When attempting to start Symantec Endpoint Protection (SEP), a SfMan.plg error message is shown.
The Windows Application log shows an Sfman.plg related Application Error event ID 1000.
Date Log Event Type Source Computer User Event ID Description 5/21/2015 3:24:50 PM Application Error Application Error server.domain.local 1000 "Faulting application name: ccSvcHst.exe, version: 126.96.36.199, time stamp: 0x53713b15 Faulting module name: SfMan.plg, version: 12.1.5337.5000, time stamp: 0x5413cac2 Exception code: 0xc0000005 Fault offset: 0x000115ce Faulting process id: 0xcdc Faulting application start time: 0x01d093fbcdfafe68 Faulting application path: C:\Program Files (x86)\Symantec\Symantec Endpoint Protection\12.1.5337.5000.105\Bin\ccSvcHst.exe Faulting module path: C:\Program Files (x86)\Symantec\Symantec Endpoint Protection\12.1.5337.5000.105\Bin\SfMan.plg Report Id: 0c7959e4-ffef-11e4-bae1-005056ad2eb1"
Symantec Endpoint Protection 12.1 RU5 or higher
An unhandled exception occured after a call to a method to monitor WBEM (Web-Based Enterprise Management, Microsoft's implementation of which is WMI) changes resulted in a NULL pointer and the next method was called using that pointer, resulting in a crash of the SfMan.plg process.
The issue was resolved in SEP 12.1 RU6 MP6 and 14, by properly handling the method failure that lead to the crash.