search cancel

Symantec Endpoint Protection: Event ID 4097 and 4096 occur near 4:00 AM on a Windows 2003 Small Business Server


Article ID: 151366


Updated On:


Endpoint Protection


Event IDs 4097 and 4096 are listed in the Windows Event Logs at 4 AM on a Windows 2003 Small Business Server.

In the Application Log of the Windows event viewer there are the following errors reported by secars:
  • Event ID 4097: src = seacars ... "Failed to start radius server the radius port may be used by another process. "
  • Event ID 4096: src = secars ... "Create log file error ... "

Net Stat shows that nothing is running on port 1812


Symantec Endpoint Protection stops "secars" to allow the Exchange maintenance cycle. The Exchange maintenance cycle starts at 4 AM by default on a Windows 2003 Small Business Server.


This problem is fixed in Symantec Endpoint Protection Manager 11.0.2000 build 1567.

For information on how to obtain the latest build of Symantec Endpoint Protection, please read the following document:
Obtaining an upgrade or update for Symantec Endpoint Protection 11.x or Symantec Network Access Control 11.x.