When attempting to start SEP, a SfMan.plg error message is shown

Products

• Endpoint Protection

Issue/Introduction

When attempting to start Symantec Endpoint Protection (SEP), a SfMan.plg error message is shown.
The Windows Application log shows an Sfman.plg related Application Error event ID 1000.

Date	Log	Event Type	Source	Computer	User	Event ID	Description
5/21/2015 3:24:50 PM	Application	Error	Application Error
server.domain.local		1000	"Faulting application name: ccSvcHst.exe, version: 12.11.3.11, time stamp: 0x53713b15
Faulting module name: SfMan.plg, version: 12.1.5337.5000, time stamp: 0x5413cac2
Exception code: 0xc0000005
Fault offset: 0x000115ce
Faulting process id: 0xcdc
Faulting application start time: 0x01d093fbcdfafe68
Faulting application path: C:\Program Files (x86)\Symantec\Symantec Endpoint
Protection\12.1.5337.5000.105\Bin\ccSvcHst.exe
Faulting module path: C:\Program Files (x86)\Symantec\Symantec Endpoint
Protection\12.1.5337.5000.105\Bin\SfMan.plg
Report Id: 0c7959e4-ffef-11e4-bae1-005056ad2eb1"

Environment

Symantec Endpoint Protection 12.1 RU5 or higher

Cause

An unhandled exception occured after a call to a method to monitor WBEM (Web-Based Enterprise Management, Microsoft's implementation of which is WMI) changes resulted in a NULL pointer and the next method was called using that pointer, resulting in a crash of the SfMan.plg process.

Resolution

The issue was resolved in SEP 12.1 RU6 MP6 and 14, by properly handling the method failure that lead to the crash.