Hi,

In our ProxySG logfiles, we see a lot of messages like the following:

ProxySG: 250017 authenticate.credentials.address substitution failed: defaulting to transaction IP address(0) NORMAL_EVENT authutility.cpp 113

Searching the Web and different Forums haven't shown any results. Does anyone experience the same? Our ProxySG today is configured to authenticate users via BCAAA with Kerberos. The auth is configured as "Proxy IP".

Authentication is working fine, just that this log entry is filling up disk space. It would be good, to know the reason for this entry and potentially getting rid of it.

Many thanks for your input.

/R
Yves

The help documentation states that SEPC discovers well-known apps on an orgs computers.  How does one access this information?

https://help.symantec.com/cs/SEPC/SEPC/v130451639_v101064224/Application-control-settings?locale=EN_US

High all,

I have a question please, in our society we want to include the installation agent in the image ISO Windows, this will help us because when we install the windows image in a computer, so automatically the DLP agent will be installed. Is it possible to do it with SCCM ?

SCCM agent use msi package, but our msi DLP agent needs others fields like : endpoint_cert.pem, endpoint_priv.pem, endpoint_truststore.pem

So how we can do that with SCCM ? for now i didn't find how to include these files to the msi with SCCM.

Best regards

Hi All,

I would like to see the Proxy ASG - CAS Module statistics  ( such as File Reputation, Predictive Analysis) in the Management Center.

CAS Module is integrated with the reporter. In reporter create the dedicated "unified" database for cas alone. But I couldn't see reports in  MC. For Proxy ASG access logs I have a separate database in Proxy SG type because if I set to unified I can't access in Reporter.

When I checked the logs been sent by CAS, it was just transaction id as below.  

#Fields: transaction-id sandbox-data
d4af82eaa49e2b8e-000000000000f310-000000005c9730f7 "[ ]"

Has any special configuration need to do for this.

Dear,

Iam testing a version 15.5 of Dlp in a single tier instalation, now I like to add a second endpoind server for take a fail over instance, whats configuration I have to make in the enforce server or enpoint server?

How can create a package agent with this two servers ?

This two endpoint server has to be in the same network segment ? example 10.99.xxx.xxx

How do I add LU to security advisory subscription when I cant find the product to add?

Need some expert suggestions for the installation issue. Environment:

- 3 tire installation DLP 15.5

- Enforcer server is on Windows

- Oracle is on RHEL 7 (we're connecting to an existing Oracle database which was installed and managed by DBA team)

Getting the following error while installation the enforcer:

Followed TECH220316& TECH220283 and granted all permissions for the database user. The MSI log shows the following error:

     47: MSI (c) (D4:38) [10:24:06:234]: Note: 1: 2205 2:  3: Error 
     122: MSI (c) (D4:38) [10:24:06:249]: PROPERTY CHANGE: Modifying ServicePackLevel property. Its current value is '0'. Its new value: '14'.error
     1619: MSI (c) (D4:2C) [10:25:10:640]: Note: 1: 2228 2:  3: Error 4: SELECT `Message` FROM `Error` WHERE `Error` = 2898 
     2246: MSI (c) (D4!E4) [10:25:55:023]: PROPERTY CHANGE: Adding UIResultErrorCode property. Its value is '2'.
     2247: MSI (c) (D4!E4) [10:25:55:023]: PROPERTY CHANGE: Adding UIResultErrorMessage property. Its value is 'User "SymantecDLP" does not exist'.
     2249: Action 10:25:55: CustomActionErrorDialog. Dialog created
     2250: MSI (c) (D4:2C) [10:25:56:195]: PROPERTY CHANGE: Deleting UIResultErrorCode property. Its current value is '2'.
     2251: MSI (c) (D4:2C) [10:25:56:195]: PROPERTY CHANGE: Deleting UIResultErrorMessage property. Its current value is 'User "SymantecDLP" does not exist'.
     2333: MSI (s) (E4:34) [10:26:49:195]: Note: 1: 2205 2:  3: Error 
     2334: MSI (s) (E4:34) [10:26:49:195]: Note: 1: 2228 2:  3: Error 4: SELECT `Message` FROM `Error` WHERE `Error` = 1715 
     2334: MSI (s) (E4:34) [10:26:49:195]: Note: 1: 2228 2:  3: Error 4: SELECT `Message` FROM `Error` WHERE `Error` = 1715 
     2334: MSI (s) (E4:34) [10:26:49:195]: Note: 1: 2228 2:  3: Error 4: SELECT `Message` FROM `Error` WHERE `Error` = 1715 
     2336: MSI (s) (E4:34) [10:26:49:195]: The call to SRSetRestorePoint API failed. Returned status: 0. GetLastError() returned: 127
     2372: MSI (s) (E4:34) [10:27:39:930]: Note: 1: 2205 2:  3: Error 
     5039: MSI (s) (E4:34) [10:27:40:351]: Component: Protectpluginsrlpdocapi_referencedotnet_referenceclassBasisTechnology_1_1RLP_1_1Error_members.html.133B00B4_6F1B_425E_B2F5_853543FA4816; Installed: Absent;   Request: Local;   Action: Local
     5040: MSI (s) (E4:34) [10:27:40:351]: Component: Protectpluginsrlpdocapi_referencedotnet_referenceclassBasisTechnology_1_1RLP_1_1Error.html.133B00B4_6F1B_425E_B2F5_853543FA4816; Installed: Absent;   Request: Local;   Action: Local
     5237: MSI (s) (E4:34) [10:27:40:351]: Component: Protectpluginsrlpdocapi_referencerws_javacombasistechrlpwsDocumentServiceErrorResponse.html.133B00B4_6F1B_425E_B2F5_853543FA4816; Installed: Absent;   Request: Local;   Action: Local
     5248: MSI (s) (E4:34) [10:27:40:351]: Component: Protectpluginsrlpdocapi_referencerws_javacombasistechrlpwsclass_useDocumentServiceErrorResponse.html.133B00B4_6F1B_425E_B2F5_853543FA4816; Installed: Absent;   Request: Local;   Action: Local
     5985: MSI (s) (E4:34) [10:27:40:367]: Component: Protectpluginsrlputilitiesincludebt_error_string.h.133B00B4_6F1B_425E_B2F5_853543FA4816; Installed: Absent;   Request: Local;   Action: Local
     6487: MSI (s) (E4:34) [10:27:40:367]: Component: Protectlibjarerror_prone_annotations_2.0.19.jar.401D797E_336E_470A_B482_AFC1EA3637F4; Installed: Absent;   Request: Local;   Action: Local
     7126: MSI (s) (E4:34) [10:27:40:367]: Component: ProtecttomcatwebappsProtectManagergraphicsdocument_error_icon.gif.401D797E_336E_470A_B482_AFC1EA3637F4; Installed: Absent;   Request: Local;   Action: Local
     7158: MSI (s) (E4:34) [10:27:40:367]: Component: ProtecttomcatwebappsProtectManagergraphicserror_16.png.401D797E_336E_470A_B482_AFC1EA3637F4; Installed: Absent;   Request: Local;   Action: Local
     7159: MSI (s) (E4:34) [10:27:40:367]: Component: ProtecttomcatwebappsProtectManagergraphicserror_24.png.401D797E_336E_470A_B482_AFC1EA3637F4; Installed: Absent;   Request: Local;   Action: Local

     9309: MSI (s) (E4:34) [10:27:41:664]: Note: 1: 2205 2:  3: Error 
     9310: MSI (s) (E4:34) [10:27:41:664]: Note: 1: 2228 2:  3: Error 4: SELECT `Message` FROM `Error` WHERE `Error` = 22 
     9311: MSI (s) (E4:34) [10:27:41:664]: Note: 1: 2205 2:  3: Error 
     9312: MSI (s) (E4:34) [10:27:41:664]: Note: 1: 2228 2:  3: Error 4: SELECT `Message` FROM `Error` WHERE `Error` = 16 
     9313: MSI (s) (E4:34) [10:27:41:664]: Note: 1: 2205 2:  3: Error 
     9314: MSI (s) (E4:34) [10:27:41:664]: Note: 1: 2228 2:  3: Error 4: SELECT `Message` FROM `Error` WHERE `Error` = 21 
     9324: MSI (s) (E4:34) [10:27:41:664]: Note: 1: 2205 2:  3: Error 
     9325: MSI (s) (E4:34) [10:27:41:664]: Note: 1: 2228 2:  3: Error 4: SELECT `Message` FROM `Error` WHERE `Error` = 1715 
     9327: MSI (s) (E4:34) [10:27:41:664]: The call to SRSetRestorePoint API failed. Returned status: 0. GetLastError() returned: 127
     9990: MSI (s) (E4:34) [10:27:45:789]: Note: 1: 2205 2:  3: Error 
     9991: MSI (s) (E4:34) [10:27:45:789]: Note: 1: 2228 2:  3: Error 4: SELECT `Message` FROM `Error` WHERE `Error` = 1302 
     10257: MSI (s) (E4:34) [10:27:47:023]: Note: 1: 2205 2:  3: Error 

     21095: MSI (s) (E4:34) [10:27:52:351]: Executing op: ComponentRegister(ComponentId={7B41948F-A2E8-5536-B2BB-EA853FDAB8E1},KeyPath=G:\Program Files\Symantec\DataLossPrevention\EnforceServer\15.5\Protect\tomcat\webapps\ROOT\error404.html,State=3,,Disk=1,SharedDllRefCount=0,BinaryType=1)
     21096: 1: {F6AD2710-C4F6-4674-AD2E-30BA1D72679F} 2: {7B41948F-A2E8-5536-B2BB-EA853FDAB8E1} 3: G:\Program Files\Symantec\DataLossPrevention\EnforceServer\15.5\Protect\tomcat\webapps\ROOT\error404.html 
     23269: MSI (s) (E4:34) [10:27:53:742]: Executing op: FileCopySDDL(SourceName=0c8wstjk.jar|error_prone_annotations-2.0.19.jar,SourceCabKey=Protectlibjarerror_prone_annotations_2.0.19.jar.401D797E_336E_470A_B482_AFC1EA3637F4,DestName=error_prone_annotations-2.0.19.jar,Attributes=512,FileSize=12079,PerTick=65536,,VerifyMedia=1,,,,,CheckCRC=0,,,InstallMode=58982400,HashOptions=0,HashPart1=-20846686,HashPart2=-248112070,HashPart3=2026892678,HashPart4=704757495,,)
     23269: MSI (s) (E4:34) [10:27:53:742]: Executing op: FileCopySDDL(SourceName=0c8wstjk.jar|error_prone_annotations-2.0.19.jar,SourceCabKey=Protectlibjarerror_prone_annotations_2.0.19.jar.401D797E_336E_470A_B482_AFC1EA3637F4,DestName=error_prone_annotations-2.0.19.jar,Attributes=512,FileSize=12079,PerTick=65536,,VerifyMedia=1,,,,,CheckCRC=0,,,InstallMode=58982400,HashOptions=0,HashPart1=-20846686,HashPart2=-248112070,HashPart3=2026892678,HashPart4=704757495,,)
    
     43572: MSI (s) (E4:34) [10:28:06:039]: Source for file 'ProtecttomcatwebappsROOTerror404.html.401D797E_336E_470A_B482_AFC1EA3637F4' is compressed
     43573: InstallFiles: File: error404.html,  Directory: G:\Program Files\Symantec\DataLossPrevention\EnforceServer\15.5\Protect\tomcat\webapps\ROOT\,  Size: 690
     43693: Process wrote to standard error: Mar 26, 2019 10:28:07 AM com.vontu.util.config.SystemProperties setSystemProperties
     43855:   derby.stream.error.method=com.vontu.itemcatalog.derby.DerbyLogger.getDerbyLogWriter
     43868: Error checking user permission: Oracle user is missing permissions to the database.
     43869: MSI (s) (E4!1C) [10:29:21:151]: Note: 1: 2205 2:  3: Error 
     43870: MSI (s) (E4!1C) [10:29:21:151]: Note: 1: 2228 2:  3: Error 4: SELECT `Message` FROM `Error` WHERE `Error` = 1709 
     43870: MSI (s) (E4!1C) [10:29:21:151]: Note: 1: 2228 2:  3: Error 4: SELECT `Message` FROM `Error` WHERE `Error` = 1709 
     43870: MSI (s) (E4!1C) [10:29:21:151]: Note: 1: 2228 2:  3: Error 4: SELECT `Message` FROM `Error` WHERE `Error` = 1709 
     43871: MSI (s) (E4!1C) [10:29:21:151]: Product: Symantec Data Loss Prevention 15.5 Enforce Server -- Error checking user permission: Oracle user is missing permissions to the database.
     43873: CustomAction checkUserPermissions.401D797E_336E_470A_B482_AFC1EA3637F4 returned actual error code 1603 (note this may not be 100% accurate if translation happened inside sandbox)
     43935: MSI (s) (E4:34) [10:29:21:198]: Executing op: FileRemove(,FileName=G:\Program Files\Symantec\DataLossPrevention\EnforceServer\15.5\Protect\tomcat\webapps\ROOT\error404.html,,)
     45672: MSI (s) (E4:34) [10:29:22:307]: Executing op: FileRemove(,FileName=G:\Program Files\Symantec\DataLossPrevention\EnforceServer\15.5\Protect\tomcat\webapps\ProtectManager\js\errorhandler.js,,)
     46047: MSI (s) (E4:34) [10:29:22:542]: Executing op: FileRemove(,FileName=G:\Program Files\Symantec\DataLossPrevention\EnforceServer\15.5\Protect\tomcat\webapps\ProtectManager\graphics\protect_api_error.gif,,)
     46343: MSI (s) (E4:34) [10:29:22:745]: Executing op: FileRemove(,FileName=G:\Program Files\Symantec\DataLossPrevention\EnforceServer\15.5\Protect\tomcat\webapps\ProtectManager\graphics\general\icon_error_32.png,,)
     46420: MSI (s) (E4:34) [10:29:22:792]: Executing op: FileRemove(,FileName=G:\Program Files\Symantec\DataLossPrevention\EnforceServer\15.5\Protect\tomcat\webapps\ProtectManager\graphics\file_remediation_error.png,,)
     46425: MSI (s) (E4:34) [10:29:22:792]: Executing op: FileRemove(,FileName=G:\Program Files\Symantec\DataLossPrevention\EnforceServer\15.5\Protect\tomcat\webapps\ProtectManager\graphics\error_unavail_48.png,,)
     46426: MSI (s) (E4:34) [10:29:22:792]: Executing op: FileRemove(,FileName=G:\Program Files\Symantec\DataLossPrevention\EnforceServer\15.5\Protect\tomcat\webapps\ProtectManager\graphics\error_unavail_16.png,,)
     46431: MSI (s) (E4:34) [10:29:22:807]: Executing op: FileRemove(,FileName=G:\Program Files\Symantec\DataLossPrevention\EnforceServer\15.5\Protect\tomcat\webapps\ProtectManager\graphics\error_16.png,,)
     46463: MSI (s) (E4:34) [10:29:22:823]: Executing op: FileRemove(,FileName=G:\Program Files\Symantec\DataLossPrevention\EnforceServer\15.5\Protect\tomcat\webapps\ProtectManager\graphics\document_error_icon.gif,,)
     46938: MSI (s) (E4:34) [10:29:23:167]: Executing op: FileRemove(,FileName=G:\Program Files\Symantec\DataLossPrevention\ServerPlatformCommon\15.5\Protect\plugins\rlp\utilities\include\bt_error_string.h,,)
     47766: MSI (s) (E4:34) [10:29:23:682]: Executing op: FileRemove(,FileName=G:\Program Files\Symantec\DataLossPrevention\ServerPlatformCommon\15.5\Protect\plugins\rlp\doc\api-reference\rws-java\com\basistech\rlp\ws\DocumentServiceErrorResponse.html,,)

     49285: MSI (s) (E4:34) [10:29:24:698]: Executing op: FileRemove(,FileName=G:\Program Files\Symantec\DataLossPrevention\EnforceServer\15.5\Protect\lib\jar\error_prone_annotations-2.0.19.jar,,)
     56394: MSI (s) (E4:34) [10:29:29:573]: Error in rollback skipped.    Return: 5
     56449: Property(S): ErrorDialog = ErrorDlg
     56449: Property(S): ErrorDialog = ErrorDlg
     57207: MSI (c) (D4:38) [10:29:29:760]: Doing action: FatalError
     57208: Action 10:29:29: FatalError. 
     57209: Action start 10:29:29: FatalError.
     57210: Action 10:29:29: FatalError. Dialog created
 

Any ideas?

Hi All,

I administer a fleet of virtual desktops that have the DLP Agent version 15.0.0100.01063 installed. We have noticed that on many the virtual desktops that have chrome installed a process brkrprcs64.exe is running. This appears to be the Symantec DLP Chrome extension. On the virtual desktops the process is consuming between 11 and 40% CPU in a single process or it may have multiple instances of brkrprcs64.exe running, having a combined CPU usage of approximately 60-->70%. 

Just wondering if anyone has any advice on why this process is consuming so much CPU and is there a fix for it? 

Environment info:

The virtual desktops are built on a VMware Horizon platform version 7.5.1

Virtual Desktop OS is Windows 8.1

DLP Agent version 15.0.0100.01063

TIA

Hi, I can log-in to EDR via web (https://IPaddressserver/atpapp/#/dashboard), but I do not remember the command line password. How can I have it or reset it. Please help. Thanks!

Hi

I want to upgrade the SEPM from 12.1.3 to 12.1.6 MP10

When I tried to get the file by using my serial number I can get only V12.1.6  MP6  Where as for 12.1.6 MP10 I am getting Clinet only patches. How to proceed this upgrade

Hi Support

cluster5.eu.messagelabs.com throttling our mail servers.

We had issues on our mail queues and once we resolved it, a lot of mails were sent in the queues. Subsequently we are now being throttled. I have mailed, called Symantec Support to no avail. Please assist us urgently.

Date Received: 2019/03/25 13:56:19

Expiration Time: 2019/03/27 13:56:19

Last Error: 421 Service Temporarily Unavailable

196.214.76.171 External MX record mail.4cgroup.co.za

196.22.223.200 External MX record mail1.4cgroup.co.za

209.203.1.2 External MX record mail2.4cgroup.co.za

Kind Regards

Leo

How do I add LU to security advisory subscription when I cant find the product to add?

Hello,
the Altiris agent installed of some machines of my organization can't communicate with the server properly (please see the attached screen capture).

Also, the log report multiple error and warning messages like these:

<event date='03/26/2019 16:59:01.2150000 +03:00' severity='4' hostName='xxxxxxxx' source='ConfigServer' module='AeXNSAgent.exe' process='AeXNSAgent.exe' pid='8748' thread='992' tickCount='226679062'>
  <![CDATA[Configure Server Mode: Access credentials are missing or incomplete, error: The system cannot find the file specified (0x00000002)]]>
</event>

<event date='03/26/2019 16:59:02.1000000 +03:00' severity='1' hostName='EMEANUC8782-09' source='NetworkOperation' module='AeXNetComms.dll' process='AeXNSAgent.exe' pid='8748' thread='992' tickCount='226679953'>
  <![CDATA[Operation 'Direct: Head' failed. 
Protocol: HTTPS 
Host:xxxxxxx.net:443 
Path: /altiris/NS/Agent/GetClientCertificate.aspx 
Connection Id: 18.8748 
Communication profile Id: {xxxxx-xxxxxx-xxxxxx-xxxxxx-xxxxx} 
Error type: HTTP error 
Error code: HTTP status 403: The client does not have sufficient access rights (0x8FA10193) 
Error note: Empty response content received 
Server HTTPS connection info: 
   Server certificate: 
      Serial number: xxxxxxxxxxx
      Thumbprint: xxxxxxxxxxxxxxxxxxxxxxxx 
   Cryptographic protocol: TLS 1.2 
   Cipher suite: xxxxxxxxxxxxxxxxxxxxxxxxxxx 
   Cipher algorithm: AES 
   Cipher key length: 256 
   Hash algorithm: SHA384 
   Hash length: 384 
   Key exchange algorithm: ECDH 
   Key length: 256]]>
</event>

<event date='03/26/2019 16:59:02.1040000 +03:00' severity='2' hostName=xxxxxxxxxxxx' source='ConfigServer' module='AeXNSAgent.exe' process='AeXNSAgent.exe' pid='8748' thread='992' tickCount='226679953'>
  <![CDATA[Request 'https://xxxxxxxxxxxxxxnet:443/altiris/NS/Agent/GetClientCertificate.aspx' failed, COM error: HTTP status 403: The client does not have sufficient access rights (0x8FA10193)]]>
</event>

<event date='03/26/2019 16:59:02.1050000 +03:00' severity='2' hostName='xxxxxxxx' source='ConfigServer' module='AeXNSAgent.exe' process='AeXNSAgent.exe' pid='8748' thread='992' tickCount='226679953'>
  <![CDATA[Failed to receive CEM certificates from https://xxxxxxxx.net:443/altiris/NS/Agent/GetClien... in direct mode, error: Unspecified error (0x80004005)]]>
</event>

Any idea?
I already tried to unistall and install the agent again, GUID reset, privileges granteed to the Altiris folder, etc.
Can it be a firewall problem?

Please help!

I have several clients that no longer update. They show as connected to SEPM. SEPM shows that all cleints have completed the "Update Content" command. I can see on the client list that they have not updated and verfy it by phyicall checking each machine. When running SymDiag on a failed client the client will update as they should so I do not see any error messages. This also happened last month and I got around it by deleting the clients and pushing the package back out to them. This worked for 3 weeks and now I have the same problem.  

Hi all,

Does anybody knows how can connect Symantec Endpoint Protection Cloud with SIEM Qradar? We have the idea that connect Enpoint protection.cloud with our console on Qradar for monitor incidents that occurs in the platform that we mangement.

With other AV we use an API, but in this platform there are nothing.

Regards,

Carlos Espinoza

Hola buenas

Estoy implementando SEPM en mi empresa y todo perfecto. El problema es que por error deje abierta la politica de excepciones para algunos usuarios. Me gustaría poder saber que excepciones han creado los usuarios y como revertirlas, pero no consigo saber como. Hay alguna manera?

Un saludo y gracias

**

I am implementing SEPM in my company and everything is perfect. The problem is that by mistake leave the policy of exceptions open for some users. I would like to know what exceptions users have created and how to reverse them, but I can not find out how. Is there any way?

Is it safe to assume that after our servers are upgraded to SEPC we have to go back to our SBE partner portal and manually remove the devices from there that were upgraded?  We received notice that our licenses were up for renewal in SBE and assumed that these would have been removed. We're looking at a large number of servers in our partner portal as well as clients that have their own hosted portals that we manage for them.

All emails sent to messageslabs.com are delayed with the following error: 421 Service Temporarily Unavailable

Environment:  Windows 7 Profesional SP1 64-bit, SEP 14.2 MP1 (14.2.1031.0100) UNMANAGED Client

Problem:  Note - this is happening on UNMANAGED clients that have no way to connect to the SEPM and never will.

It appears that most traffic on our UNMANAGED client(s) is taking the default "allow VPN" firewall rule and are bypassing our custom firewall rules that have been in place for years.  We upgraded to 14.x from 12.1 by running the executable downloaded from fileconnect.  The upgrade process carried our firewall rules forward to 14.x.

We do not use VPN in our environment.  Is there a workaround or a fix for this issue?

We've already done basic troubleshooting on the clients.  They are working fine.

Do not offer "run cleanwipe and do a fresh install" as a solution.  We are looking for either a fix or workaround or perhaps a setting in 14.2. MP1.

Thanks,

Wally

I am having the same issue as everyone else in this forum where my domain has been inexplicably prevented from sending email to customers on your email security platform.

I am not on any blacklists including Symantec's IP reputation check.

Sending an email to support.cloud@symantec.com has the auto reply "support will no longer respond to emails sent to (support.cloud@symantec.com) as a means of creating your support case"

Sending an email to investigation@review.symantec.com bounces as the email does not exist. I'm serious. I even had one of the online chat agents try it and he confirmed it.

How do I resolve this when Symantec wont provide any avenues to? Businesses using this product are legitimately missing sales inquiries, invoices, etc.