Endpoint Protection

Hi All,

 

Windows 7 O.S. I need to clear the HardwareID inside the registry for SEP 11. I am using the following script:

@echo on
start smc -stop
reg import "HardwareID.reg"
Del "c:\program files\Common Files\Symantec Shared\HWID\sephwid.xml"
start smc -start

The script appears to execute correctly up to when it attempts to run smc -start. The gold shield with the green dot may appear, but usually it can be upwards of 10 minutes before it will do so. In most cases it does not appear at all. If I check inside the registry I do see that the value for HardwareID has been cleared. If I manually run smc -start it will load.

Any ideas as to what could be going on with this relatively small and simple script?

@echo off
rem // Stop the agent
c:
cd /Program Files\Symantec\Symantec Endpoint Protection
smc -stop -p password

@set INSTALL_CLIENT="c:\Program files\Symantec\Symantec Endpoint Protection"

cd %INSTALL_CLIENT% && smc -stop -p password

@echo Agent is stopping

@echo off

@echo Set HardwareID blank.

@echo off
Reg Add "HKLM\SOFTWARE\Symantec\Symantec Endpoint Protection\SMC\SYLINK\SyLink" /V HardwareID /T REG_SZ /D "" /F

C:
cd C:\Program Files\Common Files\Symantec Shared\HWID\
rename sephwid.xml sephwid_OLD.xml

@echo off

rem // Restart the Agent. It may not be necessary to change the directory (cd) unless you've switched to a mapped drive. Rem "Change Directory" is included for the example.

@echo off
C:
@set INSTALL_CLIENT="c:\Program files\Symantec\Symantec Endpoint Protection"

@echo off
net start SmcService
net start SmcService
net start SmcService

@echo SMC Hardware ID successfully Changed
@echo SMC is now start
 

Please use the script shared by Shivkumar its working in my enironment

Regards

Hi,

I changed the following lines:

start smc -stop

start smc -stop

They are now:

start /wait smc -stop

start /wait smc -start

My script works fine when run with the /wait switch. Only other issue is I can not get them to run in our Altiris 7.0 system.

I will play around with your script and see if that works. I do have one question. Why are you running net start SmcService three times??

Thanks.

He's running NET START 3 times for the same reason that you are posting this question & why I'm replying. Sometimes, SEP just does not seem to start & you have to retry multiple times until the yellow shield appears in the system Tray.

As to why your script does not want to run, remember that SMC.EXE is not in your PATH, thus your DOS prompt for the script doesn't know where to start SMC.EXE from. It works from the Start -> Run... box because it is registered as a known ammplication in this Registry key:

 HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths\Smc.exe

If you've upgraded from SAV 10, this will point to C:\Program Files\Symantec Antivirus, for a new install, this will point to C:\Program Files\Symantec\Symantec Endpoint Protection.

Have you looked at using SC.EXE instead of NET.EXE START? SC.EXE is a replacement for NET.EXE & has more smarts. You can configure Services & verify the status with SC.EXE query [ServiceName]. You'll see a state of STARTING or RUNNING or STOPPED. You could use that in your script to ensure the SEP services are running again.

I thought using 'start /wait' fixed my issues when running this script inside and outside of NS 7. The issue is more with getting SMC loaded at the end of the script. I tried stopping and starting SMC using SC and have not been able to get it to work. Should I be looking at shutting down other Symantec Endpoint Protection related services? Can you tell me how your stopping the services?

If the START /wait resolves the issue for you, then great.

NET START will issue the command and wait for the service to start.

SC START SmcService will issue the start command for the service, display a state of START PENDING and exit.This means SC finishes a lot sooner & you don't know yet if the service has completed its start up.

SC start SmcService    # Same as SMC.exe -start
SC query SmcService    # Confirm is service is running or not.
SC stop SmcService     # Shutdown the service

Very useful script as we have a bunch of Windows 7 x64 machines that we need to run this on.

However, when I push the script out to the collection of machines using SCCM the registry value is getting changed in the Wow6432Node. The script says

Reg Add "HKLM\SOFTWARE\Symantec\Symantec Endpoint Protection\SMC\SYLINK\SyLink" /V HardwareID /T REG_SZ /D "" /F

but the reg key getting changed is actually

HKLM\SOFTWARE\Wow6432Node\Symantec\Symantec Endpoint Protection\SMC\SYLINK\SyLink\HardwareID

If I run the script manually on the machine it works fine, appears there maybe some sort of 64 bit file re-direction taking place.

Any ideas?

hi ,

you can check this download.

https://www-secure.symantec.com/connect/downloads/script-convert-unmanaged-system-managed-system