Endpoint Protection Not Working - Yellow Exclamation Mark - Not Opening

[RiDER07]

Basically to summarise,  all my users are on 14.0.2 and I deployed out 14.0.3 via SCCM which according to fellow users on here, will upgrade it automatically.

So 50% of the users, it works fine, but the other 50% are faced with this problem where it's not opening at all and it has a yellow exclamation mark on the icon on the taskbar.

What do you guys suggest I do?

 

Any help is appreciated.

 

[RiDER07]

As you can see, Windows Security Centre has a red cross on it, on the taskbar (in the screenshot) which reports that no AV is running.

[ℬrίαη]

First thing is to download and run the SymDiag tool on an affected endpoint to see what it shows. Also, was a reboot performed?

[Rafeeq]

as its upgraded from SCCM, check the execmgr.log to see if the upgrade was succesful, looks to be an incorect install which rolledback during upgrade

[RiDER07]

Upgrade was successfull, it says 14.0.3 in the About Section

 

[RiDER07]

I will download and check.  Exe's arent allowed in my company, so I will have to download this at home and OneDrive it to my work machine.

Cheers, I wil report back.

[ℬrίαη]

Any results of SymDiag?

[Rafeeq]

Did you install the package with latest updates or small package without updates, possible that they are trying to download updates after install and it gets frozen?

[RiDER07]

 

 

 

[RiDER07]

@Brian

 

After deploying out the updates to 500 machines, only few machines are getting this issue.

 

Any suggestions/solutions?  Rebuilding those machines work, but that's not a solution.

Thanks in advance.

[John Owens]

Hi Rider,

 

Run the Symdiag once more but follow the steps below.  Upload here and I will take a look at why this is happening.

 

• Accept EULA
• Click Collect Data for Support
• Select Symantec products you are running on this system
• Select All data
• Once collection is complete. Save the file for support

 

 

 

[RiDER07]

Hi John,

 

Thanks for getting back to me.  The file is attached.

 

Many thanks,

 

Attachment(s)

[LSSP0377]__2018-03-14__14-21-05__2f167e.zip   9.80 MB 1 version

[John Owens]

Good Morning,

I see the following errors:

This message indicates that Auto-Protect could not load the configuration file. This means that Auto-Protect is running, but is using a default configuration file.

To fix the problem, deploy the antivirus policy again to the affected client. If redeploying the policy does not solve the problem, uninstall and reinstall the client

3/12/2018 1:58:29 PM    Application    Error    Symantec AntiVirus    LSSP0377.retail.int        42    "Auto-Protect Error: Auto-Protect loaded the default configuration.Application has encountered an error.

 

Then I see the following which I assume happen when you are attempting to open the SEP GUI.

3/12/2018 4:22:09 PM    Application    Error    Application Hang    LSSP0377.retail.int        1002    "The program SymCorpUI.exe version 14.0.3892.1101 stopped interacting with Windows and was closed. To see if more information about the problem is available, check the problem history in the Security and Maintenance control panel.

Process ID: 2ef4

Start Time: 01d3ba0e181e7750

Termination Time: 13

Application Path: C:\Program Files (x86)\Symantec\Symantec Endpoint Protection\14.0.3892.1101.105\Bin\SymCorpUI.exe

Report Id: 9f0601dd-e3ba-4b66-b74a-3c4f0bd91c40

Faulting package full name:

Faulting package-relative application ID:"

 

3/12/2018 4:22:09 PM    Application    Error    Application Error    LSSP0377.retail.int        1000    "Faulting application name: ccSvcHst.exe, version: 13.3.1.5, time stamp: 0x5a53f171
Faulting module name: ntdll.dll, version: 10.0.15063.608, time stamp: 0x802f667e
Exception code: 0xc0000005
Fault offset: 0x00058899
Faulting process ID: 0x12c
Faulting application start time: 0x01d3ba1e45074aa6
Faulting application path: C:\Program Files (x86)\Symantec\Symantec Endpoint Protection\14.0.3892.1101.105\Bin\ccSvcHst.exe
Faulting module path: C:\WINDOWS\SYSTEM32\ntdll.dll
Report ID: c301072c-5204-42f3-8ed0-7983edec1d6a
Faulting package full name:
Faulting package-relative application ID:"

 

Our processes are crashing.  Please make sure all Windows Updates have been applied to the system and run a repair of the product.  If that does not resolve we will need you to open a case as support will need full process dumps of when ccsvchst.exe and symcorpui.exe are crashing to find out why.

Thanks,

John

[RiDER07]

Thanks John.

I have ran a repair on SEP and it is now opening.  We use a managed profile and even though I have added it manually, it's still shows the yellow triangle on it.

 

But after 5 minutes roughly, it turned to green and it's all working now.

 

Thanks everyone!