Paged pool leak on Endpoint Protection Managers with Endpoint Protection client installed

Products

• Endpoint Protection

Issue/Introduction

Windows system with Symantec Endpoint Protection Manager (SEPM) and Symantec Endpoint Protection (SEP) Client with Advanced Download Protection installed encounters paged pool memory exhaustion.  The servers may become slow or unresponsive prior to reboot.  The server may crash with BugCheck 7E. A reboot is required to restore normal operation.

Environment

• SEPM
• SEP Client with feature Advanced Download Protection

Cause

The mechanism to limit the number of entries stored by AutoProtect for Download Insight is not working correctly. Over time this can lead to excessive Paged Pool Memory utilization and eventual exhaustion.

Resolution

This issue is fixed in Symantec Endpoint Protection 14.0.  For information on how to obtain the latest build of Symantec Endpoint Protection, see Download the latest version of Symantec Endpoint Protection.

Fix Notes for SEP 14.0: https://support.symantec.com/en_US/article.INFO4000.html

Available workarounds:

• Uninstall the SEP Client feature Advanced Download Protection to prevent it from exhausting Paged Pool Memory.
• Reboot as needed to flush Paged Pool Memory allocation. Reboot frequency required will vary by system based on SEP Client Advanced Download Protection workload.