The Symantec Mail Security for Microsoft Exchange (SMSMSE) service shuts down at apparently random times, and does not restart automatically. This results in no SMSMSE policies being applied against incoming email, including AntiSpam, Content Filtering and Virus policies.
The following events are observed in the System event log:
Type : Warning
Event : 27
Source : e1iexpress
Intel(R) 82574L Gigabit Network Connection
Network link is disconnected.
Type : Information
Event : 7042
Source : Service Control Manager
User : \SYSTEM
The Symantec Mail Security for Microsoft Exchange service was successfully sent a stop control.
The reason specified was: 0x40030011 [Operating System: Network Connectivity (Planned)]
The Symantec Mail Security for Microsoft Exchange (SMSMSE) service has a service dependency set on the TCP/IP NetBIOS Helper (LmHosts) service. When Windows detects the network connection has been disconnected for any reason, for any amount of time, the LmHosts service is issued a shut down command by the service control manager. Because SMSMSE has a service dependency on LmHosts, the service control manager also issues a shut down command to the SMSMSE service. As soon as the network is restored, the LmHosts service is issued a start command, but no such command is issued to the SMSMSE service, resulting in the SMSMSE service staying stopped until a manual start command is issued.
It appears there is a known issue in VMWare drivers for the Intel E1000 and E1000E NIC types that result in random disconnects from the network.
Determine the root cause for the network disconnect, and prevent this network disconnect event from occurring. This will prevent the SMSMSE service from being issued the stop request by the service control manager.
Remove the service dependency for the SMSMSE service on the LmHosts service. This will prevent the service control manager from issuing the shut down request when the network interface disconnects.
To remove the service dependency:
After changing these settings, the SMSMSE service will no longer be issued a service shutdown request by the service control manager when the network interface is disconnected.