Windows Security Center shows "Status Unavailable" w/SEP 14.2

[rburtcher]

We've encountered an issue with SEP 14.2 RU1 MP1 (14.2.4814.1101) on Windows 10 1803 where Windows Defender Security Center shows "Status Unavailable" for both "Virus & Threat Protection" and "Firewall & Network Protection". If I open SEP, everything looks good, as expected, and opening the Windows Defender Firewall control panel applet shows the "These settings are being managed by vendor application Symantec Endpoint Protection", as expected.

I've tried to do some research on this before posting; TECH247987 doesn't appear to apply in this situation, as that's for an older version. TECH255344 says to check the SepWscSvc and SymELAM services; SepWscSvc is running without error, and SymELAM is enabled but stopped. If I manually start the SymELAM service, the status messages in WSC don't change.

What's weird is if I open WSC right after a reboot, it'll display an indeterminate progress bar (the animated "line of dots" thing) under both Virus & threat protection and Firewall & network protection for about a minute or two, then for about 15 seconds Firewall will go green and say "No action needed" and Virus will show "Threat service has stopped. Restart it now". After that, it reverts back to "Status unavailable".

It shouldn't matter that we have a password set for the SEP client, right? Anyone have any ideas?

[rburtcher]

Another data point: SEP does show up in the Security and Maintenance control panel applet - it's properly registered itself as both the antivirus and firewall providers, and it is correctly disabling Windows Firewall in favor of it's own firewall.

[Mithun Sanghavi]

Hello,

Disable the Windows Firewall rules that conflict with SEP firewall. Disabling Windows Firewall entirely is not recommended. Such a step disables DirectAccess protections provided even when SEP fully manages the Windows Firewall.

See symantec.com/docs/TECH123729 for more details about the firewall categories which SEP normally manages.

Windows Security Center reports a problem with Endpoint Protection

https://support.symantec.com/us/en/article.tech255344.html

Hope that helps!!

Regards,

[rburtcher]

While I do greatly appreciate the response, I have already checked both TECH247987 and TECH255344, as I mentioned previously. SEP appears to be correctly managing the state of Windows Firewall, and this is shown in the screenshots I posted. On a lark I tried to completely disable Windows Firewall, but that did not resolve the issue. We are also on a much newer version of SEP than TECH247987 applies to - we're already on 14.2 RU1 MP1. As for TECH255344, the SepWscSvc is already running. I can stop and restart that service without the errors mentioned in that document. The SymELAM service is enabled, but stopped - and starting that service doesn't change anything.

[Mithun Sanghavi]

Hello, 

In your case, I would suggest you to please create a ticket with Symantec Support Team to understand the root cause.

Regards,

[EConforti]

Any updates on this? We are seeing similar issues on our Windows 10 systems with SEP 14 clients, even with the latest RU1 MP1 (Build 4814).

[João Soares]

@EConforti, I have the same problem and also very similar enviroment.

 

Windows 10 1903 + SEP  14.2.4814.1101 = Windows security center reports Firewall disabled and Threat Reports unavaiable.

Windows 10 1709 + SEP 14.2.1023.0100  = Windows security center doesnt report any problem, works great.

 

I'm starting to think that's something like any incompatibility between the windows 10 1903 and the SEP 14.2.4814.1101.  Could you please report to Symantec to provide a response? This problem is growing fast and many admins got this problem.

[jhigh]

Having the same issues described above with all versions of SEP newer than 14.2.1031.0100 on Windows 10 1903. This is causing issues with other software that relies on querying Windows Security Center for the registered AV provider.  Are there any workarounds for this issue?