Updating Symevent files for Symantec Endpoint Protection 11.x client

book

Article ID: 177741

calendar_today

Updated On:

Products

Endpoint Protection

Issue/Introduction

This document describes how to update the Symevent files for a Symantec Endpoint Protection 11.x client.

 

Resolution

Several files make up the module known as Symevent. Symevent is used by many different Symantec programs in all versions of Windows and is updated periodically. When you install current Symantec software, these files will normally be updated. If you are experiencing a problem with a Symantec program that may be fixed by updating these files, or if you just want to make sure that you have the most recent version, then follow the instructions for your operating system:

To update the Symevent files on Windows 2003/XP/2000/NT (Including Server versions)

  1. Download Sevinst.exe from the Symantec FTP site.
  2. Save the file to an easy accessible location on the hard drive, (for example C:\Windows\Temp).
  3. Open a command prompt, and change to the folder where you downloaded the Sevinst.exe file.
  4. On computers that run Symantec Endpoint Protection version 11.x or later, type the following command and hit Enter:

    sevinst.exe
     
  5. When the popup window states it has updated successfully, restart the computer.

 

To update the Symevent files on Windows XP 64-bit Edition 2003 or on Windows Server 2003 64-bit Edition

  1. Download one of the following files from the Symantec FTP site, depending on the type of 64-bit processor that your computer uses:
  2. Save the file to an easy accessible location on the hard drive, (for example C:\Windows\Temp).
  3. Open a command prompt, and change to the folder where you downloaded the file.
  4. On computers that run Symantec Endpoint Protection version 11.x or later, type the following command and hit Enter:

    sevinst64.exe

    sevinst64x86.exe

     
  5. When the popup window states it has updated successfully, restart the computer.
     


To find the version of Symevent that is installed:

  • For 32-bit computers, browse to C:\Windows\System32\drivers and right click the file SYMEVENT.SYS, click Properties and select the Version tab.
  • For 64-bit computers, browse to C:\Windows\System32\drivers and right click the file SYMEVENT64x86.SYS or SYMEVENT64.SYS, click Properties and select the Details tab.


Optional switches:
There are several switches that you can use if you are in doubt that the Symevent is actually being updated. In most cases, Sevinst.exe does not require any switches. A common exception is if you see the error message "Symevent does not exist on this computer, no action taken." In this case, run Sevinst.exe with a Product ID, as described below.
 

Switch Explanation
/q Sets the installation to quiet mode, where no user interface is presented, and no message will be displayed when finished.
/log Generates the Symevent.log file in the Windows temp folder (%temp%), which logs the actions of the installer.

<Product ID>

SAVCE

This is a required parameter when Symevent has not been previously installed on the computer. If Sevinst.exe is run without a product ID, the program runs in "Update Only" mode and will update the Symevent files on the system (if they exist). Note that there is no "/PRODID" switch; Sevinst will interpret any text that does not match any of the switches in this list as a product ID. Also, the Product ID does not use a slash (/).

Sevinst.exe will not install Symevent when it runs in "Update Only" mode (that is, without a product ID) unless Symevent is already installed on the computer.

For Symantec Endpoint Protection use SAVCE on all platforms.

Using the SAVCE switch forces all Symevent files to be replaced.

For example, if you have Symantec Endpoint Protection and want to install or update Symevent on Windows 2000, XP, 2003, Vista, 2008, or 7 use the following syntax depending on the OS:

sevinst.exe SAVCE

sevinst64.exe SAVCE

sevinst64x86.exe SAVCE

/u Indicates that this is an uninstall.
/nodel Tells the Symevent installer that it should not delete Symevent files, even if the usage count goes to zero. This is used when running Symevent to decrement the usage counts from a previous version of the product.

Examples of switch usage:

  • To install Symevent silently and create a log on the Windows operating systems:

sevinst.exe /q /log SAVCE

  • To uninstall Symevent:

sevinst.exe /u

  • To force Symevent to replace all files:

sevinst.exe SAVCE