Windows XP clients lose connection to shares on 2008 server

When the issue occurs for me, no one is using TS as I'm the only one with TS
access to my 2008 server. I can however TS in while no one is able to
access shares from their workstation.

"Tony P." <(E-Mail Removed)> wrote in message
news:00A8F278-5CBD-422D-AFCA-(E-Mail Removed)...
> Found this on Symantec's Website:
>
> Terminal servers run multiple instances of ProtectionUtilSurrogate.exe
> Fix ID: 1185648
> Symptoms: After installing Symantec Endpoint Protection 11.0 to a Terminal
> Server, a copy of ProtectionUtilSurrogate.exe is ran for each user that
> logs
> on.
> Solution: Symantec Endpoint Protection 11.0 now allows for a client to
> disable the extra components from loading in separate sessions.
>
> Now when you remote desktop into the server it's a terminal session. I
> noticed in my application logs on the SBS 2008 that
> "protectionutilsurrogate"
> was flagged as a faulting application. When I arrived on-site to look at
> the
> server the sep client had a yellow exclaimation point and said it was
> malfunctioning or corrupted. These events seem to line up with times that
> I've connected remotely to the server. I've removed the client and will
> report on what happens now.
>
> "Tony P." wrote:
>
>> This is funny... just setup SBS 2008 for a client. Same EXACT issue. I
>> have
>> SEP 11.0.4... will be taking off the client and see if it's the problem.
>>
>> "boe" wrote:
>>
>> > Thanks - I'm running Symantec MR3 - and still having this issue.
>> >
>> >
>> >
>> > "Sam Casperson" <(E-Mail Removed)> wrote in message
>> > news:(E-Mail Removed) node...
>> > > Hi Everyone
>> > >
>> > > I have just installed a new server 2008 computer in one of our
>> > > branches
>> > > that is experiencing this exact problem. Most of the workstations are
>> > > running terminal services and have no problem. But we have a few xp
>> > > laptops that just loose all connection to the server and will refuse
>> > > to
>> > > connect to any shares whatsoever.
>> > >
>> > > I found this while googleing the problem
>> > >
>> > > -- Experts Exchange -------
>> > > I am having the same issue. I have been able to keep the server up
>> > > and
>> > > running for as long as 6 days before having to reboot. I have a
>> > > Windows
>> > > Server 2008 SP1, SQL Server 2005, Symantec End Point Protection
>> > > 11.0.2020.56, Symantec Backup Exec 12.0 Rev 1364.
>> > >
>> > > Symantec End Point Protection is the culprit. I can only assume you
>> > > have
>> > > Symantec EndPoint Protection installed. If not, ignore my
>> > > information.
>> > >
>> > > Maintenance Release 3 is expected to be released by Symantec in mid
>> > > September. I've opened at least 3 cases with Symantec regarding this
>> > > issue. I spoke with a very knowledgeable rep and was told the SEP
>> > > mini
>> > > filter driver is trying to access oplocked data in memory. To
>> > > summarize,
>> > > SEP tries to scan files at the same time the user's antivirus is
>> > > scanning
>> > > and a lock is created. I may be off slightly, but you can get the
>> > > idea.
>> > >
>> > > Solution (Temporary until MR3 is released)
>> > > 1. Install only the SEP Core AntiVirus services on Server 2008.
>> > > 2. Uncheck Drive Scanning
>> > > 3. Add Centralized Exceptions to disable AutoProtect on all shares
>> > > on the
>> > > 2008 Server.
>> > > 4. Setup manual scans to run a few times throughout the day to run a
>> > > full
>> > > system scan.
>> > > 5. Sign up here
>> > > http://www.symantec.com/business/sup...tins/index.jsp to
>> > > be
>> > > notified immediately when SEP 11 MR3 is released in mid September.
>> > > 6. If possible reboot your server daily.
>> > > --------------------------------
>> > >
>> > > We do have Symantec Endpoint installed on this machine, and I will be
>> > > getting rid of it today to see if it makes a difference.
>> > >
>> > > Ill post the results here soon.
>> > >
>> > > Hope it helps.
>> > >
>> > > "boe" <(E-Mail Removed)> wrote in message
>> > > news:(E-Mail Removed)...
>> > >> That seems like a good idea - I'm somewhat limited as I'm usually
>> > >> remoting in to that office. Strangely I can remote to the server
>> > >> with
>> > >> no issue.
>> > >>
>> > >> "Danny Sanders" <(E-Mail Removed)> wrote in message
>> > >> news:#(E-Mail Removed)...
>> > >>> Well I'm not sure what is going on but it seems to be a problem
>> > >>> with
>> > >>> your server and not the clients. I would try restarting individual
>> > >>> services on the server the next time it happens to see if you can
>> > >>> at
>> > >>> least narrow it down to a particular service.
>> > >>>
>> > >>>
>> > >>> hth
>> > >>> DDS
>> > >>>
>> > >>> "boe" <(E-Mail Removed)> wrote in message
>> > >>> news:%(E-Mail Removed)...
>> > >>>> The server points to itself. No secondary - I could put in the
>> > >>>> loopback address but it doesn't usually change anything on 2003
>> > >>>> servers. The server can continue to browse the web and the PCs can
>> > >>>> at
>> > >>>> the time - the PCs can still ping the server by name at the time
>> > >>>> of the
>> > >>>> issue and they can renew their IP info at the time. The server
>> > >>>> has a
>> > >>>> static IP address.
>> > >>>>
>> > >>>> No error in the event view on the XP machines - other than
>> > >>>> eventually
>> > >>>> it can't find the group update ini - which coincides of course
>> > >>>> with it
>> > >>>> not being able to the sysvol or any other share.
>> > >>>>
>> > >>>>
>> > >>>> "Danny Sanders" <(E-Mail Removed)> wrote in message
>> > >>>> news:#(E-Mail Removed)...
>> > >>>>> What does the DNS server point to for Primary and alternate DNS?
>> > >>>>>
>> > >>>>> Is there any error in the event viewer of the XP machine when
>> > >>>>> this
>> > >>>>> happens?
>> > >>>>>
>> > >>>>>
>> > >>>>> hth
>> > >>>>> DDS
>> > >>>>>
>> > >>>>> "boe" <(E-Mail Removed)> wrote in message
>> > >>>>> news:(E-Mail Removed)...
>> > >>>>>> The primary DNS is the file server. It has no secondary DNS
>> > >>>>>> entry.
>> > >>>>>>
>> > >>>>>> The file server is the AD, DNS, DHCP and WINS server. The
>> > >>>>>> workstations are still able to browse the web and ping the file
>> > >>>>>> server by name when the issue occurs. If I renew the IP
>> > >>>>>> address of
>> > >>>>>> a workstation at the time of the issue, they are able to refresh
>> > >>>>>> their DHCP address but still not able to get to the shares on
>> > >>>>>> the
>> > >>>>>> server.
>> > >>>>>>
>> > >>>>>> "Danny Sanders" <(E-Mail Removed)> wrote in message
>> > >>>>>> news:(E-Mail Removed)...
>> > >>>>>>> What server do the clients point to for Primary and Secondary
>> > >>>>>>> DNS?
>> > >>>>>>>
>> > >>>>>>>
>> > >>>>>>> hth
>> > >>>>>>> DDS
>> > >>>>>>>
>> > >>>>>>> "boe" <(E-Mail Removed)> wrote in message
>> > >>>>>>> news:(E-Mail Removed)...
>> > >>>>>>>> Hello,
>> > >>>>>>>>
>> > >>>>>>>> We have a single server environment running Exchange 2008.
>> > >>>>>>>> All
>> > >>>>>>>> the clients are running XP. They'll login and the login
>> > >>>>>>>> script
>> > >>>>>>>> batch file assigns all the drive mappings. They'll work for
>> > >>>>>>>> a
>> > >>>>>>>> week or so and then suddenly no one can access their shared
>> > >>>>>>>> drives.
>> > >>>>>>>> They have a few drives mapped to different volumes and none of
>> > >>>>>>>> them
>> > >>>>>>>> are accessible. They can still ping the server by name or by
>> > >>>>>>>> IP
>> > >>>>>>>> and they get a response. However, they can't even manually map
>> > >>>>>>>> a
>> > >>>>>>>> drive to the shares - even the hidden shares and they can't
>> > >>>>>>>> get to
>> > >>>>>>>> the sysvol from the clients. It isn't happening at a regular
>> > >>>>>>>> frequency - but about 1 to 3 weeks or so it will happen. I
>> > >>>>>>>> can
>> > >>>>>>>> remote desktop to the server - no issue when this is
>> > >>>>>>>> happening.
>> > >>>>>>>> There is nothing in the event viewer at the time the issue
>> > >>>>>>>> occcurs.
>> > >>>>>>>> If I reboot the server everything returns to normal.
>> > >>>>>>>
>> > >>>>>>>
>> > >>>>>
>> > >>>>>
>> > >>>
>> > >>>
>> >

Which, when you do, is most likely loading another instance of that
executable. I've removed the sep client from the server and have had no
issues yet I also noticed that the sep client on the server was screwing
up group policy deployment to PC's too. I was also getting "could not
reconnect all network drives" upon login's and that has also disappeared
since removing the sep client on the server. There's def. something hookie
with the sep client on server 2008 regardless of which Maintenance release
you have.

"boe" wrote:

> When the issue occurs for me, no one is using TS as I'm the only one with TS
> access to my 2008 server. I can however TS in while no one is able to
> access shares from their workstation.
>
> "Tony P." <(E-Mail Removed)> wrote in message
> news:00A8F278-5CBD-422D-AFCA-(E-Mail Removed)...
> > Found this on Symantec's Website:
> >
> > Terminal servers run multiple instances of ProtectionUtilSurrogate.exe
> > Fix ID: 1185648
> > Symptoms: After installing Symantec Endpoint Protection 11.0 to a Terminal
> > Server, a copy of ProtectionUtilSurrogate.exe is ran for each user that
> > logs
> > on.
> > Solution: Symantec Endpoint Protection 11.0 now allows for a client to
> > disable the extra components from loading in separate sessions.
> >
> > Now when you remote desktop into the server it's a terminal session. I
> > noticed in my application logs on the SBS 2008 that
> > "protectionutilsurrogate"
> > was flagged as a faulting application. When I arrived on-site to look at
> > the
> > server the sep client had a yellow exclaimation point and said it was
> > malfunctioning or corrupted. These events seem to line up with times that
> > I've connected remotely to the server. I've removed the client and will
> > report on what happens now.
> >
> > "Tony P." wrote:
> >
> >> This is funny... just setup SBS 2008 for a client. Same EXACT issue. I
> >> have
> >> SEP 11.0.4... will be taking off the client and see if it's the problem.
> >>
> >> "boe" wrote:
> >>
> >> > Thanks - I'm running Symantec MR3 - and still having this issue.
> >> >
> >> >
> >> >
> >> > "Sam Casperson" <(E-Mail Removed)> wrote in message
> >> > news:(E-Mail Removed) node...
> >> > > Hi Everyone
> >> > >
> >> > > I have just installed a new server 2008 computer in one of our
> >> > > branches
> >> > > that is experiencing this exact problem. Most of the workstations are
> >> > > running terminal services and have no problem. But we have a few xp
> >> > > laptops that just loose all connection to the server and will refuse
> >> > > to
> >> > > connect to any shares whatsoever.
> >> > >
> >> > > I found this while googleing the problem
> >> > >
> >> > > -- Experts Exchange -------
> >> > > I am having the same issue. I have been able to keep the server up
> >> > > and
> >> > > running for as long as 6 days before having to reboot. I have a
> >> > > Windows
> >> > > Server 2008 SP1, SQL Server 2005, Symantec End Point Protection
> >> > > 11.0.2020.56, Symantec Backup Exec 12.0 Rev 1364.
> >> > >
> >> > > Symantec End Point Protection is the culprit. I can only assume you
> >> > > have
> >> > > Symantec EndPoint Protection installed. If not, ignore my
> >> > > information.
> >> > >
> >> > > Maintenance Release 3 is expected to be released by Symantec in mid
> >> > > September. I've opened at least 3 cases with Symantec regarding this
> >> > > issue. I spoke with a very knowledgeable rep and was told the SEP
> >> > > mini
> >> > > filter driver is trying to access oplocked data in memory. To
> >> > > summarize,
> >> > > SEP tries to scan files at the same time the user's antivirus is
> >> > > scanning
> >> > > and a lock is created. I may be off slightly, but you can get the
> >> > > idea.
> >> > >
> >> > > Solution (Temporary until MR3 is released)
> >> > > 1. Install only the SEP Core AntiVirus services on Server 2008.
> >> > > 2. Uncheck Drive Scanning
> >> > > 3. Add Centralized Exceptions to disable AutoProtect on all shares
> >> > > on the
> >> > > 2008 Server.
> >> > > 4. Setup manual scans to run a few times throughout the day to run a
> >> > > full
> >> > > system scan.
> >> > > 5. Sign up here
> >> > > http://www.symantec.com/business/sup...tins/index.jsp to
> >> > > be
> >> > > notified immediately when SEP 11 MR3 is released in mid September.
> >> > > 6. If possible reboot your server daily.
> >> > > --------------------------------
> >> > >
> >> > > We do have Symantec Endpoint installed on this machine, and I will be
> >> > > getting rid of it today to see if it makes a difference.
> >> > >
> >> > > Ill post the results here soon.
> >> > >
> >> > > Hope it helps.
> >> > >
> >> > > "boe" <(E-Mail Removed)> wrote in message
> >> > > news:(E-Mail Removed)...
> >> > >> That seems like a good idea - I'm somewhat limited as I'm usually
> >> > >> remoting in to that office. Strangely I can remote to the server
> >> > >> with
> >> > >> no issue.
> >> > >>
> >> > >> "Danny Sanders" <(E-Mail Removed)> wrote in message
> >> > >> news:#(E-Mail Removed)...
> >> > >>> Well I'm not sure what is going on but it seems to be a problem
> >> > >>> with
> >> > >>> your server and not the clients. I would try restarting individual
> >> > >>> services on the server the next time it happens to see if you can
> >> > >>> at
> >> > >>> least narrow it down to a particular service.
> >> > >>>
> >> > >>>
> >> > >>> hth
> >> > >>> DDS
> >> > >>>
> >> > >>> "boe" <(E-Mail Removed)> wrote in message
> >> > >>> news:%(E-Mail Removed)...
> >> > >>>> The server points to itself. No secondary - I could put in the
> >> > >>>> loopback address but it doesn't usually change anything on 2003
> >> > >>>> servers. The server can continue to browse the web and the PCs can
> >> > >>>> at
> >> > >>>> the time - the PCs can still ping the server by name at the time
> >> > >>>> of the
> >> > >>>> issue and they can renew their IP info at the time. The server
> >> > >>>> has a
> >> > >>>> static IP address.
> >> > >>>>
> >> > >>>> No error in the event view on the XP machines - other than
> >> > >>>> eventually
> >> > >>>> it can't find the group update ini - which coincides of course
> >> > >>>> with it
> >> > >>>> not being able to the sysvol or any other share.
> >> > >>>>
> >> > >>>>
> >> > >>>> "Danny Sanders" <(E-Mail Removed)> wrote in message
> >> > >>>> news:#(E-Mail Removed)...
> >> > >>>>> What does the DNS server point to for Primary and alternate DNS?
> >> > >>>>>
> >> > >>>>> Is there any error in the event viewer of the XP machine when
> >> > >>>>> this
> >> > >>>>> happens?
> >> > >>>>>
> >> > >>>>>
> >> > >>>>> hth
> >> > >>>>> DDS
> >> > >>>>>
> >> > >>>>> "boe" <(E-Mail Removed)> wrote in message
> >> > >>>>> news:(E-Mail Removed)...
> >> > >>>>>> The primary DNS is the file server. It has no secondary DNS
> >> > >>>>>> entry.
> >> > >>>>>>
> >> > >>>>>> The file server is the AD, DNS, DHCP and WINS server. The
> >> > >>>>>> workstations are still able to browse the web and ping the file
> >> > >>>>>> server by name when the issue occurs. If I renew the IP
> >> > >>>>>> address of
> >> > >>>>>> a workstation at the time of the issue, they are able to refresh
> >> > >>>>>> their DHCP address but still not able to get to the shares on
> >> > >>>>>> the
> >> > >>>>>> server.
> >> > >>>>>>
> >> > >>>>>> "Danny Sanders" <(E-Mail Removed)> wrote in message
> >> > >>>>>> news:(E-Mail Removed)...
> >> > >>>>>>> What server do the clients point to for Primary and Secondary
> >> > >>>>>>> DNS?
> >> > >>>>>>>
> >> > >>>>>>>
> >> > >>>>>>> hth
> >> > >>>>>>> DDS
> >> > >>>>>>>
> >> > >>>>>>> "boe" <(E-Mail Removed)> wrote in message
> >> > >>>>>>> news:(E-Mail Removed)...
> >> > >>>>>>>> Hello,
> >> > >>>>>>>>
> >> > >>>>>>>> We have a single server environment running Exchange 2008.
> >> > >>>>>>>> All
> >> > >>>>>>>> the clients are running XP. They'll login and the login
> >> > >>>>>>>> script
> >> > >>>>>>>> batch file assigns all the drive mappings. They'll work for
> >> > >>>>>>>> a
> >> > >>>>>>>> week or so and then suddenly no one can access their shared
> >> > >>>>>>>> drives.
> >> > >>>>>>>> They have a few drives mapped to different volumes and none of
> >> > >>>>>>>> them
> >> > >>>>>>>> are accessible. They can still ping the server by name or by
> >> > >>>>>>>> IP
> >> > >>>>>>>> and they get a response. However, they can't even manually map
> >> > >>>>>>>> a
> >> > >>>>>>>> drive to the shares - even the hidden shares and they can't
> >> > >>>>>>>> get to
> >> > >>>>>>>> the sysvol from the clients. It isn't happening at a regular
> >> > >>>>>>>> frequency - but about 1 to 3 weeks or so it will happen. I
> >> > >>>>>>>> can
> >> > >>>>>>>> remote desktop to the server - no issue when this is
> >> > >>>>>>>> happening.
> >> > >>>>>>>> There is nothing in the event viewer at the time the issue
> >> > >>>>>>>> occcurs.
> >> > >>>>>>>> If I reboot the server everything returns to normal.
> >> > >>>>>>>
> >> > >>>>>>>
> >> > >>>>>
> >> > >>>>>
> >> > >>>
> >> > >>>
> >> >
>

Hi, we had the same problem too on Storage Server 2008- running double Take and SEP- turned out to be a SEP problem- both SEP and Double take have replicated this they say (in their test environment) and in our case a patch is being released Oct 2010 to resolve this

> On Friday, January 02, 2009 2:19 PM boe wrote:

> Hello,
>
> We have a single server environment running Exchange 2008. All the clients
> are running XP. They'll login and the login script batch file assigns all
> the drive mappings. They'll work for a week or so and then suddenly no
> one can access their shared drives. They have a few drives mapped to
> different volumes and none of them are accessible. They can still ping the
> server by name or by IP and they get a response. However, they can't even
> manually map a drive to the shares - even the hidden shares and they can't
> get to the sysvol from the clients. It isn't happening at a regular
> frequency - but about 1 to 3 weeks or so it will happen. I can remote
> desktop to the server - no issue when this is happening. There is nothing
> in the event viewer at the time the issue occcurs. If I reboot the server
> everything returns to normal.


>> On Friday, January 02, 2009 3:37 PM Danny Sanders wrote:

>> What server do the clients point to for Primary and Secondary DNS?
>>
>>
>> hth
>> DDS


>>> On Friday, January 02, 2009 6:10 PM boe wrote:

>>> The primary DNS is the file server. It has no secondary DNS entry.
>>>
>>> The file server is the AD, DNS, DHCP and WINS server. The workstations
>>> are still able to browse the web and ping the file server by name when the
>>> issue occurs. If I renew the IP address of a workstation at the time of
>>> the issue, they are able to refresh their DHCP address but still not able to
>>> get to the shares on the server.
>>>
>>> "Danny Sanders" <(E-Mail Removed)> wrote in message
>>> news:(E-Mail Removed)...


>>>> On Monday, January 05, 2009 10:06 AM Danny Sanders wrote:

>>>> What does the DNS server point to for Primary and alternate DNS?
>>>>
>>>> Is there any error in the event viewer of the XP machine when this happens?
>>>>
>>>>
>>>> hth
>>>> DDS


>>>>> On Wednesday, January 07, 2009 1:47 AM boe wrote:

>>>>> The server points to itself. No secondary - I could put in the loopback
>>>>> address but it doesn't usually change anything on 2003 servers. The server
>>>>> can continue to browse the web and the PCs can at the time - the PCs can
>>>>> still ping the server by name at the time of the issue and they can renew
>>>>> their IP info at the time. The server has a static IP address.
>>>>>
>>>>> No error in the event view on the XP machines - other than eventually it
>>>>> can't find the group update ini - which coincides of course with it not
>>>>> being able to the sysvol or any other share.
>>>>>
>>>>>
>>>>> "Danny Sanders" <(E-Mail Removed)> wrote in message
>>>>> news:#(E-Mail Removed)...


>>>>>> On Wednesday, January 07, 2009 12:28 PM Danny Sanders wrote:

>>>>>> Well I'm not sure what is going on but it seems to be a problem with your
>>>>>> server and not the clients. I would try restarting individual services on
>>>>>> the server the next time it happens to see if you can at least narrow it
>>>>>> down to a particular service.
>>>>>>
>>>>>>
>>>>>> hth
>>>>>> DDS
>>>>>>
>>>>>> "boe" <(E-Mail Removed)> wrote in message
>>>>>> news:%(E-Mail Removed)...


>>>>>>> On Wednesday, January 07, 2009 6:49 PM boe wrote:

>>>>>>> That seems like a good idea - I am somewhat limited as I am usually remoting
>>>>>>> in to that office. Strangely I can remote to the server with no issue.


>>>>>>>> On Tuesday, January 13, 2009 6:30 PM Sam Casperson wrote:

>>>>>>>> Hi Everyone
>>>>>>>>
>>>>>>>> I have just installed a new server 2008 computer in one of our branches that
>>>>>>>> is experiencing this exact problem. Most of the workstations are running
>>>>>>>> terminal services and have no problem. But we have a few xp laptops that
>>>>>>>> just loose all connection to the server and will refuse to connect to any
>>>>>>>> shares whatsoever.
>>>>>>>>
>>>>>>>> I found this while googleing the problem
>>>>>>>>
>>>>>>>> -- Experts Exchange -------
>>>>>>>> I am having the same issue. I have been able to keep the server up and
>>>>>>>> running for as long as 6 days before having to reboot. I have a Windows
>>>>>>>> Server 2008 SP1, SQL Server 2005, Symantec End Point Protection
>>>>>>>> 11.0.2020.56, Symantec Backup Exec 12.0 Rev 1364.
>>>>>>>>
>>>>>>>> Symantec End Point Protection is the culprit. I can only assume you have
>>>>>>>> Symantec EndPoint Protection installed. If not, ignore my information.
>>>>>>>>
>>>>>>>> Maintenance Release 3 is expected to be released by Symantec in mid
>>>>>>>> September. I've opened at least 3 cases with Symantec regarding this issue.
>>>>>>>> I spoke with a very knowledgeable rep and was told the SEP mini filter
>>>>>>>> driver is trying to access oplocked data in memory. To summarize, SEP tries
>>>>>>>> to scan files at the same time the user's antivirus is scanning and a lock
>>>>>>>> is created. I may be off slightly, but you can get the idea.
>>>>>>>>
>>>>>>>> Solution (Temporary until MR3 is released)
>>>>>>>> 1. Install only the SEP Core AntiVirus services on Server 2008.
>>>>>>>> 2. Uncheck Drive Scanning
>>>>>>>> 3. Add Centralized Exceptions to disable AutoProtect on all shares on the
>>>>>>>> 2008 Server.
>>>>>>>> 4. Setup manual scans to run a few times throughout the day to run a full
>>>>>>>> system scan.
>>>>>>>> 5. Sign up here
>>>>>>>> http://www.symantec.com/business/sup...tins/index.jsp to be
>>>>>>>> notified immediately when SEP 11 MR3 is released in mid September.
>>>>>>>> 6. If possible reboot your server daily.
>>>>>>>> --------------------------------
>>>>>>>>
>>>>>>>> We do have Symantec Endpoint installed on this machine, and I will be
>>>>>>>> getting rid of it today to see if it makes a difference.
>>>>>>>>
>>>>>>>> Ill post the results here soon.
>>>>>>>>
>>>>>>>> Hope it helps.
>>>>>>>>
>>>>>>>> "boe" <(E-Mail Removed)> wrote in message
>>>>>>>> news:(E-Mail Removed)...


>>>>>>>>> On Friday, January 23, 2009 1:04 PM boe wrote:

>>>>>>>>> Thanks - I am running Symantec MR3 - and still having this issue.


>>>>>>>>>> On Wednesday, January 28, 2009 3:21 PM Tony wrote:

>>>>>>>>>> This is funny... just setup SBS 2008 for a client. Same EXACT issue. I have
>>>>>>>>>> SEP 11.0.4... will be taking off the client and see if it is the problem.
>>>>>>>>>>
>>>>>>>>>> "boe" wrote:


>>>>>>>>>>> On Wednesday, January 28, 2009 5:28 PM Tony wrote:

>>>>>>>>>>> Found this on Symantec's Website:
>>>>>>>>>>>
>>>>>>>>>>> Terminal servers run multiple instances of ProtectionUtilSurrogate.exe
>>>>>>>>>>> Fix ID: 1185648
>>>>>>>>>>> Symptoms: After installing Symantec Endpoint Protection 11.0 to a Terminal
>>>>>>>>>>> Server, a copy of ProtectionUtilSurrogate.exe is ran for each user that logs
>>>>>>>>>>> on.
>>>>>>>>>>> Solution: Symantec Endpoint Protection 11.0 now allows for a client to
>>>>>>>>>>> disable the extra components from loading in separate sessions.
>>>>>>>>>>>
>>>>>>>>>>> Now when you remote desktop into the server it's a terminal session. I
>>>>>>>>>>> noticed in my application logs on the SBS 2008 that "protectionutilsurrogate"
>>>>>>>>>>> was flagged as a faulting application. When I arrived on-site to look at the
>>>>>>>>>>> server the sep client had a yellow exclaimation point and said it was
>>>>>>>>>>> malfunctioning or corrupted. These events seem to line up with times that
>>>>>>>>>>> I've connected remotely to the server. I've removed the client and will
>>>>>>>>>>> report on what happens now.
>>>>>>>>>>>
>>>>>>>>>>> "Tony P." wrote:


>>>>>>>>>>>> On Thursday, January 29, 2009 9:38 AM boe wrote:

>>>>>>>>>>>> When the issue occurs for me, no one is using TS as I am the only one with TS
>>>>>>>>>>>> access to my 2008 server. I can however TS in while no one is able to
>>>>>>>>>>>> access shares from their workstation.


>>>>>>>>>>>> Submitted via EggHeadCafe - Software Developer Portal of Choice
>>>>>>>>>>>> Flat file Database with LINQ and ASP.NET jQuery Page Methods
>>>>>>>>>>>> http://www.eggheadcafe.com/tutorials...e-methods.aspx

If you've enabled the Client service for Netware and there's a Netware server detected on the network, the system will pause for you to login. If you don't want access to Netware servers, just uncheck that box in your local area connection properties.