Teefer install corrupted on Windows 10.0.14393 results in loss of network connectivity.

Products

• Endpoint Protection

Issue/Introduction

Upon upgrading Symantec Endpoint Protection (SEP) to version 14, 14 MP1 or 14 MP2 and rebooting, in some small cases, the network stack appears broken resulting in no network communications.

The following errors can be found within the teeferInstall.log:

• Unbinding symc_teefer2 failed. ret = 00000001
• ERROR: pnc->Apply() failed, unable to install firewall drivers: 0x800706be

teefer.sys is missing from C:\Windows\System32\drivers

Cause

During removal and installation of the Teefer driver, the function call to INetCfg::Apply() fails. There are two identified possible causes for the failure:

1. svchost.exe (NetSetupEngine.dll) crashes which results in the INetCfg::Apply() call failing.

   • Evidence points to Microsoft KB4022715 as being, in part, related. 

   • Removal of this KB has been found to prevent the crash, thus helping to prevent the teefer install issue.

2. Network adaptor is missing because Teefer2 service is deleted incorrectly by SEP. 

Environment

Windows 10.0.14393

Resolution

Microsoft has released a Windows Update that resolves this issue.

See: https://support.microsoft.com/en-us/help/4038782/windows-10-update-kb4038782

• Addressed an issue where some Windows clients receive a 0xc0000005 ACCESS_VIOLATION error when trying to install drivers.