Proactive Threat Protection fails to load on Windows 2008 SP 2 x86/x64

Products

• Endpoint Protection

Issue/Introduction

Proactive Threat Protection fails to load for 14.2 MP1 Endpoint Protection clients running on Windows 2008 SP 2 x86/x64. This occurs for both 32-bit and 64-bit architecture.

This issue started on May 20th, 2022.

Environment

Symantec Endpoint Protection 14.2 MP1 client
Windows 2008 SP 2 x86/x64

Cause

Broadcom is no longer able to publish SONAR content compatible with Windows 2008 SP 2 x86/x64.

Resolution

SONAR engine 12.3.069 is the last SONAR engine that is compatible with Windows 2008 SP 2 x86/x64.

Broadcom recommends that customers upgrade/migrate their Windows 2008 SP 2 x86/x64 servers to a newer/supported Windows operating system and install the latest version of Endpoint Protection.

If this is not possible customers should do the following:

• Move all Windows 2008 (non R2) servers into their own groups within the Symantec Endpoint Protection Manager.
• Apply a Liveupdate Content policy to these groups which sets the SONAR heuristics engine 14.3 RU1 revision to May 18th, 2022 Rev 11.  This will apply to the 14.2 MP1 clients and prevent the clients in the groups from updating to newer SONAR content after that point in time.
• If you do not have this content available, open a support ticket to request the last supported SONAR definition JDB file that can be applied to the SEPM

Note that with this content locked, the SEPM will retain this signature set for one year before it gets purged. If this occurs the JDB file can be applied and locked in again if necessary.

Additional Information

See steps 3 and 4 in the Download .jdb files to update definitions for Endpoint Protection Manager document to apply the JDB file to the SEPM server.

Also see SONAR 12.3.0, CIDS 17.2.6, and ERASER 119.1.3 Operating System requirements for Windows 7, Windows Server 2008 and 2008 R2