Warning: failed to set a custom action for IPS signature in Endpoint Protection errcode=0x80004005

Products

• Endpoint Protection
• Endpoint Security

Issue/Introduction

On Symantec Endpoint Protection (SEP) clients 14.3 RU2 , warnings are logged in client system logs about custom action for Intrusion Prevention System (IPS) signatures that can't be applied.

5266 30/11/2021 09:39:06 Warning 12071000 Failed to set a custom action for IPS signature 33198 (errcode=0x80004005). Most probably, this IPS signature was removed from the IPS content. 
5267 30/11/2021 09:39:06 Warning 12071000 Failed to set a custom action for IPS signature 32015 (errcode=0x80004005). Most probably, this IPS signature was removed from the IPS content. 
5268 30/11/2021 09:39:06 Warning 12071000 Failed to set a custom action for IPS signature 31402 (errcode=0x80004005). Most probably, this IPS signature was removed from the IPS content. 

Environment

Symantec Endpoint protection 14.3 RU2/RU3/RU4 client

Windows OS

Cause

The issue occurs when SEP starts and attempts to read the IPS exceptions in the policy, however due to a race condition in the IPS driver, it fails to correctly read them and results in the error, 'failed to set a custom action...'

 

Resolution

This issue is fixed in Symantec Endpoint Protection (SEP) 14.3 RU 5. For information on how to obtain the latest build of Symantec Endpoint Protection, see Download the latest version of Symantec software here.

Additional Information

CRE-8222