Symantec Endpoint Protection: Event ID 4097 and 4096 occur near 4:00 AM on a Windows 2003 Small Business Server

Products

• Endpoint Protection

Issue/Introduction

Event IDs 4097 and 4096 are listed in the Windows Event Logs at 4 AM on a Windows 2003 Small Business Server.

Symptoms
In the Application Log of the Windows event viewer there are the following errors reported by secars:

• Event ID 4097: src = seacars ... "Failed to start radius server the radius port may be used by another process. "
• Event ID 4096: src = secars ... "Create log file error ... "

Net Stat shows that nothing is running on port 1812

Cause

Symantec Endpoint Protection stops "secars" to allow the Exchange maintenance cycle. The Exchange maintenance cycle starts at 4 AM by default on a Windows 2003 Small Business Server.

Resolution

This problem is fixed in Symantec Endpoint Protection Manager 11.0.2000 build 1567.

For information on how to obtain the latest build of Symantec Endpoint Protection, please read the following document:
Obtaining an upgrade or update for Symantec Endpoint Protection 11.x or Symantec Network Access Control 11.x.