Windows will not boot after installing SEP with Smart App Control enabled

Products

• Endpoint Protection

Issue/Introduction

In a Windows 11 22H2 environment, if SEP is installed with Smart App Control(SAC) enabled and the OS is restarted, then OS will not boot.

If Smart App Control is enabled after SEP is installed, the OS will boot.

Environment

Release :  SEP 14.3 RU8 and below

Resolution

SEP 14.3 RU9 contains a fix for this issue. 

 

Workaround for previous versions:

• Do not enable Windows 11 Smart App Control prior to installing Symantec Endpoint Protection. Smart App Control can be enabled post-installation. 

Mitigation: 

• If Smart App Control was enabled prior to installation of Symantec Endpoint Protection, the system can be recovered via Windows Safe Mode.
  • Restart Windows into Safe Mode
  • Disable Sysplant.sys via the registry: 
    • Navigate to: HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Sysplant
    • Set the "Start" DWORD value to "4"
  • Restart Windows

Additional Information

CRE-15006