Endpoint Protection

I am creating a new thread on this topic as all my research has not uncovered a solution.

We only have one server for our entire company, its running Windows Server 2008 R2.

Firstly, I have deployed SEP Manager to this server. 

I then successfully deployed SEP Client using GPO to all our client computers which all run windows 7 pro 32bit.  No problems with this.

I have now tried deploying SEP Client to the server itself as although it is running SEP Manager I believe it still needs the client installed.

After deployment I get the Firewall is Malfunctioning error and hovering the mouse over the client icon yields the message Firewall Driver is not Loaded.

I have tried stoping and starting SMC then turning debugging off and stopping and starting SMC.

Still the problem exists.  Thanks in advance.

The solution in this thread was to disable the Windows firewall and run a repair installation of SEP.

Have a look at this thread as well:

https://www-secure.symantec.com/connect/forums/sep-121-firewall-malfunctioning-firewall-driver-not-loaded

HTH!

Hi greg12,

Thanks for the repsonse, I have read both those threads thoroughly, tried each solution and neither has helped.

I really thought disabling the firewall and a repair was the solution but it simply didnt work.

Thanks.

Hi,

Check this one..similar

https://www-secure.symantec.com/connect/forums/firewall-malfunctioning-error

Thanks, but I have also seen that thread and the solution did not help me.

Remove the  Network Threat Protection (NTP) component, then reboot the machine and install it again.

Is the version on the machine 12.1 or 12.1 RU1, If it's 12.1, would ask you to upgrade to RU1

Look for teefer driver in Device manager > View > show hidden devices > Network Adapters if it's not there then it would be best to re-install.

Norton Installer?? Or Symantec Endpoint??

Do not remove SEPM, but remove just the SEP client. You can try the process of manual removal.

It seems that the teefer driver was not installed properly, which is why the Firewall is malfunctioning.

Some stpes that you could try (At your own risk! ) 

1)Uninstall NIC drivers. 
2)Uninstall SEP.
3)Install NIC drivers. 
4)Reinstall SEP.

Thanks for the reply.  I tried removing the NTP component however the symantec installer failed and rolled back, it would not remove it.

Version is 12.1 RU1

There is no teefer driver listed.

This is the second time I have tried deploying to the server through GPO so im not sure a reinstall will work.  

Or are you suggesting I uninstall SEP Manager as well (this will mean removing SEP from all the clients) and do a cleanwipe?

Sorry - I meant symantec, not norton.  Our system has nothing to do with any norton products.

Thanks, could you point me to the correct webpage instructions for manual removal of SEP 12.1 from windows server 2008R2.

Unfortunately removing the SEP client and reinstalling did not work.  Neither did uninstalling the NIC drivers.

I found this thread which has my exact symptoms, however I have internet explorer 8 installed so my problem is different.

Manual uninstall documents for Symantec Endpoint Protection
http://www.symantec.com/docs/TECH96924

Thanks.  I have uninstalled both SEP and SEPM manually.  I have also run cleanwipe.

I tried simply to install an unmanaged client on the server and the install did not complete.  I noticed the installteefer.exe is running in the background but never completes, I left it running all night.  Finally in the morning I rebooted the server and once again the "Firewall driver is not loaded" error comes up.

Anymore ideas?

Use cleanwipe tool to remove SEP client then after restart Install SEP again.

Thanks, if you read my last post thats what I have just done.

I am still struggling with this, is anyone able to offer me further assitance?

It would be greatly appreciated.

i would suggest you to open a support case as well to troubleshoot the issue, as they will check the few other logs and analyze the problem.

I had the similar problem 2 weeks ago, but with following conditions:

1. The malfunction product was SEP SBE 12.1, not SEP 12.1 (sometimes called SEP EE)

2. Just before installing SEP SBE, I removed SEP EE 12.1 RU1 client which was there for testing purposes.

Standard uninstall/install didn't help. To check if your case is the same as mine look for the following key in the registry: HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\Teefer3 

If you found it, then solution is:

1. Uninstall SEP (I think your can leave SEPM at place)

2. Remove mentioned key from registry, Reboot

3. Remove file teefer.sys from %systemroot%\system32\drivers directory.

4. Install SEP.

I believe that last version of SEP EE install new version of firewall driver (teefer3). But all utils (e.g. cleanwipe) and manual uninstal procedures doesn't count on this yet.

Agree with Pete.. have a support case opened to get further assistance.

Thanks, I will open a support case.  

@dias, the key you mentioned did not exist in our registry.

Hi Reafidy,

I am having the same problem as you are having with the "Firewall driver is not loaded".  It happen only with unmanaged clients.  As you, I have tried all the suggestions above with no avail.

I too are looking to open a support case.  If you have identify the root cause with a solution, please share your finding.  I will do the same.

Thank you in advance.

I have also stumbled into this error on a clean install of unmanaged SEP 12.1 RU1 EE on a freshly built Window's 7 x64.

I have no idea why.  This is the second of these particular machine builds and the first one went perfectly.  Any definitive solution would certaily be appreciated.

Enable the hidden administrator account and then install using that enabled hidden admin account.

Thanks @theexplorer.  Unfortunately I was using the builtin administrator account for the install.  

Could the problem be that I am installing on a domain controller?

I am still waiting for our DVD to turn up so I can start an official support case with symantec.

Hi,

I had a similar Problem on a couple of Computers.

On some it was fixed with the latest Version 12.1 RU1 MP1 (12.1.1101.401).

But I still had a computer where I could not install it. I opened up a support case and the helped me with the following solution:

To resolve this problem, adjust the value of the HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Network\ registry subkey.

1. Click Start , click Run , type regedit , and then click OK .

2. Locate and then click the following registry subkey:

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Network\

3. In the right pane, right-click MaxNumFilters, and then click Modify.

4. Change the value to “14”, and click to select the Decimal option, and then click OK.

Note: Default value is 8, 14 is the maximum

5. Close the Registry Editor.

Then I uninstalled SEP => restart => install SEP => restart and now everything works fine