What functions of the Endpoint Protection client are disabled by the smc -stop command?

Products

• Endpoint Protection

Issue/Introduction

You want to know how stopping SMC will affect the Symantec Endpoint Protection (SEP) client.

Resolution

Issuing the smc -stop command stops the Symantec Management Client (SMC) and the Symantec Endpoint Protection service (ccSvcHst.exe).

 

For example:

C:\Program Files (x86)\Symantec\Symantec Endpoint Protection\smc.exe -stop

 

Stopping SMC disables the following features in all versions of SEP:

• Client-Server communications
• Automatic content updates
• Client notifications
• Network Threat Protection (NTP) Firewall, and all traffic will be allowed unless "Block all traffic until the firewalls starts and after the firewall stops" is enabled in SEP security settings,
• Client Intrusion Detection System (CIDS)
• Application and Device Control
• Host Integrity

 

Stopping SMC disables the following features in SEP 14 and newer. In SEP 12.1.x these features are still enabled but no client notifications will be generated.

• Auto-Protect
• Proactive Threat Protection: SONAR and Device Control
• Download Insight
• Email Auto-Protect

 

Stopping SMC disables the protection capabilities of the SEP agent but drivers remain running. 

 

In all versions of SEP when SMC is stopped the following feature is still enabled but no client notifications will be generated.

• Tamper Protection

 

To restart SMC use -start command line:

C:\Program Files (x86)\Symantec\Symantec Endpoint Protection\smc.exe -start