Endpoint Protection

Hi,

We are using SEPM & SEP cleint 11.06 MP2 . We have have Mupliple GUPS setup. We are experincing issue network issue on GUP's . We have notices SMC.exe is uing lot of memorey, We are seeing on GUP server lot of other serves hang. Getting Error message RPC error or Domian unavilable. Once SMC -STOP and stat all serises back to normal .  We are having this only on where system is GUP.

Added following reg values but the issue still exist 

HKLM\System\CurrentControlSet\Services\Tcpip\Parameters
- DWORD MaxUserPort, with value 50000 (decimal)

- DWORD TcpTimedWaitDelay, with value 30 (decimal)

is any one have experance and what is the fix it

Thank you,

hi,

Lot of person are same problem regarding  smc.exe service slow the process.bot we can't stop this services.

https://www-secure.symantec.com/connect/forums/smcexe-and-smcguiexe-wall-pain

https://www-secure.symantec.com/connect/forums/sep-11-network-access-protection-smcexe

Adding the registry

HKLM\System\CurrentControlSet\Services\Tcpip\Parameters
- DWORD MaxUserPort, with value 50000 (decimal)

- DWORD TcpTimedWaitDelay, with value 30 (decimal)

would not help

Upgrade SEP and see if that helps.

Or Take a Proc Dump or AD Plus Dump for the process and PM me.

thank you, for the reply. 

We had this issue only where servers is acting as GUP.  Once we stop SMC and start . All servises back to normal.

thank you,

Could be  a memory leak with smc.exe , take  the dump and contact support

I would imagine they'll recommend upgrade to RU3 MP3 or higher...

some memory leaks issue were detected prior to these release

what OS your GUPs mainly are?

Hi,

90% GUPS OS Windows 2003 32Bit and 10 % Windows 2008 64Bit . We see Below errors and some diffrent erros. Current TEMP soultion is stop and start  SMC servises, everything back to normal.

Event Type:    Error
Event Source:    NETLOGON
Event Category:    None
Event ID:    5719
Date:        3/26/2012
Time:        10:36:42 AM
User:        N/A
Computer:    SERVER
Description:
This computer was not able to set up a secure session with a domain controller in domain AP due to the following:
Not enough storage is available to process this command.  
This may lead to authentication problems. Make sure that this computer is connected to the network. If the problem persists, please contact your domain administrator.  

Event Type:    Error
Event Source:    BROWSER
Event Category:    None
Event ID:    8032
Date:        3/26/2012
Time:        9:34:48 AM
User:        N/A
Computer:    SERVER
Description:
The browser service has failed to retrieve the backup list too many times on transport \Device\NetBT_Tcpip_{03E6A1CC-4D72-41D4-AC89-70D40067983D}. The backup browser is stopping.

Thank you,

To resolve this issue, increase the value of the IRPStackSize registry entry. To do this, follow these steps:

1. Click Start, click Run, type regedit, and then click OK.
2. Locate and then click the following registry subkey:
   HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\LanmanServer\Parameters
   If the IRPStackSize entry is not present in this subkey, follow these steps:
   1. Click Edit, point to New, and then click DWORD Value.
   2. Type IRPStackSize, and then press ENTER.
      
      NoteType IRPStackSizeexactly as it appears. The value name is case sensitive.
3. Click IRPStackSize, click Edit, and then click Modify.
4. In the Data Value box, type a larger value, and then click OK.
   
   Note Values may range from 0x1 to 0xC. These values are equivalent to 1 to 12 in decimal notation.

If the problem persists after you complete the previous procedure, increase the value of IRPStackSize more.

Thanks Prachand,

for provide this setting.