Computers on Subnet have dropped off one by one, HELP!??!!

[MissBraveheart]

Hi folks,

My problem is that we have been using CA Etrust 7.1 and everything was fine untill recently. Our computers on our subnet in Etrust admin view have dropped off one by one and discoveries don't pick them up. The only one left on our subnet is our redistribution server. I have noticed that when i edit the settings of the subnet that we have a conflicting admin server ip address, but this is greyed out and can't be modified....i have tried everything with no luck. Starting to think that it might have something to do with ISA but why would it start to affect Etrust all of a sudden??!! Ripping our hair out here trying to resolve this. Also don't know if this is relevant but the computers seemed to have dropped off since they were updated and lost the InoculateIT signature version.
Please please please help!!!!!!!!!!!!!!!!!!!!any help at all would be much appreciated!!

 

[cmeagan656]

If you're running the Windows firewall on XP machines check that you still have an exception in it for the eTrust antivirus RPC server, local scanner, and realtime monitor.

Are there any events showing in you admin server's eTrust event log?

We have machines drop off occaisionally and have found that most of the time it happens when the XP machine loses its firewall exemptions for the RPC server. When this happens you should see a critical event in the admin server's eTrust event log saying something to the effect that "computername is responding but RPC service is not". If the exemptions are still there then try a hard boot (not a restart) of the computer.

Our drops usually - but not always - happen after M$ patches (which this month corresponded with the eTrust dropping of the signature version). Its never the same machines each month and I haven't been able to figure out a pattern.

Hope this helps.

Cheers.

 

[MissBraveheart]

Thanks for your reply, much appreciated!!!
Our admin server doesn't have Windows Firewall enabled, we use ISA....no recent changes have been made. We still can't see our computers on our subnet....checked the logs and i can't see anything. It seems to have happened since we had to power down our server, as we were adding a new backup tape drive.....Banging my head against a brick wall on this one ....we are even thinking about getting the newer current version of ETrust Antivirus so it will solve our problem....this will be costly though...All the computers on our network are getting the signature distributions from the admin server and are all up to date...been seraching the Internet for an answer for a few weeks now and i'm still no nearer the answer.....Help!!!!!!?????!!!!!

 

[cmeagan656]

Its not the admin server that server that's the problem, its the XP Windows Firewall on the desktops.

The error only shows ONCE in the admin server log, at the time of the 1st missed discovery if its caused by an RPC server issue.

If your updates are happening on the desktops but discovery is not then that definitely sounds like something is blocking the RPC server from communicating with the desktops. Are you sure that either your XP Windows Firewall isn't enabled or, if it is, you have the appropriate exemptions for the eTrust RPC server?

Cheers.

 

[cmeagan656]

We've powered down our server for various reasons a few times and its never been an issue. Since the discoveries are initiated by the admin server so if the server is powered down there is no discovery failure, it just doesn't happen.

Cheers.

 

[MissBraveheart]

Hi there, we have Windows Firewall disabled on all our desktop pc's. Our firewall is all done through ISA. Recently we had to turn the server off again and i have now noticed that 17 out of 55(approx) computers have appeared back on the subnet although our distribution server is not showing and we had a ".....computername is responding but RPC service is not" for the redistribution server. All our desktops are still receiving their signature updates from the redistibution server though?!?! If i try to find any of the computers not showing, it doesn't find them. Discoveries don't find them either.......The 17 computers showing on our subnet are the same 17 every day and some of them aren't even switched on......

 

[cmeagan656]

If they're not turned on then they'll drop after a set amount of missed discoveries. The default is 10. Ditto for any that are switched on but are having the RPC server blocked.

Have you checked the problem clients and servers and made sure that the eTrust Antivirus RPC Server is showing as started on each machine? The service should show started and be set to automatic.

Something, somewhere is blocking the RPC server. What ports are you blocking? Here is a list of the ports that Inoculate IT uses:

http://supportconnect.ca.com/sc/kb/...&docid=293583&bypass=yes&fromscreen=kbresults

Cheers.