Cannot manually copy Sylink.xml into a Symantec Endpoint Protection client. Access is Denied.

Products

• Endpoint Protection

Issue/Introduction

On a Symantec Endpoint Protection (SEP) client, when you try to replace the sylink.xml file manually by copying it into C:\ProgramData\Symantec\Symantec Endpoint Protection\CurrentVersion\Data\Config, you receive an error message and cannot copy in the file.

Access is Denied. Make sure that the disk is not full or write-protected.

Cause

This behavior is expected. In SEP, the Tamper Protection feature prevents direct modification of Symantec files.

Resolution

Use one of the supported methods below to replace the sylink.xml file on a SEP client machine.

Method 1:

Import the sylink.xml using SylinkDrop.exe tool.  This tool is located in the installation folder. 

By default:

- SEP Client >> C:\Program Files (x86)\Symantec\Symantec Endpoint Protection\<current_install_build_number>\Bin\SylinkDrop.exe.
- SEPM >>        C:\Program Files (x86)\Symantec\Symantec Endpoint Protection Manager\Tools\SylinkDrop\SylinkDrop.exe

Note: Starting from SEP 14.3 RU5 or later, SylinkDrop.exe is no longer found in the SEP client installation folder. Instead, you must use the tool from the SEPM Tools folder.

Method 2:

Import the sylink.xml within the client by going to Help > Troubleshooting > Click on Import... under Communication Settings. 

Method 3:

It is still possible to manually replace the sylink.xml file, however in order to do so Tamper Protection must first be disabled.  This can be done on the client by going to Change Settings > Click Configure Settings under Client Management > Tamper Protection (Tab) > Then uncheck the box that says Protect Symantec security software from being tampered with or shut down.

Once tamper protection is disabled:

1. Stop the SMC service by going to Start > Run > type in > smc -stop.
2. Once the service is stopped, copy the sylink.xml file from the new SEPM, and on the client side, put that sylink.xml file under "C:\ProgramData\Symantec\Symantec Endpoint Protection\CurrentVersion\Data\Config"
3. Replace the existing file and restart the SMC service with Start > Run > smc -start

 

Method 4:

Use the Communication Update Package Deployment from the Symantec Endpoint Protection Manager 14.x.

See the reference: Use the Communication Update Package Deployment from the Symantec Endpoint Protection Manager 14.x