Warning: failed to set a custom action for IPS signature in Endpoint Protection 12.1

book

Article ID: 159300

calendar_today

Updated On:

Products

Endpoint Protection

Issue/Introduction

On Symantec Endpoint Protection (SEP) clients 12.1 RU4 or higher, warnings are logged in client system logs about custom action for Intrusion Prevention System (IPS) signatures that can't be applied.

Failed to set a custom action for IPS signature xxxxx (errcode=0x80070057). Most probably, this IPS signature was removed from the IPS content.

Failed to set a custom action for IPS signature xxxxx (errcode=0x80010221). Most probably, this IPS signature was removed from the IPS content.

Cause

The involved IPS signatures are deprecated.

Resolution

Remove the exceptions for the deprecated IPS signatures by editing the appropriate Intrusion Prevention policy in Symantec Endpoint Protection Manager.

List of current IPS signatures can be found here:
http://www.symantec.com/security_response/attacksignatures/

 

Applies To

 

The IPS policy has been customized with exceptions where custom actions have been set for the IPS signatures reported in the warnings.