Endpoint Protection 14.3 ccSvcHst.exe crashes when using Profile Relocator

Products

• Endpoint Protection

Issue/Introduction

Symantec Endpoint Protection (SEP) 14.3 ccSvcHst.exe crashes when using Profile Relocator.

Environment

Symantec Endpoint Protection 14.3 - 14.3.589.0000

Symantec Endpoint Protection  14.3 RU1 - 14.3.3384.1000

SMR Driver 5.0.1.48 - SMR501.sys

Cause

Profile Relocator makes the following unexpected changes to the ProfileList:

HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\ProfileList
     Public    REG_EXPAND_SZ    %SystemDrive%\Users\Public  (expected)

To: HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\ProfileList
     Public  REG_SZ  E:\Users\Public (unexpected)

 

Resolution

This issue has been resolved through new SMRDefs content delivered via LiveUpdate.

To confirm the update has been applied, with access to the endpoint: 

1. Open the SEP client UI
2. Click on Help, then Troubleshooting
3. Choose Versions on the left
4. In the Engines window, scroll down to Power Eraser Engine

If the Power Eraser Engine is at least 5.2.2.8, then the endpoint has received the SMR driver update with the fix. The associated driver file is SMR522.sys.

Additional Information

ESCRT-4067