Roger's Information Security Blog

SEP11 MR4 release notes have been posted here.
I suspect this is now available on the platinum site. I’ve been told by our sales guy that we should have access to that, but all I can ever get to is fileconnect. Rumor is January 6th for Fileconnect. I’m more interested in the msp update files than the full CD for a full SEPM install. I dont see those on the KB or via FTP right now.
Here’s one fix that I’m waiting for.

Wireless connections at 104Mb/second do not register with Location Awareness as Wireless connections.
Fix ID: 1441489
Symptom: Auto Location Awareness does not work when using 104Mbps wireless network.
Solution: Added 130Mbps/117Mbps to the list that detects when the wireless speed is not stable.

That information would have been helpful to me last week. I wasted quite a bit of time troubleshooting a users problems with 802.11N.
I think I have more issues with smc.exe than rtvscan.exe. However every lowered amount of CPU helps.
Constant 5% Rtvscan CPU usage.
Fix ID: 1389006
Symptom: Constant 5% Rtvscan CPU usage seen from Process Explorer or Task Manager.
Solution: Changed to cache the state of Auto-Protect ,thus reducing excessive calls which gather state information. The state is now updated once on startup, on change notification from Auto-Protect, and occasionally on the main timer, eliminating this issue.

Symantec posted some performance numbers touting the improvement of SEP11 M3 over MR2 and even SAV 10.
The slides are posted here.

Occasionally when I try to open EFS encrypted text files on my Windows XP PC, the files are not decrypted and appear to be corrupt. If I reboot, I’m able to access the files again. These occurrences began when I installed Symantec Endpoint Protection 11 MR2.
A review of the Symantec Forums and Knowledgebase isn’t particularly helpful. MR4 is rumored to be coming out in December, maybe that will help. Fortunately the problem is rare. I haven’t had a user reported yet, though I’ve seen this a couple of times myself.

Since deploying Symantec Endpoint Protection (SEP) 11 MR2 MP1, I’ve been fielding complaints from the System Administrator that the virtual machines are running 20-30% higher in total CPU usage than before the upgrade. He that SMC.exe a SEP11 process is the culprit. SMC.exe is the process for administrative communication. So it seems odd that it would be constantly using so much CPU.
I first checked the Symantec Forums (forums.symantec.com) and found some people with the same problem but no solutions.
First I found an old problem. It seems that in the initial release when no user is logged in SMC.exe would average 50% of the CPU. Its my guess that this is only partially fixed. It looks to me like with MR2, when a user is logged in CPU usage for SMC.exe is 0-10% and with no user logged in it is 10-20%. The SA doesn’t agree with my assessment due to some spikes in SMC, but I think those spikes are explainable by definition downloads or spikes right after logging in.
People in the forums also suggested turning things off. The problem is most of those things are already off in my environment. I don’t believe in tamper protection. Proactive Threat Protection shouldn’t be installed on servers either. I did turn off location awareness which I wasn’t using anyway, and the application monitoring. I also changed the communications from push to pull and from every 5 minutes to every 60 minutes.
Nothing I changed helped. I even tried upgrading a server to MR3 to see if that would help.
Having done all I could I opened a case with Symantec. At this point, the case has been open over a week. I’ve gathered logs for them, but there hasn’t been a resolution yet.