Solved

SEP Security Status reportes dekleted client

Posted on 2011-02-28
13
1,073 Views
Last Modified: 2013-12-09
I have SEP management console installed on a server and the Security Status is "attention needed" because of one Client reporting "Intrusion Prevention Signature Failure". The issue is that this client (server) has been shut down and removed without uninstalling the SEP Client. What I did is that I have removed the Client from the management console, but the report still shows the security status RED and points to the same client.
Autorefresh is set to 15 minutes, restart of the console did not help either.

Any ideas?
0
Comment
Question by:haldoxp
  • 4
  • 2
  • 2
  • +2
13 Comments
 
LVL 29

Expert Comment

by:Sudeep Sharma
ID: 35002283
Did you tried CleanClients command from a web browser on the SEPM:

http://127.0.0.1:9090/servlet/ConsoleServlet?ActionType=ConfigServer&action=CleanClients

Sudeep
0
 
LVL 3

Author Comment

by:haldoxp
ID: 35005687
An output i get from this one:
  <?xml version="1.0" encoding="UTF-8" ?>
  <Response ResponseCode="0" />
0
 
LVL 3

Author Comment

by:haldoxp
ID: 35024800
Well obviously this did not help, any other suggestions?
0
 
LVL 29

Expert Comment

by:Sudeep Sharma
ID: 35032551
Since how many days are passed the client has been removed? The offline clients are purged from the console after 15 days if I am not wrong. If it has not been 15 days you would need to wait till then.

Sudeep
0
 
LVL 20

Accepted Solution

by:
jimmymcp02 earned 250 total points
ID: 35041519
What version of sep are you using? there is a bug in sep11 mr5 that causes the status tracker not to track risk correctly see


http://www.symantec.com/business/support/index?page=content&id=TECH103087

look up fix id 1947676
0
Threat Intelligence Starter Resources

Integrating threat intelligence can be challenging, and not all companies are ready. These resources can help you build awareness and prepare for defense.

 
LVL 3

Author Comment

by:haldoxp
ID: 35055508
@Sudeep: it is more than 15 days since I deleted the client.

@Jimmy: The Version is 10.0.4202.75
0
 
LVL 20

Expert Comment

by:jimmymcp02
ID: 35083986
There is no symantec end point 10.0.4202

Are you sure we are talking about the same product?    It looks like you might be using Sep11 MR4 have you tried restarting the server and clearing the status page?

You are using an older version the currecnt version is sep11mu6 mp2
0
 
LVL 3

Author Comment

by:haldoxp
ID: 35107356
Sorry my bad it is 11.0.4202.75 of course

I tried to restart the server and run CleanCLients command

how exactly should I clear the status page?
0
 
LVL 12

Assisted Solution

by:jmlamb
jmlamb earned 250 total points
ID: 35214779
Hi haldoxp,

jimmymcp02 has provided the solution for you. The issue you're having is due to a defect and there is no workaround for it. Below are the corresponding fixes related to this.

Symantec Endpoint Protection Manager Home page "Attention needed" details do not match client properties
Fix ID: 2009806
Symptom: On the Symantec Endpoint Protection Manager home page, "More Details, IPS Failures" does not match client properties.
Solution: A SQL query for IPS Failures was updated to that Symantec Endpoint Protection Manager shows the latest IPS version.

Symantec Endpoint Protection Manager Home Page "Security Status . Attention Needed" lists old data in details
Fix ID: 1745613
Symptom: Symantec Endpoint Protection ManagerHomePage "Security Status . Attention Needed" lists old data in details.
Solution: The algorithm to create the hardware key was changed such that the hardware key should not change with minor hardware changes, such as disabling of NICs.

You'll need to upgrade to Release Update 6 Maintenance Patch 1 (RU6 MP1) or later. RU6 MP3 is currently available.
0
 
LVL 38

Expert Comment

by:younghv
ID: 35455429
This question has been classified as abandoned and is closed as part of the Cleanup Program. See the recommendation for more details.
0

Featured Post

6 Surprising Benefits of Threat Intelligence

All sorts of threat intelligence is available on the web. Intelligence you can learn from, and use to anticipate and prepare for future attacks.

Join & Write a Comment

For those of you actively in the Malware fightling business, we now have available an amazing new tool in the malware wars (first recommended to me by rpggamergirl (http://www.experts-exchange.com/M_3598771.html), the Zone Advisor for the Virus and …
Learn about cloud computing and its benefits for small business owners.
This video shows how to remove a single email address from the Outlook 2010 Auto Suggestion memory. NOTE: For Outlook 2016 and 2013 perform the exact same steps. Open a new email: Click the New email button in Outlook. Start typing the address: …
You have products, that come in variants and want to set different prices for them? Watch this micro tutorial that describes how to configure prices for Magento super attributes. Assigning simple products to configurable: We assigned simple products…

758 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question

Need Help in Real-Time?

Connect with top rated Experts

19 Experts available now in Live!

Get 1:1 Help Now