search cancel

Symantec Endpoint Protection service starts and stops repeatedly with an Event ID of 7031 in the System Event Log when installed on a Windows 2000 Terminal Server


Article ID: 151334


Updated On:


Endpoint Protection


You install Symantec Endpoint Protection on a Windows 2000 Terminal Server.
On reboot, you notice that the Symantec Endpoint Protection sytem tray icon does not display normally, and there are Symantec Endpoint Protection service failures in the event log.

The shield icon in the notification area changes repeatedly from a green dot to a red circle with a line.
  • If you look in the System Event Log, you notice repeat Event IDs of 7031: "The Symantec Endpoint Protection service terminated unexpectedly. It has done this X time(s)...."


This is usually caused by installing Symantec Endpoint Protection while Windows is in Application Server mode.


Ensure you are using Symantec Endpoint Protection 11 Maintenance Release 3 (MR3) or newer, and install Symantec Endpoint Protection while in Remote Administration mode, reboot, then switch to Application Server mode.

For information on obtaining the latest build of Symantec Endpoint Protection, read How to obtain an update or an upgrade for your Symantec corporate product.

Technical Information

Terminal Services in Windows 2000 Server

Terminal Services in Windows 2000 Server is an optional Windows Component in Add/Remove Programs.
Application Server mode or Remote Administration mode is a choice made when installing Terminal Services.
You cannot switch between the two modes unless you un/re-install Terminal Services.
Application mode has two sub-modes: Install and Execute. You can switch to Install mode by using a command line. Using Add/Remove Programs to install software will also automatically switch to install mode. Application mode in any case is not recommended when installing Symantec Endpoint Protection.