Tuesday, November 3, 2015

Symantec Endpoint Protection creating Multiple instances on Citrix and Terminal Servers

Welcome Back!!!
We had issue where on Citrix Servers for every user when he opens a Application a instance of Symantec would open eating up lot of Memory on the background, something like this below



Colleague of mine had similar issue and they worked with vendor Symantec Endpoint and they suggested a registry key settings to fix the issue.

Prevent the process from starting by changing the registry value:

1. Click Start, Run and type “regedit” then click OK
2. Browse to the SMC key. In version of SEP older than 12.1 RU5, this is the same
location on 32- or 64-bit systems:
HKLM\SOFTWARE\Symantec\Symantec Endpoint Protection\SMC

In SEP 12.1.5 (12.1 RU5) and newer on 64-bit systems, LaunchSmcGui and most
other SMC keys and values have moved to Wow6432Node:
HKLM\SOFTWARE\Wow6432Node\Symantec\Symantec Endpoint Protection\SMC

3. Find the entry LaunchSmcGui and change it from DWORD 1 to DWORD 0 (add it if it
is not already present)

If you are unable to modify the listed registry keys, you can temporarily disable Tamper
Protection.

More info check this vendor website link

Hope this helps someone!!!

1 comment: