After reboot or service restart Endpoint Protection is not a Group Update Provider

book

Article ID: 156364

calendar_today

Updated On:

Products

Endpoint Protection

Issue/Introduction

A Symantec Endpoint Protection (SEP) Group Update Provider (GUP) intermittently fails to start GUP role.  Changes in GUP status attributed to SEP service restart or reboot.  When the GUP role is not started a SEP service restart or reboot is required to start the GUP role.

Sylink Debugging sylink.log

  • DD/MM HH:MM:SS [####] <GetOnlineNicInfo>:Netport Count=0

Symantec Management Client (SMC) debug.log

  • DD/MM HH:MM:SS [####:####] GUProxy - Is this computer a GUP Server? [0]

For more information on sylink.log and debug.log refer to http://www.symantec.com/docs/TECH102412

Cause

The SEP Client will not initialize the GUP role if it is unable to query the network interface.

Common scenarios:

  • Intermittent network connectivity
  • Boot timing issue

In SEP 12.1 Release Update 1 (RU1) and later the GUP role will remain disabled until SEP service restart or reboot if GUPCheckAlive is not configured or set to 0.

Resolution

Configure GUPCheckAlive with a value greater than zero.

  1. Add the following DWORD registry value to the affected client's registry:
  2. 32-bit: HKEY_LOCAL_MACHINE\SOFTWARE\Symantec\Symantec Endpoint Protection\SMC\GUPCheckAlive
    64-bit: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Symantec\Symantec Endpoint Protection\SMC\GUPCheckAlive
  3. Modify the value of GUPCheckAlive to a value greater than 1
    Note: The value of GUPCheckAlive indicates the number of times the client will attempt to enable GUP functionality. The higher the number, the more attempts to initialize. Do not exceed a value of 255.
  4. Restart the SMC service to allow the changes to take effect.

 

After making these changes, the client will attempt to restart the GUP functionality every 60 seconds based on the value of the GUPCheckAlive registry.