local Management Support component is installed.

This issue is only a visual issue. The user interface may say that the client is in the quarantine network, but in fact it has access to the appropriate network. The solution is to authenticate to an 11.x Enforcer instead.

This issue occurs because of a conflict between UAC and the logon privilege of the user. The workaround is to run Internet Explorer as Administrator, if UAC is turned on. The alternative is to turn off UAC.

This issue occurs because of a change in drivers. The solution is to restart the client computer.

The combination of Internet Explorer 7, Java Runtime Environment, and ActiveX on a computer might cause downloading the Symantec Endpoint Protection On-Demand client to fail due to lack of privileges. Users without administrator privileges might need to disable ActiveX to download the client. Users with administrator privileges or users running Internet Explorer 6 are not affected.

At the time of this release, you cannot use the Juniper VPN client with the Macintosh On-Demand client because Juniper has not released a version for Macintosh OS 10.6.

At the time of this release, you cannot use the Checkpoint VPN client with the Macintosh On-Demand client because Checkpoint has not released a version for Macintosh OS 10.6.

The default value of security hotfixes is less than the default value of important patches in Compliance.xml. So, when security hotfixes on the client machine are less than the default value, Host Integrity can check pass. Otherwise, Host Integrity cannot pass Bigfix compliance checks.

The "Check Norton confidential installed" rule has not been tested with Macintosh OS 10.6 because the current release of Norton Antivirus does not support the 10.6 version of the Macintosh OS.

The "Check SAV/NAV installed" HI Rule has not been tested with Macintosh OS 10.6. For this release, Symantec does not support Symantec Antivirus or Norton Antivirus for this version of the Macintosh OS.

Right-clicking the Symantec Endpoint Protection icon and selecting "Re-authentication" in the notification area does not reauthenticate as expected if you are:

The Macintosh on-demand client does a Host Integrity check and updates its policy once even if the agent has been disabled. This issue will be fixed in a future release.

The MacBook 10.5 Network application incorrectly displays a normal client IP address in the Subnet mask field. It should display a quarantine IP address. To view the quarantine IP address, run ipconfig in a Terminal window.

The workaround is to turn off the P2P feature in the Symantec Endpoint Protection Manager or disable Network Threat Protection.

To work around this issue, use the ./Application/RemoveSniffer command to manually remove the file. You can also work around this issue by using Macintosh Power PC operating system version 10.5 or 10.6.

This issue only appears on Windows XP, and if the user logs off in the brief interval while a remote user checks Host Integrity, or if a remote user logs off while Host Integrity has been running. The solution is not to log off during that period.

Selecting the "Allow HI check to pass even if this requirement fails" option in the Symantec Endpoint Protection Manager, does not give the expected result. When Host Integrity fails, the client can access internal network. However, the client log does not display which Host Integrity check fails.

The Macintosh On-Demand Client cannot connect to a DHCP Enforcer or the Symantec Endpoint Protection Manager if you configure the quarantine route as 127.0.0.1 in the DHCP server. This issue applies to DHCP Enforcers with the secure-mask feature enabled, or the DHCP Plug-in Enforcer with a 255.255.255.255 netmask. To work around this issue, do not set the 127.0.0.1 router in the Quarantine user class. Instead, manually run the ipconfig release and renew commands to get the correct IP address.

The timestamps that are recorded in the Enforcer appliance log are based on time settings in the appliance's CMOS instead of the appliance's system settings. For example, when you use an NTP server to set system time, the timestamps that are recorded in the log are still based on the appliance's CMOS settings. They are not based on the system time that the NTP server provides. For accurate timestamps, make sure that system time and the appliance's CMOS use the same clock settings.

Because external networks are considered unsecure, any server that the Gateway Enforcer connects to must reside on an internal network. Only the Enforcer Services and the On-Demand delivery services can communicate with hosts on external networks. Other user mode applications, such as SNMP client, NTP client, and SSH server must use the Gateway Enforcer's forwarding support module to communicate with hosts on an external network.

If you make configuration changes to the Enforcer, you should stop and start the Enforcer so that the new configuration is stored.

This error code indicates that the user class already exists in the DHCP database. The implication of this error code is that you have already manually configured this user class in the DHCP server. This user class still exists in the database, so the automatic process cannot add this user class. For Windows 2000 Server: This error occurs when the user class is manually configured on the DHCP server and then manually removed later. Sometimes, the user class is not deleted from the DHCP database. This scenario is when the automatic process can no longer add this user class.

The initial authentication between a client and a LAN Enforcer in transparent mode fails. See the topic called "How LAN Enforcer transparent mode works" in the Administration Guide for Symantec Endpoint Protection and Symantec Network Access Control.

After the LAN Enforcer tries to authenticate the client for the first time and fails, the client must reauthenticate. Otherwise, the client cannot connect to the network. See the chapter called "About 802.1x authentication" in the Administration Guide for Symantec Endpoint Protection and Symantec Network Access Control. Because the initial authentication failed, the Enforcer reports profile is unavailable. Therefore you must reauthenticate.

If you use any device, such as a USB drive or a DVD-ROM drive, from which you copy an update package, the following message should no longer appear after you complete the update and type the "show update" command: Enforcer# show update initrd-Enforcer.img.gpg available in {device} device Disregard this message. The update has been completed successfully.

Printers do not accept the static routes that are configured for a DHCP Enforcer appliance or a DHCP Plug-in Enforcer. Therefore, SNAC Scanner cannot communicate with a printer that is connected to a DHCP Enforcer appliance or a DHCP Plug-in Enforcer.

The Allow Legacy Client option is no longer supported for the Integrated Enforcer.

If you delete a client's MAC address from the Trusted MAC list in the Symantec Endpoint Protection Manager, a DHCP Enforcer's lease prevents a client from connecting to the network. The client cannot communicate with the network until the DHCP server's lease expires. Alternatively, the user can execute the following command:

ipconfig /renew

If you want the user to wait for a DHCP server's lease to expire, the user might have to wait for a long time. Administrators may have reset the default setting for lease expiration on a DHCP server from minutes to hours due to bandwidth issues.

The Symantec Network Access Control Enforcer no longer supports the Juniper Odyssey 4.6 client supplicant for 802.1x authentication.

If you need to use wireless access points external to the DHCP Enforcer, Symantec recommends that you set both the Authentication timeout period and the DHCP timeout period to more than 10 seconds. Increasing the timeout periods helps to avoid repeated agent timeouts and reattempts at authentication.

The System Preferences > Network command on the Macintosh does not show routers that have invalid addresses or are not reachable. This situation is the result of a Macintosh issue. The solution is to ensure that routers have valid addresses and are addressable.

The workaround is to unplug the Ethernet cable on the switch port and plug it in again.

To work around this issue, set the retry times to zero in PEAP properties in IAS.

This situation is a driver issue that is resolved at the next authentication attempt. It will be fixed in a future release.

With the DHCP Enforcer and a MacBook 10.6, static route records do not delete when the client gets a normal IP. The Microsoft DHCP server does not always offer the Static Route option, so the client needs to retain the static route records..

The default value is 60 seconds. The administrator should update the value to 10 minutes (600 seconds) to make this value be the client's reauthentication timeout * 2.

To change the value, edit the following registry key on the Integrated NAP Enforcer computer:HKEY_LOCAL_MACHINE\Software\Symantec\Symantec Endpoint Protection\SNAC\Enforcer\SymEnforcerShv - ReauthTimeout:DWORD

If two Gateway Enforcers are in active mode, connecting them to construct a failover environment causes a 0.5 ~ 9 second ARP storm. (The default duration is one second, as determined by the failover sensitive-level configured from the Enforcer command line.) Once the failover begins to work, the ARP storm disappears. To prevent this issue, connect the two Gateway Enforcers into a failover environment when one of the Enforcers is on standby mode.

The interrupt handling capacity of the network interface card that is used on the Dell 850 and 860 causes this issue. The solution is to upgrade the hardware to the Dell R200.

The solution is to restart the Enforcer service.

If you use a DHCP Enforcer and you want to enable a secure netmask on the DHCP Enforcer, you must add an external router and a static route. These additions ensure that the client can always access the Enforcer, the Symantec Endpoint Protection Manager, and the DHCP server.

To work around this issue, you can try to manually renew the IP address a few times.

If you install Symantec Network Access Control on a computer that runs Windows 2000 Service Pack 4 (SP4), wireless connections might fail on the client computer. You can modify the Symantec Network Access Control policy to fix this issue.

The issue occurs because of incompatibilities between third-party wireless management software, such as Intel PROSet/Wireless Software, and the Wireless Zero Configuration software on Windows.

To enable wireless connections on the client computers that run Symantec Network Access Control, make sure that you enable third-party support when you create Symantec Network Access Control policies inSymantec Endpoint Protection Manager.

When you use the Enforcer with Windows XP or Windows Server 2003 (including RTM, Service Pack 1, and Service Pack 2 on x86 and x64 platforms), you might encounter problems with the Microsoft DHCP Client. When the client updates its IP address, you might lose connection or the ipconfig command might show the incorrect subnet mask.

You may also see the incorrect subnet mask in the command prompt if the client's IP address changes from a quarantine IP address to a normal IP address. The client still uses the correct subnet mask. This issue occurs on client computers that run Microsoft Windows 2000, and occurs even if the client passes the Host Integrity check. The client still works correctly.

To fix the problem on Windows XP or Windows Server 2003, you should apply the Microsoft Hot Fix (Microsoft KB927288). The Hot Fix has been updated since its original release, so make sure to download and apply the most up-to-date version for your computer platform. Because Microsoft no longer supports Windows 2000, there is no patch for this issue on Windows 2000.

If you install a Cisco supplicant 5.0 or 5.1 on a client computer and then install an exported Symantec Endpoint Protection client that is configured for third-party supplicants, the Cisco supplicant does not perform dot1x authentication and does not pass a Host Integrity check.

Due to the kernel upgrade present in RU 5, upgrading from earlier versions is not supported. Users should do a fresh install from the product disc. Note that this will require reconfiguration of settings.

When using Macintosh OS 10.5 or 10.6 with a DHCP Enforcer secure mask, failed Host Integrity passes do not automatically switch from normal to quarantine IP addresses. To work around this issue, double-click iprenew to get the correct IP address.

After you install Symantec Endpoint Protection Manager and a NAP Enforcer and then connect to a client, the management server validates the client's UID. If you then connect the NAP Enforcer to a second management server, you must stop and start the NAP Enforcer to have the UID properly validated with the second management server.

[1949062]

You cannot upgrade an Enforcer appliance image from version 11.0.4000 to 11.0.6000 or above. Instead of upgrading, perform a fresh 11.0.6 installation on the appliance.

[1879162]

The Mac OS does not respond to the DHCP static routing option (33) without a patch. Mac computers in a Symantec Endpoint Protection network cannot download and use the Demand Client for Mac without applying that patch.

Solution: For each computer that is running Mac OS X 10.4, 10.5, or 10.6, download and install "Symantec ODC Static Route Spoof Tool.pkg." Administrative permission is needed during the installation. A restart is needed after the installation is complete.

To make the DHCP Enforcer environment work, the admin must configure the static route option (33) on the DHCP server. This option enables the following servers to be accessed from the client side when the client is quarantined:

[1978734]

If you re-initialize an Enforcer or if you reconfigure the interface role, On-Demand Clients are disconnected from the Enforcer.

To work around this issue, disable the On-Demand Clients and then re-enable them.

[1957244]

To change the default Gateway Enforcer, use the interface set command. The route delete and route add commands result in duplicate Gateway Enforcers.

[1996721]

When re-initializing an Enforcer appliance, running the advanced re-initialize configuration command does not work if you press Ctrl + C after the first configuration attempt. Running this command should return the eth0 IP address as output, but instead it does not display anything.

To work around this issue, restart the Enforcer appliance to successfully re- initialize the Enforcer.

[1995448]

The client computers that run Windows XP might receive pop-up messages about a missing client every 30 seconds.

This situation occurs if you choose the Enable pop-up message on client if Client is not running option on the Gateway Enforcer. The situation occurs regardless of the frequency of the pop-up messages that you set. The Messenger Service must also be started on the client computer for the pop-ups to continue to appear.

[2014557]

You may encounter a situation where you connect a Mac computer to a shared network that includes an Enforcer. If you subsequently download the Mac On-Demand client, you cannot connect to the network.

This situation occurs because the client computer must always be authenticated by the Enforcer that authenticates it first. If you connect the client computer through an Enforcer before you download the On-Demand client, the client then cannot authenticate by using the Enforcer that the On-Demand client software requires.

You can work around this issue by downloading the Mac On-Demand client before you connect to a network that requires authentication through an Enforcer.

[2011535]

If a Symantec Endpoint Protection Manager server shuts down, the Enforcer is expected to select the highest priority server on the management server list. Instead, the Enforcer selects the next available server in the list sequence instead. There is no known workaround at this time.

[2014558]

If a Symantec Network Access Control client resumes after hibernation, there may be a delay in obtaining DHCP server authentication. This situation occurs because the client should request a new IP address. Instead, the client continues to request the current IP address.

[2011533]

The Mac static route spoof tool is not supported on your client computers that run Mac OS X 10.4.

[2011540]

Beginning with Symantec Network Access Control version 11.0 RU6 MP1, Enforcers will ship with a Silcom NIC card that is in configured in fail-open mode.

To configure the Enforcer to be in fail-closed mode, issue the following CLI command:

configure interface failopen disable

[2086785]

Enforcer hardware compatibility matrix lists Symantec Network Access Control appliance image releases and their level of testing and support for Dell Enforcer appliance hardware models.

[2099910]

The default management server list that is on the console of Symantec Endpoint Protection Manager is migrated to the Enforcer. In some cases, that list may contain a hostname, rather than an IP address or DNS name. If the Enforcer uses the default management server list and if that list contains a hostname, the enforcer may be shown as offline. Symantec recommends against using hostnames in the management server list.

To work around this issue:

[2174579]

The user documentation might be updated between product releases. You can locate the latest user documentation at the Symantec Technical Support Web sites:

Symantec Endpoint Protection documentation

Symantec Network Access Control documentation

This section contains documentation issues for the Administration Guide for Symantec Endpoint Protection and Symantec Network Access Control.

This section contains documentation issues in context-sensitive help for Symantec Endpoint Protection Manager.

This section contains documentation issues in the Installation Guide for Symantec Endpoint Protection and Symantec Network Access Control.

This section contains documentation issues in Getting Started with Symantec Endpoint Protection and Getting Started with Symantec Network Access Control.

This section contains documentation issues in the Client Guide for Symantec Endpoint Protection and Symantec Network Access Control or Symantec Endpoint Protection Client Help.

This section contains documentation issues in the Implementation Guide for Symantec Network Access Control Enforcement.

The Symantec Protection Center has been enhanced to manage several VeriSign hosted services. Instructions appear in the following material.

If a Nortel VPN client and a Symantec Endpoint Protection or Symantec Network Access Control client are installed at the same time and the Nortel AutoConnect feature is enabled, then when the computer is restarted, neither client starts and neither notification area icon appears. Restarting the computer may resolve the issue. If it does not, then as a workaround, disabling Nortel AutoConnect allows the Symantec Endpoint Protection or Symantec Network Access Control client to start. Because the VPN server can enable the AutoConnect feature, the user may need to disable the AutoConnect feature after every VPN connection.

To run Trend Micro OfficeScan 7.3 with Symantec client software, you must install Trend Micro OfficeScan first, and then install Symantec client software. Otherwise, when the Trend Micro OfficeScan installer detects LiveUpdate, it attempts to uninstall it, fails, and exits.

The firewall does not work with Google Web Accelerator in combination with Internet Explorer. This issue affects any Symantec Endpoint Protection client that has both Internet Explorer and Google Web Accelerator installed. The issue occurs when the client computer tries to use a firewall rule to block access to a remote Web site. All platforms are affected. Symantec Corporation recommends that you avoid using Internet Explorer, Google Web Accelerator, and firewall combinations. No workaround exists for this issue.