Client package export fails in SEPM 14.4 Web Console when using file fingerprint lists
search cancel

Client package export fails in SEPM 14.4 Web Console when using file fingerprint lists

book

Article ID: 449361

calendar_today

Updated On:

Products

Endpoint Protection

Issue/Introduction

When attempting to export a client installation package from the Web Console in Symantec Endpoint Protection Manager (SEPM) 14.4, the export may fail. This issue occurs under specific conditions involving policy configurations and group name lengths.

 

  • The package export process fails, producing an error relating to the generation of the "allow list".

  • A File Fingerprint List (e.g., used by System Lockdown or EDR) is attached to the target group's policy.

  • The target group name (located directly under "My Company") is longer than 9 characters.

  • The issue does not occur when exporting from the traditional Java-based SEPM console.

  • The issue does not occur if the File Fingerprint list is removed prior to export.

 

Environment

 

  • Symantec Endpoint Protection Manager (SEPM) 14.4

  • SEPM Web Console (Webswing)

 

Cause

When a File Fingerprint List is attached to a policy, the SEPM Web Console utilizes a deeply nested temporary directory structure via Tomcat and Webswing to compile the package. The working path resembles the following:

C:\Program Files (x86)\Symantec\Symantec Endpoint Protection Manager\tomcat\instances\sepm-api\webswing\tmp\jdk-temp\0\<Group_Name>_WIN64BIT\Symantec Endpoint Protection version 14.4.X - English\protection<GUID>.dat.tmp

Because of the length of the default installation path, temporary webswing folders, and the generated GUIDs, the total string length leaves only ~9 characters available for the group name leaf. If the group name exceeds this, the underlying compilation tool (encrypt.exe) hits the Windows 260-character Maximum Path Length limitation (MAX_PATH), causing the package generation to fail.

Resolution

Broadcom Engineering is aware of this issue and is currently investigating a permanent solution. This document will be updated once a fix is available in a future release.

In the meantime, please utilize one of the following workarounds to successfully export client packages:

Workaround 1: Use the Java Console (Recommended) Export the installation package using the traditional Java-based SEPM console. The Java console utilizes the user-selected destination path as its working directory rather than the deep Webswing temporary folder, reliably bypassing the 260-character path limitation.

Workaround 2: Shorten the Group Name Rename the target group in the SEPM hierarchy to contain 9 characters or fewer before attempting the export from the Web Console.

Workaround 3: Temporarily Remove the File Fingerprint List If the File Fingerprint List is not strictly required for the immediate deployment package, temporarily remove the list from the group's policy, export the package, and reassign the list afterward.

Workaround 4: 

  • Open the file sepm\tomcat\instances\sepm-api\webswing\webswing.config to a text editor.
  • Look for the string "java.io.tmpdir". The file should only contains one in the line to configure "vmArgs".
  • Replace the "java.io.tmpdir" to the following. It will point to the folder "sepm\Temp", the folder that is parallel to the folder of "sepm\tomcat".
  • Restart the SEPM new server.
-Djava.io.tmpdir=\"${webswing.rootDir}/../../../../Temp\"

(Note: Modifying environment variables or creating Windows junction points to artificially shorten the SEPM installation root path is not supported and may result in unintended environmental conflicts.)

Powered by Wolken Software