Symantec DLP Which files are indexed?

If you wonder about which files are indexed in Symantec DLP follow the steps below;

1) Open ManagerLogging.properties
2) Change ServletLogHandler.level to FINEST
3) Add com.vontu.cracker.DocumentCracker.level = FINEST
4) Re-run the indexer
The tomcat log should have an entry for each file after it's processed by the content extractor but before it's added to the index.
Read more...

Symantec DLP - EndPoint Incidents Active Directory Attributes Lookup Problem

If you are using Symantec DLP v10.0 and if you have problem about getting Active Directory attributes from endpoint incidents try the steps below;

• Verify Active Directory Connection by using method that described in Symantec Data Loss Prevention Administration Guide.


• Check the log. You will have a log like that below;

if you have Exception: krb_error 14 KDC has no support for encryption type (14) KDC has no s upport for encryption type line

Possible solution is the check "USe DES Encryption types for this account" from user properties in the releated user.

and the AD attiributes will come in the next endpoint incidents.

AD Connection Test

C:\Vontu\jre\bin>kinit
Password for dlpx@xxxx.LOCAL:
Exception: krb_error 14 KDC has no support for encryption type (14) KDC has no s upport for encryption type
KrbException: KDC has no support for encryption type (14)
at sun.security.krb5.KrbAsRep.(Unknown Source)
at sun.security.krb5.KrbAsReq.getReply(Unknown Source)
at sun.security.krb5.KrbAsReq.getReply(Unknown Source)
at sun.security.krb5.internal.tools.Kinit.sendASRequest(Unknown Source)
at sun.security.krb5.internal.tools.Kinit.(Unknown Source)
at sun.security.krb5.internal.tools.Kinit.main(Unknown Source) Caused by: KrbException: Identifier doesn't match expected value (906)
at sun.security.krb5.internal.KDCRep.init(Unknown Source)
at sun.security.krb5.internal.ASRep.init(Unknown Source)
at sun.security.krb5.internal.ASRep.(Unknown Source)
... 6 more


Read more...

These settings are not available in preference mode

If you get this warning on Windows Server 2008 , while changing internet explorer Group Policy settings try the step below;

Click Reset Browser Setting in Group Policy, Under User Configuration

Read more...

The Java Virtual Machine has exited with a code of -1, the service is being stopped.

Event Type: Error
Event Source: semsrv
Event Category: None
Event ID: 4096
Date: 5/13/2010
Time: 6:37:09 PM
User: N/A
Computer: TNSEP
Description:
The Java Virtual Machine has exited with a code of -1, the service is being stopped.
If you are getting this error on Symantec Endpoint Protection Manager and can not open the SEPM console follow the steps below;

Be sure that IUSR_XXXX user are not in the Guest Group, if it is than remove it from there and add to the Local Users group.

Secondly, Open the IIS Manager

Right Click to Symantec Web Server Web Page , Click Properties




On the Web Site TAB, check if your SEP Server IP Adress is correct. Click Apply and OK.
Then, start Symantec Endpoint Protection Manager service and Open and Login to the Console.
Read more...

Symantec Endpoint Protection Manager - Clear Still Infected

--> Open Monitors-->Log-->Log Type(Computer Status) Advance Settings --> Compliance Options
Tick "Infected only" and then Click View log

Select the computers by using (Ctrl or Shift+Click) and click Clear infected status.

Open Home Page and Click Refresh
Read more...

Disable StartTLS on Exchange 2007

If you want to Disable StartTLS on Edge Transport you should apply these command below on Hub Transport server.

Firstly, get all your connector list by using the command below;

Get-SendConnector (On edge transport)


To disable "TLS" enter the following command (On hub transport)

Set-SendConnector -Identity "send Connector full name" -IgnoreSTARTTLS $true

To check if your changes apply succesfully, enter the following commands on Edge transport server

Get-SendConnector "Send Connector Full Name"fl IgnoreSTARTTLS



If answer is false ; Enter the following commands below,


Test-EdgeSynchronization (Check synchronization)

Start-EdgeSynchronization (Start Synchronization Immediately)
Read more...

Failed to find updates with error code 80244010

If you are getting this error in windowsupdate.log file while you are trying to deploy updates using wsus 3 sp1 ;

try the steps below;

Method 1: Download and install the Windows Update Agent
For more information about how to download the latest version of Windows Update Agent, click the following article number to view the article in the Microsoft Knowledge Base:
949104 (http://support.microsoft.com/kb/949104/ ) How to obtain the latest version of the Windows Update Agent to help manage updates on a computer

Method 2: Register the Wups2.dll file
To register the Wups2.dll file in Windows, follow these steps:
Stop the Automatic Updates service. To do this, follow these steps:
Open the Command Prompt window. To do this, click Start, click Run, type cmd, and then click OK.
At the command prompt, type the following command, and then press ENTER:
net stop wuauserv
Register the Wups2.dll file. To do this, follow these steps:
At the command prompt, type the following command, and then press ENTER:
regsvr32 %windir%\system32\wups2.dll


Note For a computer that is running Windows XP Professional x64 Edition, type the following command, and then press ENTER:
regsvr32 %windir%\syswow64\wups2.dll
Click OK if you receive a verification message.
Start the Automatic Updates service. To do this, type the following command at the command prompt, and then press ENTER:
net start wuauserv
Exit the Command Prompt window. To do this, type exit at the command prompt, and then press ENTER.


Source : http://support.microsoft.com/kb/943144
Read more...