14.2 RU2 MP1 on MacOS 10.15.3 (Catalina) - All AV Scans Fail

[IT Dist]

Hi,

I've recently upgraded to 14.2.5569.2100 on MacOS 10.15.3. I'm running into an issue whereby manual AV scans complete instantly with no error code.

Scheduled scans seemingly fail with the following error: scheduled scan.

"Scan with norton security failed. Cannot load a required component to perform that functionality."

I have a ticket open since the 5th March: 31791475

But have received no initial response thus far.

[[e-mail]]

I've just verified that I'm seeing the same issue on Catalina (10.15.3)

Open the SEPM agent (14.2 RU2 MP1) 14.2.5569.2100 and select the option to run a full scan, it "completes" instantly without scanning anything.

This does not inspire confidence at all.



------------------------------
CBC/Radio-Canada
------------------------------

[IT Dist]

Thanks for confirming we're not alone, Tom.

They have picked up the case now, we had a webex session to confirm the issue but no sign of it being resolved soon. We'll probably have migrated to ATP before this gets resolved.
I'll keep you posted if we come to any conclusions.

Regards,
Tom

[[e-mail]]

Did you get any feedback from Symantec? The SEPM agent for Mac Catalina (10.15.x) seems to be a lost cause.


------------------------------
CBC/Radio-Canada
------------------------------

[ALee]

Hello, can you test out build 5576? It should be available from your download section.

------------------------------
Sr Manager, Product Management
------------------------------

[[e-mail]]

Would the version you recommend work on MacOS 10.15.4 as well?

The only version that I see is the following for our account. I had previously installed the 14.2.2_MP1 on our test environment where I discovered the issue with scanning on the Mac. Is the one below an updated version of 14.2 RU2 MP1 that was previously released?

Symantec Endpoint Protection 14.2 RU2 MP1- International English Release : 14.2.2_MP1 Service Pack : 0

Symantec_Endpoint_Protection_14.2.2_MP1_Full_Installation_EN.exe
Released: Mar 6 2020 10:51AM
SHA2: cea6e8dc4c5e13ec741a28a1c160d5a0bce088610965bfde85634e3ee0591fbd
MD5: 395f88aec0fbe80f4a3978236c42b167


------------------------------
CBC/Radio-Canada
------------------------------

[[e-mail]]

I downloaded the new SEPM 14.2 RU2-MP1 package, dated March 6th, 2020.

I already have SEPM 14.2 RU2-MP1 (14.2.5569.2100) installed on my SEPM Test environment server, So I will need to do another upgrade cycle on the Test server first before I can deploy the updated 14.2.5576.2100 agent to a Macintosh device to test. 

SEPM 14.2 RU2-MP1 Old Build 14.2.5569.2100 (Previous release)
SEPM 14.2 RU2-MP1 New Build 14.2.5576.2100 (Released March 6th, 2020)

I'll need to schedule a change for this.


------------------------------
CBC/Radio-Canada
------------------------------

[ALee]

Hi Tom, give it a shot on the 5576 build and let us know if it fixes your problem. If not I would have to request you to provide additional logs to Support team.

Thanks.

------------------------------
Sr Manager, Product Management
------------------------------

[[e-mail]]

Hi A Lee, 

Where is the March version of the SEPM 14.2 RU2-MP1 Update in French? It's only showing the January 27th version. We have a large number of French language devices to support.

Thank you.


------------------------------
CBC/Radio-Canada
------------------------------

[ALee]

Hi Tom, if referring to RU2MP1, it's dated 27th Jan. If referring to 5576 build which is a hotfix to some customers issues, it won't be localized. The next build would be sometime in April.

------------------------------
Sr Manager, Product Management
------------------------------

[[e-mail]]

ok, So I installed SEPM 14.2.5576.2100 on a Macbook Air (2018 with SSD) macOS 10.15.3 installed. I verified that the Full disk access was enabled and that the signatures were up to date. The device has Filevault encryption enabled.

The scan progress is extremely slow with virtually no CPU utilization for the Symantec application. The first scan hung at 1007 files for over an hour after installation/reboot. I rebooted a second time, the second scan is extremely slow as well with virtually no CPU utilization but it has processed a much larger number of files. It hangs for a long time before incrementing the file count periodically.   

I've submitted case 31841375 to see if support has any insight.

Any time that Symantec releases a product, it needs to be localized for English, French and Spanish at a minimum. Being in Canada, English/French is a requirement for Government.

------------------------------
CBC/Radio-Canada
------------------------------

[Scott K]

Hi ALee,

When I go to the download page the only version I have access to is 14.2.2 MP1 or 14.2.5569.2100 and not build 5576. I am having numerous problems on macOS systems with both 14.2.2 (OS crashes due to SEP) and 14.2.2 MP1 (not scans with 10.15.x, not communicating with any SEPM, and/or managed client turning into unmanaged on reboot after install) and therefore would like to test the latest build before opening a ticket with support (which has gone downhill since Broadcom has taken over).

Thanks,
Scott

[Scott K]

Hi Alan,

Thanks for the private email with a link to download build 5580. Unfortunately, build 5580 is still producing unmanaged Mac clients. I am still running 14.2 RU2 build 5323 (14.2.5323.2000) on our two SEPMs. I have been waiting for 14.3 to upgrade our SEPMs to resolve the known problem "Windows hangs with a blank screen on reboot after upgrading the Endpoint Protection client" TECH257184 (https://knowledge.broadcom.com/external/article?legacyId=tech257184).

I can download 14.2.2 MP1 or 14.2.5569.2100 to upgrade our SEPMs, but I want to check to see if there is a newer build that I should use to upgrade our SEPMs.

Thanks,
Scott

[ALee]

Hi Scott, 5569 is the official build with a refresh of macOS agent with build number 5576. Anything in between 5569 and 14.3 build would be for specific customers running into various issues.

I did encountered what you mentioned on the unmanaged build despite exporting from SEPM, but I tried again and got it working afterwards. I make sure I selected the write Mac OS settings and tried the export. You should be able to do an auto upgrade for SEP for macOS clients 14.x and above and don't need to do an export. But for testing, you might want to try sylinkdrop utility in the Symantec solutions folder.

------------------------------
Sr Manager, Product Management
------------------------------

[Scott K]

Hi Alan,

I exported a managed SEP macOS client several times with the options in the below screenshot, but they all end up unmanaged. 

When we have problems with SEP we typically remove SEP and install the latest version we have available, therefore we have a number of macOS systems with unmanaged SEP clients. I thought the sylinkdrop utility didn't work for SEP14.x under macOS from the Symantec/Broadcom articles I read (https://knowledge.broadcom.com/external/article?legacyId=tech131585; see screenshot for the sylinkdrop utility) and therefore tried the steps to manually place the sylink.xml file into the appropriate folder, but unfortunately, the SEP clients remained unmanaged (not sure why this didn't work).

I am going to try the sylinkdrop utility before upgrading the SEPMs servers.

Thanks,
Scott

[su_A_ve]

I was able to use sylink to make an unmanaged client into a manged one on macOS 10.15 - I used the unmanaged installer that comes with the all-clients zip.


------------------------------
Rider University
------------------------------

[su_A_ve]

So how to we update SEPM to get 5580? I only got 5576 available.

------------------------------
Rider University
------------------------------