High CPU on Domain Controllers - Symantec Endpoint Protection

Products

• Endpoint Security Complete
• Endpoint Protection

Issue/Introduction

• SEP client already installed on a server before it's fully promoted to a Domain Controller
• Following the Domain Controller promotion, CPU spikes with Symantec Service Framework and ccSvcHst.exe are reaching 90 - 100%. This is observed for several minutes (5-20 minutes), during user login to the Domain Controller. 

 

Environment

SEP client versions: 14.3x

Windows Server OS: Windows Server 2019 Standard Edition 

Cause

• Symantec client was already installed on the server(s) before the server was promoted to a Domain controller.
• Upgrade to the legacy SEP client doesn't apply the DC exclusions added during an install\upgrade as the legacy SEP client is still present.

Resolution

• Uninstall the existing SEP client on the primary Domain Controller (DC) server and reboot prior to the upgraded SEP client install.

OR

• To completely remove all traces of the existing SEP client and start with a fresh install of the SEP client on the DC, run a full Cleanwipe on the device, reboot and install the upgraded SEP client.
  • Download and Run CleanWipe To Uninstall Symantec and Carbon Black Products