Endpoint Security processes and services

Products

• Endpoint Security
• Endpoint Security Complete

Issue/Introduction

You want to know the processes and services used by Symantec Endpoint Security (SES)

Symantec Endpoint Protection (SEP) 14.3x and 16 agents.

Resolution

SEP 16 Processes:

Display Name / Description	Description	Path	Binary
Endpoint Security Agent	Primary user interface process for the agent.	C:\Program Files\Broadcom\Endpoint Security Agent\<version>\bin64	main_ui.exe
Symantec Service Framework	Symantec Service Framework — hosts multiple protection services.	C:\Program Files\Broadcom\Endpoint Security Agent\<version>\bin64	ccSvcHst.exe
Symantec Browser Extension Bridge	Facilitates communication for the Web Extension / Browser Protection.	C:\Program Files\Broadcom\Endpoint Security Agent\Definitions\WebExtConnectorDefs\<defs version>	webextbridge.exe
Symantec Endpoint Collector	Part of the Threat Defense for AD (TDAD) module.	C:\Program Files\Broadcom\Endpoint Security Agent\Definitions\SepServiceTdadDefs\<defs version>	SETDADCollector.exe
Endpoint Security Agent ADScan process	Used by the App Discovery module for scanning for applications and binary files on the endpoint.	C:\Program Files\Broadcom\Endpoint Security Agent\Definitions\SeaBladeAppDiscoveryDefs\<defs version>	ADScan.exe
Endpoint Security Agent command line interface	Command-line utility for managing the agent (replaces smc.exe).	C:\Program Files\Broadcom\Endpoint Security Agent\<version>\bin64	agentcli.exe

 

SEP 16 Services:

Display Name / Description	Service Name	Description
Symantec Endpoint Protection	SepMasterService	Provides malware and threat protection for Symantec Endpoint Protection.
Endpoint Security Agent Platform Service	EapService	Manages the agent's user interface.
Endpoint Security Agent Shared Services	SeaSharedServices	Handles core communication and management functions.
Endpoint Security Agent Scripting Service	SeaScriptingService	Runs scripts used for administrative and troubleshooting tasks.
Endpoint Security Agent Blade Service	SeaBladeService	Provides several of the endpoint's protection features, including malware protection, host integrity, browser protection, behavioral analysis, and device/application control.
Endpoint Security Agent Core Service	SeaCoreService	Delivers core protection and detection capabilities.
Symantec Endpoint Protection Shared Service	SepSharedService	Manages shared Symantec Endpoint Protection functions such as logging, feature management, and communication.
Endpoint Security Agent Firewall Service	SepBladeFirewall	Provides firewall protection on Windows, monitoring and controlling network traffic to help block malicious connections.

 

SEP 14.3x Processes and Services:

Display Name / Description	Service Name	Description	Path	Binary
Symantec Endpoint Protection	SepMasterService	Provides malware and threat protection for Symantec Endpoint Protection.	C:\Program Files\Symantec\Symantec Endpoint Protection\<version>\Bin	ccSvcHst.exe
Symantec Endpoint Protection (User Session)	SmcGui (Not a service)	User-context instance. Loads once for each user logged in unless LaunchSmcGui is set to 0 in the registry.	C:\Program Files\Symantec\Symantec Endpoint Protection\<version>\Bin	ccSvcHst.exe
Symantec Endpoint Protection Hardening CAF Service	heCAF	Communication service.	C:\Program Files\Symantec\Symantec Endpoint Protection\<version>\SAEP\Common Agent Framework	CAFServiceMain.exe
Symantec Endpoint Protection Hardening Detection	SISIDSService	Intrusion detection service that monitors system state.	C:\Program Files\Symantec\Symantec Endpoint Protection\<version>\SAEP\IDS\bin	SISIDSService.exe
Symantec Endpoint Protection Hardening Prevention	SISIPSService	Intrusion prevention service that communicates with the server for policies and events.	C:\Program Files\Symantec\Symantec Endpoint Protection\<version>\SAEP\IPS\bin	SISIPSService.exe
Symantec Endpoint Protection Hardening Utility	SISIPSUtil	Controls communications between the Endpoint Protection services.	C:\Program Files\Symantec\Symantec Endpoint Protection\<version>\SAEP\IPS\bin	sisipsutil.exe
Symantec Endpoint Protection Local Proxy Service	SepLpsService	Proxies the web traffic for WSS Traffic Redirection to allow for more granular web traffic management.	C:\Program Files\Symantec\Symantec Endpoint Protection\<version>\Bin	ccSvcHst.exe
Symantec Endpoint Protection Scan Service	SepScanService	Provides real-time and on-demand scanning of disks and files.	C:\Program Files\Symantec\Symantec Endpoint Protection\<version>\Bin64	ccSvcHst.exe
Symantec Endpoint Protection WSC Service	sepWscSvc	Allows Symantec Endpoint Protection to report status to the Windows Security Center.	C:\Program Files\Symantec\Symantec Endpoint Protection\<version>\Bin64	sepWscSvc64.exe
Symantec Network Access Control (Deprecated)	SNAC	Checks that the computer complies with the defined security policy and communicates with the Symantec Enforcers to allow your computer to access the corporate network.	C:\Program Files\Symantec\Symantec Endpoint Protection\<version>\Bin64	snac64.exe
Symantec Endpoint Security	(Not a service)	Cloud Connect Defense	C:\Program Files\WindowsApps\<app identifier>	Security.UWP.exe
Symantec Endpoint Collector	(Not a service)	Threat Defense for Active Directory	C:\Program Files\Symantec\Symantec Endpoint Protection\<version>\Bin64	SETDADCollector.exe
Symantec Endpoint Domain Manager	(Not a service)	AD Gateway	C:\ProgramData\Symantec\Symantec Endpoint Protection\<version>\Data\Definitions\MiniDMDefs\<defs version>	SETDADMiniDM.exe

Note: For 64-bit clients on version 14.3 RU4 and older replace "C:\Program Files\..." with "C:\Program Files (x86)\...".