SEP clients are shown as offline in SEPM

Products

• Endpoint Protection

Issue/Introduction

The Symantec Endpoint Protection Manager (SEPM) reports that more than half of the Symantec Endpoint Protection (SEP) clients are offline.
Investigation from the SEP clients shows successful communications with the SEPM.

 

 

 

exsecars.log

Error: Got response 403 from IsapiProxy: /secars/IsapiProxy.dll?isapiProxyCloseGroup=&isapiProxyCloseAgent=6F659C4E74017346019EC872629E6D70

Cause

Duplicated ports settings in IIS and Apache.

IIS proxy settings:
scm.iis.http.port=80
scm.iisproxy.http.port=80

Apache settings:
Listen 8014
Listen 80

 

Resolution

Make a backup of the conf.properties file. Location:
C:\Program Files\Symantec\Symantec Endpoint Protection Manager\tomcat\etc\conf.properties

Edit the conf.properties to remove the IIS listening and proxy settings.
After removing settings, restart the Symantec Endpoint Protection Manager service.
Retest to confirm the issue has been resolved.

Applies To

Symantec Endpoint Protection 12.1.x