Red status notification appears in the agent

Products

• Symantec Products

Issue/Introduction

Symantec Endpoint Protection Small Business Edition cloud (SEP SBE) agent is displaying a Red status.

Cause

Agents can show a red status for a number of reasons including the following.

• Virus definitions are out of date by 14 or more days.
• Agent policies are out of sync with the Hosted Endpoint Portal.
• Communication with the Hosted Endpoint Portal could be interrupted.
• Core features have been disabled (e.g. Antivirus/Antispam).

Resolution

Client virus definitions are out of date by 14 or more days:

Symantec provides a stand-alone auto-updating definitions package called Intelligent Updater which will update an agent to the newest definitions, this can clear blockages which may occur if older definitions are corrupt and preventing the agent from updating definitions using the regular LiveUpdate process. In cases where definitions are out of date, run the intelligent updater on affected systems.

Replace Old Definitions

1. Download the Intelligent Updater file that is appropriate for your operating system
   • Workstations:
     • For 32bit systems: symcdefscore3v5i32.exe
     • For 64bit systems: symcdefscore3v5i64.exe
   • Servers:
     • For 32bit Servers: symcdefsv5i32.exe
     • For 64bit Servers: symcdefsv5i64.exe
   • Note: To confirm the architecture, click Start, right-click Computer, and then click Properties. Under System, look for the System type.
2. Right-click the downloaded file and choose Run as administrator.
3. When prompted to "deploy all updates from this updater," click Yes.
4. Monitor the client for the next 24-48 hours to ensure that definitions are updating consistently.

 

Agent policies are out of sync with the Management Console:

Please re-distribute the policy to the groups containing clients with red status, this will update their policies and hopefully re-establish proper functionality. To do so:

1. Login to the SEP SBE management console.
2. Navigate to the Policies tab.
3. Click the Endpoint Protection link on left side of the page.
4. Open the policy used by the effected agent.
5. Click "Save and Apply" at the bottom of the page.
6. Hit the F5 button to refresh the page, when the distribution bar reaches 100% that indicates that all clients have received the policy.

Clients having trouble communicating with the Hosted Endpoint Portal:

The following two documents discuss the various URLs necessary for proper functionality of SEP SBE, please review them and make sure that all necessary communications are open and available.

• Please check that the following URLs are not blocked.
• Please browse to these sites using an internet browser to confirm connectivity.