SepMasterService not starting / crashing post upgrade to SEP 14.3 RU9

Products

• Endpoint Protection

Issue/Introduction

You experience one of the following issues on a client running Symantec Endpoint Protection (SEP) 14.3 RU9 and later.

• The Sep client Service (SepMasterService) cannot be started or stops quickly after it starts.
• The client GUI cannot be opened.
• The SepMasterService process ccSvcHst.exe crash with following error:

Date Log Event Type Source Computer User Event ID Description Details
4/30/2025 12:12:17 PM Application Error Application Error DESKTOP 1000 "Faulting application name: ccSvcHst.exe, version: 17.3.4.32, time stamp: 0x648752fb
Faulting module name: ucrtbase.dll, version: 10.0.19041.3636, time stamp: 0x81cf5d89
Exception code: 0xc0000409
Fault offset: 0x0000000000071208
Faulting process ID: 0x3fc
Faulting application start time: 0x01dbb9b85623f940
Faulting application path: C:\Program Files\Symantec\Symantec Endpoint Protection\14.3.11216.9000.105\Bin64\ccSvcHst.exe
Faulting module path: C:\Windows\System32\ucrtbase.dll
Report Id: 35bd3001-8f81-4e92-bc7a-451c0287d28f
Faulting package full name:
Faulting package-relative application ID:"

Environment

Symantec Endpoint Protection 14.3 RU9 and later.

Windows Servers and desktops

Cause

The issue occurs if you configured an incorrect Application control exception, and the string length was close to 260, so after replacing "Program Files" with "Program Files (x86)", it crashed.

References:

Folder Exception

How to create an Application Control exception or stop sysfer.dll injection into a process with Endpoint Protection

Resolution

Fix the Application Control exception policy with the wrong exception.

Engineering will fix in next client release the parsing check so we will ignore the crash.