search cancel

Virus and Spyware Protection is Disabled after migrating SEP for Mac to 12.1.6 MP4 or later

book

Article ID: 163743

calendar_today

Updated On:

Products

Endpoint Protection

Issue/Introduction

After migrating the Symantec Endpoint Protection Mac client product to 12.1.6 MP4 or later, the Virus and Spyware Protection shows as Disabled with a Red X.

If you click Fix, it may flash to Green and then back to Red or Disabled.

Virus and Spyware Protection shows as Disabled with a Red X

In the system.log we see a kernel extension signing error on our Autoprotect kernel extension.

Apr 13 11:22:09 admins SymDaemon[20404]: Version of Kernel Extension is: 15
Apr 13 11:22:09 admins SymDaemon[20404]: Unsigned Kernel Extension will lead to warning if loaded
Apr 13 11:22:09 admins SymDaemon[20404]: Loading Signed version of Kext in 10.9 OS X: /Library/Application Support/Symantec/AntiVirus/Signed/SymAPComm.kext
Apr 13 11:22:09 admins com.apple.kextd[43]: Untrusted kexts are not allowed
Apr 13 11:22:09 admins com.apple.kextd[43]: ERROR: invalid signature for com.symantec.kext.SymAPComm, will not load

Environment

Symantec Endpoint Protection 12.1.6 MP4 or later version of the Mac client

Cause

This is caused by a change to the way Apple performs kernel extension signing so Symantec also had to change in order to comply with the OS standards.

Symantec identified extra resource files within the new kernel extension which contributed to the signing failure.

Resolution

Symantec is currently investigating this issue. This article will be updated as a resolution is determined.

Since this issue seems to only occur if you install the new version of the product over the top of the previous version. Therefore one optional workaround is to uninstall then re-install the product. This will avoid the error.