Windows Offloaded Data Transfer (ODX) support in Symantec Endpoint Protection (SEP)

Products

• Endpoint Protection

Issue/Introduction

Symantec Endpoint Protection (SEP) 12.1 RU4 MP1 and higher fully support ODX, the direct inter-storage device data transfer feature introduced in Windows Server 2012, otherwise known as "copy offload". However, when using Symantec Endpoint Protection (SEP) 12.1 RU4 MP1, data transfer speeds may be slower than expected.

Cause

The following registry keys and values should be present to signify the relevant drivers support ODX:

• HKLM\System\CurrentControlSet\Services\BHDrvx64\SupportedFeatures (REG_DWORD, value: 3)
• HKLM\System\CurrentControlSet\Services\SRTSP\SupportedFeatures (REG_DWORD, value: 3)

The latter should be present by default in Symantec Endpoint Protection (SEP) 12.1 RU4 MP1, while the former is not. In Symantec Endpoint Protection (SEP) 12.1 RU5 and higher, both registry keys are present by default.

Resolution

To remedy this issue for Symantec Endpoint Protection (SEP) 12.1 RU4 MP1, perform the following actions:

1. Disable Tamper Protection (http://www.symantec.com/business/support/index?page=content&id=TECH192023).
2. Add a registry key HKLM\System\CurrentControlSet\Services\BHDrvx64\SupportedFeatures (REG_DWORD, value: 3).
3. Verify the presence of HKLM\System\CurrentControlSet\Services\SRTSP\SupportedFeatures (REG_DWORD, value: 3). If not present, add this key.
4. Reboot.