Component Isolation steps for Endpoint Protection and Endpoint Security
search cancel

Component Isolation steps for Endpoint Protection and Endpoint Security


Article ID: 255167


Updated On:


Endpoint Protection Endpoint Security


A step-by-step instructional guide on component isolation when a Symantec Endpoint Protection (SEP) or Symantec Endpoint Security (SES) client installation causes unexpected behavior. This includes "Core Files" only.


Symantec Endpoint Protection
Symantec Endpoint Security


Core Files Component Isolation Instructions

1. Remove all features except Core Files following this document: How to configure Symantec Endpoint Protection 14.x Enterprise Edition to include only "Core Files" (

If the machine does not reproduce the reported issue, add protection components one by one starting with AV/AS with Basic Download Protection Only from the Control Panel until the issue occurs.

2. If the machine is still reproducing the issue with Core Files only, disable the remaining drivers one by one until the issue stops occuring.

Disabling driver Instructions

1. Open the command prompt as Administrator
2. Enter the following commands one by one. A reboot will be needed each time.
3. Attempt to reproduce until the issue occurs.

sc config SymEFASI start= disabled
sc config SymELAM start= disabled
sc config SymEvent start= disabled
sc config SymIRON start= disabled
sc config eeCtrl start= disabled
sc config EraserUtilRebootDrv start= disabled

Once the component or driver causing the issue is found please contact Technical Support

Additional Information

In the event that disabling symefasi does not work and it is necessary to stop it without modifying dependent drivers, rename the driver file.

To find the file:
sc qc symefasi

Look at the BINARY_PATH_NAME value to find the driver file, then rename the extension to .bak. Reboot the server to disable symefasi. Revert the change and reboot again to restore driver functionality.