Symantec Endpoint Protection, developed by Broadcom Inc., is a security software suite that consists of anti-malware, intrusion prevention and firewall features for server and desktop computers.[2] It has the largest market-share of any product for endpoint security.[3]
According to Gartner, Symantec Endpoint Protection 14 is one of the more comprehensive endpoint security products available and regularly scores well in independent tests.[3] However, a common criticism is that customers are "fatigued" by "near constant changes" in the product and company direction.[3] SC Magazine said Endpoint Protection 14 was the "most comprehensive tool of its type . . . with superb installation and documentation."[12] The review said EndPoint Protection had a "no-brainer setup and administration," but it does have a "wart" that support fees are "a bit steep."[12]
Forrester said version 12.1 was the most complete endpoint security software product on the market, but the different IT security functions of the software were not well-integrated.[22] The report speculated the lack of integration would be addressed in version 14.[22] Network World ranked Symantec Endpoint Protection sixth in endpoint security products, based on data from NSS Labs testing.[23]
So in this case, you the person doing the install, will have to determine that you have completed the install of Symantec, since the software can't detect it. Typically the install of Symantec requires two reboots before it is done doing all of the configuration that it wants to do. So what I recommend is that you do is follow the instructions in Symantec section for anti-virus support ( -us/citrix-app-layering/4/layer/layer-antivirus-apps.html#symantec-endpoint-protection). Do the two reboots after you finish those steps, and then tell the service that you want to bypass the layer check. This is done by a regedit, and navigating to the HKLM\System\CurrentControlSet\Service\Uniservice and adding a DWORD value called BypassLayerCheck and set it to 1. This is documented here: in the final section of the file where it talks about getting the reboot requests. In this case you can do the override because you as the human know that Symantec keeps updating the same file and that the machine is booting correctly with this updated file and thus you can allow the shutdown.
However, re-enabling tamper protection then caused Symantec to stop working on one machine where the service could not be restarted and a reboot was needed. After the reboot, with Tamper Protection enabled, the icon did not return. This was confirmed on a few other machines -- the icon disappeared again with Tamper Protection enabled.
We have been a Symantec Endpoint protection shop for a long time and just purchased Sophos Endpoint with Intercept X. The sales rep said that they can coexist on the same machine yet when you install Sophos Endpoint it uninstalls Symantec Endpoint. Now I am cautious to install Symantec on top of Sophos. Is there anyone out there running both and is there a need to run both clients any longer. It appears to me that we only need Sophos. Any suggestions out there?? Thanks.
I have recently uninstalled Symantec endpoint client from a few machines that were having some performance issues. I went to add/remove programs and selected remove on symantec endpoint. I input the Symantec administrator password, and then completed the uninstall.
We had a symantec managing server.. where we would put in an ip address and it would locate the machine on the domain. It would then install. I'm not sure if there was a group policy in place. Looking now at group policy, I don't see a Symantec policy anywhere. Is there someway to block the install? Or what should I look for in group policy ?
Anyway, Uninstall the client again. Remove the inheritance attribute from the "%programfiles%\symantec" directory. Make sure no identifier has access to it. Reboot. If you are lucky, You will get an error from the source thats trying to install it. If you are not, The client will not be installed.
The server and all but one client have Symantec Endpoint Protection version 12.1.1101.401 (Release) RV1MP1. It's been a few years since I've used SEP but it looks to me like all the clients were installed in managed mode as I'm unable to change some settings. I would've thought the server would have the SEP manager installed but it does not, it has the SEP client same as all the workstations. One workstation has nothing installed. Is there a way to locate what computer had the endpoint manager installed or can I just install it on the server and try to connect the clients to it? I'm wondering if the previous IT people installed the manager on one of their computers in order to deploy?
Traditional endpoint solutions are no longer enough to protect your organization against ransomware and targeted attacks. Symantec Endpoint Security solutions prevent, harden, detect and respond to emerging threats across your devices, servers and cloud workloads.
i have randomely checked 6,7 systems and found SEP installed, after that i checked symantec endpoint protection service which is already started, but when i try to start the SEP client from system tray or from start menu it is showing Symantec Endpoint Protection cannot open because some Symantec Services arestopped. Restart the Symantec services, and then open Symantec Endpoint Protection. Symantec Endpoint Protection cannot open because some Symantec Services are stopped. Restart the Symantec services, and then open SymantecEndpoint Protection.
In my dedicated index "Symantec" i can see events about symantec:ep:scan:file, which supposed to be normalized to "Malware" datamodel according to the docs docs.
I can also see the "malware" tag, as well as the "attack" tag.
For some reason, when i query the datamodel, i don't see any sign for symantec logs.
The Intrusion Detection datamodel for example, does has symantec logs .
Symantec Endpoint Protection (SEP) is an enterprise-wide application used for protection against intrusion. It includes protection against virus, malware and network layer attacks. SEP is available for both Macintosh- and Windows-based platforms.
you might want to have a look at the below article. in any case I (as an Ex symantec Technician) can tell you that this case is not headed in the right direction. I second brain here, have the case handled by a senior technican or get it escalated to advanced engineer as we cannot directly work with backline engineer.
Any idea where this IDSvia64.sys file is located? I cannot find this on my system. I did however uninstall all symantec features except the basic virus, spyware protection. I am getting an average of 4Gbps throughput but that is still only half what the system can do without syamntec installed. I am thinking this file doesnt exist in Symantec Endpoint 12.1.6a
Thanks for following. I will post Symantec's official response after I get it. Currently It is escalated and handed off to the Backline Engineers. I had another support vendor of ours who I was working with before we realized it was Symantec causing our slowness. They have recreated this in their labs. I have asked Symantec to recreate this in their labs. At this point that is what they are doing. I have requested daily updates but was told due to the nature of this issue it could take a week or two to get more information. Very frustrating problem. I have been playing with different components being installed and here are some interesting results. The best I can do is to install the client with basic protection only and no download insight (Which I am ok with on a server) but I am not ok with losing 3 Gbps of my total possible bandwidth.
I installed a competitors endpoint agent and performed the same tests. The results were much better, I was able to get full or nearly full bandwidth using a non symantec product. I also tested its functionality by downloading the eicar.org test virus and it caught it as we would expect.
AFAIK there is a Option in Symantec Endpoint protection called Network-Protect, that doesnt allow the Mac-Adress-Broadcast, that is used to find accessible Devices in Step7. Many anti-virus-scanner have an option like this.
The Symantec Endpoint Security Suite provides attack prevention, detection and response for endpoints in an organization. It provides a broad feature set including traditional and machine-learning based prevention measures, Endpoint Detection and Response (EDR), application control, and deception technology.
Cynet 360 is a security solution that includes a complete Endpoint Protection Platform (EPP), including Next-Generation Antivirus (NGAV), device firewall, advanced EDR security capabilities and automated incident response. The Cynet solution goes beyond endpoint protection, offering network analytics, UEBA and deception technology.
With access to multiple security control points consisting of both endpoint and network elements in the cloud, the challenges associated with growing remote worker needs are easier to address. Detecting and responding to increasingly sophisticated and targeted cyber threats becomes more straightforward.
I am trying to install Symantec end point protection manager on Server 2012 R2 without trusted root or CA certificates in an environment that is air gapped has no internet access and absolutely no certificates in the registry path: C:\Program Files\Symantec\Symantec Endpoint Protection\14.3.8268.5000.105\bin64\EFAInst64.exe is not trusted. Verification result: 20
When Broadcom acquired Symantec in 2019, they continued to support Symantec Endpoint Protection but chose in late 2020 to end-of-life the product. As CrowdStrike became the Penn-recommended endpoint detection and response solution, there was no longer a need to keep a relationship with Symantec.
The contract for individually owned systems ends on May 24th, 2022. Though these endpoints will still provide protection for some time after the contract ends, people should plan to transition away from SEP as soon as possible.
dd2b598166