Component Isolation steps for Endpoint Protection and Endpoint Security

Products

• Endpoint Protection
• Endpoint Security

Issue/Introduction

A step-by-step instructional guide on component isolation when a Symantec Endpoint Protection (SEP) or Symantec Endpoint Security (SES) client installation causes unexpected behavior. This includes "Core Files" only.

Environment

Symantec Endpoint Protection
Symantec Endpoint Security

Resolution

Core Files Component Isolation Instructions

1. Remove all features except Core Files following this document: How to configure Symantec Endpoint Protection 14.x Enterprise Edition to include only "Core Files" (broadcom.com)

If the machine does not reproduce the reported issue, add protection components one by one starting with AV/AS with Basic Download Protection Only from the Control Panel until the issue occurs.

2. If the machine is still reproducing the issue with Core Files only, disable the remaining drivers one by one until the issue stops occuring.

Disabling driver Instructions

1. Open the command prompt as Administrator
2. Enter the following commands one by one. A reboot will be needed each time.
3. Attempt to reproduce until the issue occurs.


sc config SymEFASI start= disabled
sc config SymELAM start= disabled
sc config SymEvent start= disabled
sc config SymIRON start= disabled
sc config eeCtrl start= disabled
sc config EraserUtilRebootDrv start= disabled


Once the component or driver causing the issue is found please contact Technical Support

Additional Information

In the event that disabling symefasi does not work and it is necessary to stop it without modifying dependent drivers, rename the driver file.

To find the file:
sc qc symefasi

Look at the BINARY_PATH_NAME value to find the driver file, then rename the extension to .bak. Reboot the server to disable symefasi. Revert the change and reboot again to restore driver functionality.