SCCM jobs return 183 error on random files with Endpoint Protection installed

Products

• Endpoint Protection

Issue/Introduction

With Symantec Endpoint Protection (SEP) installed and AutoProtect enabled, random SCCM jobs may produce error code 183 messages on various files. Repeat runs of the same job may produce error messages on other files altogether. 

Cause

Wmiprvse.exe is interacting with files that are part of the job and, during that interaction, one of the driver components of SEP interacts with them as well. This causes a situation where the file is unable to be deleted or renamed because it's open, but the SCCM job is trying to rename it and this produces the error message. 

Resolution

Create a SONAR exception for wmiprvse.exe. 

Note that this exception will take effect when the wmiprvse.exe processes are restarted or when the SEP client is restarted. Both would be accomplished by rebooting the device.