What functions of the Endpoint Protection client are disabled by the smc -stop command?

Products

• Endpoint Protection

Issue/Introduction

How does running the command smc -stop impact the Endpoint agent's (Symantec Endpoint Protection or Symantec Endpoint Security) protection capabilities?

Environment

• Symantec Endpoint Protection 14.3.x
• Symantec Endpoint Security 14.3.x
• Windows Operating Systems 

Resolution

Issuing the smc -stop command stops the Symantec Management Client (SMC) and the Symantec Endpoint Protection service (ccSvcHst.exe).  This can be a useful troubleshooting step. 

To run the command from the Run menu

1. Click Start -> Run
2. Type in "smc -stop"
3. Wait for the protection agent shield to disappear from the system tray

to run the command from Command prompt

1. Open an Administrator elevated cmd.exe window
2. Type in the following command:

C:\Program Files (x86)\Symantec\Symantec Endpoint Protection\smc.exe -stop

 

Stopping SMC disables the following features in all versions of SEP:

• Application and Device Control
• Automatic content updates
• Auto-Protect
• Client-Server communication
• Client Notifications
• Device Control
• Download Insight
• Email Auto-Protect
• Host Integrity
• Intrusion Prevention (IPS)
• Network Threat Protection (NTP) Firewall, and all traffic will be allowed unless "Block all traffic until the firewalls starts and after the firewall stops" is enabled in SEP security settings
• Proactive Threat Protection (SONAR)

Stopping SMC disables the protection capabilities of the SEP agent but drivers remain running.  In all versions of SEP when SMC is stopped the following feature is still enabled but no client notifications will be generated.

• Tamper Protection

To restart SMC, use the same steps above, but replace the word "stop" with "start".