search cancel

Symantec Endpoint Protection service starts and stops repeatedly with an Event ID of 7031 in the System Event Log when installed on a Windows 2000 Terminal Server

book

Article ID: 151334

calendar_today

Updated On:

Products

Endpoint Protection

Issue/Introduction


You install Symantec Endpoint Protection on a Windows 2000 Terminal Server.
On reboot, you notice that the Symantec Endpoint Protection sytem tray icon does not display normally, and there are Symantec Endpoint Protection service failures in the event log.

Symptoms
The shield icon in the notification area changes repeatedly from a green dot to a red circle with a line.
  • If you look in the System Event Log, you notice repeat Event IDs of 7031: "The Symantec Endpoint Protection service terminated unexpectedly. It has done this X time(s)...."


Cause

This is usually caused by installing Symantec Endpoint Protection while Windows is in Application Server mode.

Resolution

Ensure you are using Symantec Endpoint Protection 11 Maintenance Release 3 (MR3) or newer, and install Symantec Endpoint Protection while in Remote Administration mode, reboot, then switch to Application Server mode.

For information on obtaining the latest build of Symantec Endpoint Protection, read How to obtain an update or an upgrade for your Symantec corporate product.




Technical Information

Terminal Services in Windows 2000 Server

Terminal Services in Windows 2000 Server is an optional Windows Component in Add/Remove Programs.
Application Server mode or Remote Administration mode is a choice made when installing Terminal Services.
You cannot switch between the two modes unless you un/re-install Terminal Services.
Application mode has two sub-modes: Install and Execute. You can switch to Install mode by using a command line. Using Add/Remove Programs to install software will also automatically switch to install mode. Application mode in any case is not recommended when installing Symantec Endpoint Protection.