SEPM Console shows wrong time in logs

Products

Endpoint Protection

Issue/Introduction

When using the SEPM console, various console messages might have their date shown in a different time zone, with indication of its name, despite the system time being set to a proper, different one.
As an example, the date might look like this while the OS being set to IST (India Standard Time):

Environment

Symantec Endpoint Protection Manager

Cause

The issue is caused by a corrupt installation of the SEPM making the JVM (Java Virtual Machine) unable to obtain correct time zone from the OS, or OS configuration prohibiting from reading the values properly (REG_SZ "TimeZoneKeyName" @ HKLM\SYSTEM\CurrentControlSet\Control\TimeZoneInformation). This may happen if at some point the system has been changed to a different time zone in production.

Resolution

The SEPM stores all dates in its logging data as UTC, so no data is actually affected by the issue. However the console converts the UTC time "on the fly" to a local time zone for display in its interface.

To resolve the problem, SEPM needs to be re-installed and the system configuration checked whether the applications can access the current time zone information.
However should this not be feasible, a temporary workaround, is to specify the desired time zone directly to the JVM when launching it. In order to do so:

locate the file sesm.bat; it is stored in the SEPM_installdir\bin catalog (usually C:\Program Files (x86)\Symantec\Symantec Endpoint Protection Manager\bin);
close any console instance if one is running, and edit the file (you may need to save it under different path if your user does not have edit rights on the catalog, and copy it over using privileges' elevation prompt);
right after the line:
```
@start "SESM" "C:\Program Files (x86)\Symantec\Symantec Endpoint Protection Manager\jre11\bin\javaw.exe"
```
preceded and followed with whitespace, append following string:
```
-Duser.timezone="TIMEZONE"
```
where TIMEZONE denotes the time zone you want your console should display the time in. The parameter accepts time zone names listed in the Oracle's documentation (https://docs.oracle.com/middleware/12211/wcs/tag-ref/MISC/TimeZones.html) and date in the "GMT_hour_difference" format, for ex. "GMT+4" or "America/Los_Angeles".
The resulting line should look like:
```
@start "SESM" "C:\Program Files (x86)\Symantec\Symantec Endpoint Protection Manager\jre11\bin\javaw.exe" -Duser.timezone="TIMEZONE" --module-path(...)
```
where --module-path(...) denotes all the other parameters that had already been there before editing the file.

Please do note, that when this setting is on, it has a precedence over any OS settings and will always be applied, as long as the line is there.