What to do when the network adapter is blocked by Application and Device Control Policy

book

Article ID: 156501

calendar_today

Updated On:

Products

Endpoint Protection

Issue/Introduction

By mistake customer blocked the Network Adapter by Application and Device Control Policy.

 All network traffic dropped

Cause

  Customer blocked the Network Adapter by Application and Device Control Policy.

Resolution

To revert the situation is necessary following the steps:

  • Change the Application and Device Control of group.
  • Copy the lsprofile.xml of this specific group.
  • Import the lsprofile.xml in each SEP client with network Adapter that were blocked.
 
Change the Application and Device Control
  1. Open the Symantec Endpoint Protection Manager;
  2. Click on clients;
  3. Click on Policies tab (Between clients and details);
  4. Edit the Application and Device Control policy;
  5. Select Device Control;
  6. Take out any rule that are blocking the network adapter;
  7. Click on OK button.
 
Copy the LSProfile.xml of the group
  1. Note the begin of characters of Policy Serial Number (In the top of page)
    • Ex.: Policy serial Number= f8b0-05/16/2012 16:57:46 323
    • Just note: F8B0
  2. Go to the folders of groups, in the SEPM server
    • The folder is in the similar path: "%driver%\Program Files\Symantec\Symantec Endpoint Protection Manager\data\outbox\agent" in 32bits and %driver%\Program Files(x86)\Symantec\Symantec Endpoint Protection Manager\data\outbox\agent" in 64bits
    • Enter in the folder that starts with the same begin of the Policy Number (Ex.F8B0)
    • Copy the file "LSProfile.xml" to a PenDrive or Brun in a CD/DVD
 
Import the LSProfile.xml in each SEP client.
  1. Bring the LSProfile.xml to the station with problem (By PenDrive or CD/DVD);
  2. Open the SEP client (double click in the shield next to the clock);
  3. Click on the "HELP" button;
  4. Select "Troubleshooting...";
  5. Click in "Import..." button under the "Policy Profile" options;
  6. Select the LSProfile.xml from CD/DVD or PenDrive.

 

Restar the SEP client service

  1. To Stop: Go to Start > Run > type: SMC -Stop
  2. To Start: Go to Start > Run > type: SMC -Start

Applies To

 SEPM 12.1

SEP client 12.1