SepMasterService not starting / crashing post upgrade to SEP 14.3 RU9

Products

• Endpoint Protection

Issue/Introduction

You experience one of the following issues on a client running Symantec Endpoint Protection (SEP) 14.3 RU9 and later.

• The Sep client Service (SepMasterService) cannot be started or stops quickly after it starts.
• The client GUI cannot be opened.
• The SepMasterService process ccSvcHst.exe crash with following error:

Date Log Event Type Source Computer User Event ID Description Details
4/30/2025 12:12:17 PM Application Error Application Error DESKTOP 1000 "Faulting application name: ccSvcHst.exe, version: 17.3.4.32, time stamp: 0x648752fb
Faulting module name: ucrtbase.dll, version: 10.0.19041.3636, time stamp: 0x81cf5d89
Exception code: 0xc0000409
Fault offset: 0x0000000000071208
Faulting process ID: 0x3fc
Faulting application start time: 0x01dbb9b85623f940
Faulting application path: C:\Program Files\Symantec\Symantec Endpoint Protection\14.3.11216.9000.105\Bin64\ccSvcHst.exe
Faulting module path: C:\Windows\System32\ucrtbase.dll
Report Id: 35bd3001-8f81-4e92-bc7a-451c0287d28f
Faulting package full name:
Faulting package-relative application ID:"

Environment

• Symantec Endpoint Protection 14.3 RU9 and later.
• Windows Servers and desktops

Cause

The issue occurs if you configured an incorrect Application control exception, and the string length was close to 260, so after replacing "Program Files" with "Program Files (x86)", it crashed.

References:

Folder Exception

How to create an Application Control exception or stop sysfer.dll injection into a process with Endpoint Protection

Resolution

This issue is fixed in Symantec Endpoint Protection 14.4.  For information on how to obtain the latest build of Symantec Endpoint Protection, see Download Symantec Enterprise Security software, tools, and patches.

Work Around:

Fix the Application Control exception policy with the wrong exception.

Additional Information

CRE-21284