Endpoint Protection

We have a Windows 2012 R2 server running Symantec Endpoint Protection 14.2.53.23.2000. Same behavior I am reporting was also observed with ver 14.0.3876.1100

We have a backup appliance Rubrik on version 5.2 that archives virtual machines fine to the above server fine. It is when we attempt to write a virtual machine tape, using Qstar software we run into a problem. The job keeps restarting.

If we disable Symantec the jobs fails. If we put exceptions in place for the Qstar directories the job fails too.

If we remove Symantec the job completes.

How do we go about troubleshooting this type of scenerio? Rubrik and Qstar believe Symantec is the cause.

Thanks!

It clearly appears to be SEP, but putting in exclusions should work. Have you tried to exclude every process used by Rubrik, or just the entire installation folder? All ports excluded that the application and VTL use?

Craig, I neglected to mention that small VMs write to tape, it is large ones that fail consistantly. A 1.5 TB VM will never write to tape while Symantec is installed, however a 200 GB VM does.

I have not excluded any ports, but have done these steps in the Symantec console

add security risk exception , folder c:\qstar
add security risk exception , folder l:\    (this is the qstar cache)
add security risk exception , folder y:\

add application exception C:\QStar\svc\qwsd_server.exe
add application exception C:\QStar\svc\qs3svc_server.exe
add application exception  C:\QStar\svc\qserver.exe
add application exception  C:\QStar\svc\_cbfsmount.exe

...and you're sure it isn't a Rubrik issue with the tape not being big enough?