SEP 12.1.5 disabling internet based on "traffic has been blocked from this host svchost.exe"

We use Symantec Endpoint Protection in an unmanaged scenario in our small network.  In certain cases, some staff get their internet access disabled when SEP says "traffic has been blocked from this: svchost.exe"

The quick fix:

In SEP

1. clicking on Options next to Network Threat Protection

2. Click "Configure Firewall rules"

3. Find "Block UPnP Discovery" and change it from BLOCK to ALLOW

Symantec Endpoint Protection eating up disk space

On two of my servers, I found Symantec Endpoint Protection eating up disk space like crazy. In each case, they had many, many temp folders that amounted to many gigs of data in this folder:

C:\Program Files\Common Files\Symantec Shared\SymcData\sesmvirdef64

There doesn't seem to be any harm in deleting them. Very strange - very lame.

Symantec Endpoint Protection LiveUpdate fails

I had an unmanaged SEP install that failed to update itself - even after I uninstalled and resintalled.

Turned out the answer was to update from LiveUpdate 3.3 to LiveUpdate 3.5 via this link:

ftp://ftp.symantec.com/public/english_us_canada/liveupdate/3.5/lusetup.exe

SBS 2003 licenses disappear after reboot

A couple times, I have seen SBS 2003 licenses disappear after a reboot. You're only left with the original 5 licenses. The consensus seems to be that antivirus scanning the licensing files is the cause. However, in this case, the license files were already immune from scanning. Anyway, here is a way to fix this issue:

1. Look for licstr.cpa & Autolicstr.cpa files under c:\windows\system32 folder.

2. Exclude these two files from being scanned by Anti Virus.

3. Make a backup copy of both the files on a different folder.

4. Delete licstr.cpa from c:\windows\system32 folder.

5. Rename autolicstr.cpa file to licstr.cpa.

6. Restart the Licensing Service.

7. Goto Server Management Console -> Licensing & you will have the actual no. of CALS.

SEP problems on SBS 2003

An associate recommended that I use Symantec Endpoint Protection on by SBS 2003 box as local file anti-virus.  I have done this successfully on a couple servers.  On one particular network, I have an Windows Server 2003 R2 box that hosts the Management Console, and I tried installing the SEP on the SBS box.  I first tried it using the unmanaged version of SEP on the SBS box.  The SBS box froze every time I rebooted it, and I had to cold boot it.  I figured it was that it was the unmanaged part that was the problem.  So today I tried to install it using the managed version.  Same problem.  And unfortunately, I didn't document how I uninstalled SEP.

The server freezes during a standard boot, so that doesn't work.  You can't uninstall it in safe mode (you can get to safe mode via F8 during the bootup process just like any regular Windows machine) becuase the installer service isn't running.

In essence, I went into safe mode, went into msconfig and went into the service tab and removed the Symantec options and rebooted.  Then you can go in regular mode and uninstall SEP.  I presume that will work - what I actually did was go into safe mode and go to msconfig and go into diagnostic startup and then enable all Microsoft services.  This sounds easy and logical, but took several hours of troubleshooting.