@larry_barrett with SIP Disabled it completely wipes any system extensions approved or not.
Hugonaut$ systemextensionsctl resetThis Popup requests Authentication
& Then Terminal Reads
Database reset successfully.
Hugonaut$ systemextensionsctl list
0 extension(s)
@mikedowler Just to check that I'm following your workflow properly, I've created the config profile in Jamf, put together the System Extensions payload with "Allowed System Extensions" for the type, populated the team identifier, and explicitly added com.symantec.mes.systemextension as an allowed System Extension.
However, despite scoping that out to a test Mac on 10.15.1 and confirmed it's installed, running sudo systemextensionctl list returns 0 extensions, and when I launch SEP, it still indicates that "System extensions need authorization". Any idea what might be broken in my setup? I've also tried setting Allowed Team Identifier and specifying that identifier, but no luck there either.
What does your configuration profile - system extension payload look like, does it look like this? I'm on Jamf Pro 10.16.1 - This works on macOS Catalina 10.15.1.
Also, You need a PPPC Profile to grant the system extension Access to All Files. So if you stick to a Granular Approach, you need 3 profiles.
- Kernel Extension Configuration Profile
- System Extension Configuration Profile
- PPPC - Full Disk Access for Symantecs System Extension
Great Thread :) @NoahRJ @Hugonaut @mikedowler
I'm still having problems. I have 1 profile with 3 payloads, PPPC, Approved Kernel Extension, System Extension
PPPC to allow Full Disk Access:
Approved Kernel Extension
System Extension
I removed Symantec, restarted, ensured Profile is in place, install Symantec, restart, but still I get:
Could someone please provide screen shots of all 3 items?....I must be doing something wrong here.
@MatG no need to create a PPPC payload for mainapp. Your System Extension Payload profile is correct, have you given it time to load?
Also, (PPPC) grant it access to EVERYTHING, your PPPC profile looks a little light unless im missing something. Remember, when the systemextension is fully utilized (i dont believe symantec is fully utilizing it yet) its doing a full system scan, I wanted mine to include all possible avenues of data, external & internal. (This is COMPLETE overkill, you only need SystemPolicyAllFiles)
for kernel extensions payload, it's also best to give access to the following 4 Kexts explicitly.
great thread, anyone else seeing the systemextension chew up the CPU?
Having major issues with Symantec EndPoint Protection 14.2 RU2 (14.2.5323.2000) and installing onto MacOS Catalina 10.15.x. The SEP Client installs fine but I am constantly getting the cursed System Extension Blocked even though in JAMF I have done all the required Kernel Extension and System Extension Allows for the Configuration Profile.
I have setup the correct PPPC Settings for com.symantec.mes.systemextension using Bundle ID 9PTGMPNXZ2 for Symantec Corporation using the Code Requirement below:
identifier "com.symantec.mes.systemextension" and anchor apple generic and certificate 1[field.1.2.840.113635.100.6.2.6] / exists / and certificate leaf[field.1.2.840.113635.100.6.1.1.3] / exists / and certificate leaf[subject.OU] = "9PTGMPNXZ2"
And having the App or Service set to Allow SystemPolicyAllFiles
The Approve Kernel Extensions is also configured for Team ID 9PTGMPNXZ2 and Approved Kerenel Extensions as followed:
com.symantec.nfm.kext
com.symantec.internetSecurity.kext
com.symantec.ips.kext
com.symantec.sep.mainapp
com.symantec.mes.systemextension
What the hell am I doing wrong? :) Hope to hear back from an expert who has overcome this issue :)
Cheers - Paul
Same here as @blackholemac We have profiles for PPPC, SEXT and KEXT, fresh 10.15.2 install. I install the cloud version of SEP (14.2 RU2 25, in system info version 9.0.1) and this is what we see after deploying the pkg, and reboot:
will try the tip from @David_h to run the update first.
Update1:
I tried to update ,but the GUI does not allow to access (see error message above), so I try to update in the background
This command (no need for sudo) can run it manually, but behaviour (error above) is the same:
/Library/Application Support/Symantec/Silo/MES/LiveUpdate/LUToolUpdate 2:
using the log command from carl ashley/ I see a lot of references to com.symantec.mes and not com.symantec.mes.systemextension so I tried to include both in the PPPC profile.
Not much improvement so far
Update 3:
We use the cloud version of SEP, also known as SES. It has different GUI, but shares a lot with the on-prem versions of SEP (that we also use for some internal mac's) Maybe the GUI warning I see is only for the Cloud version?
So, we're seeing high CPU utilization from the com.symantec.mes.systemextension agent and won't be deploying it in our environment until Symantec sorts out their poorly written sysext, but I did put together a reliable way to install the SEP client and get it authorized:
I have a single config profile with three payloads (PPPC, kext, sysext; screenshot below), scoped out to 10.15 (this is important, because if you apply sysext on 10.14 and then upgrade to 10.15, it doesn't know what to do with this and Catalina will not respect the config).
From there, I have a policy scoped to 10.15 machines that hits on login. I haven't been able to activate the system extension correctly without first launching Symantec Endpoint Protection.app in the user space, so I install the SEP 14.2 RU2 PKG as well as a postinstall script (below) that loads the SEP kexts and launchds, launches SEP in the GUI for five seconds (seems to be long enough to get it to activate the sysext), and then quits. I've tried invoking the binary or figuring out some way to do this separate from the user login, but so far haven't been successful.
#!/bin/bash
#Updated 12/02/19; NRJA
#FOR USE WITH 10.15
#POSTINSTALL SHOULD ONLY BE RUN ON LOGIN
#Load the kexts for SEP
/sbin/kextload /Library/Extensions/{NortonForMac.kext,SymInternetSecurity.kext,SymIPS.kext,SymXIPS.kext}
#Load the LaunchDaemons for SEP
/bin/launchctl load /Library/LaunchDaemons/{com.symantec.SymLUHelper.MES.plist,com.symantec.UninstallerToolHelper.MES.plist,com.symantec.deepsightdownload.MES.plist,com.symantec.liveupdate.daemon.MES.plist,com.symantec.sharedsettings.MES.plist,com.symantec.symdaemon.MES.plist,com.symantec.symqual.detail.MES.plist,com.symantec.symqual.panicreporter.MES.plist,com.symantec.symqual.submit.MES.plist,com.symantec.symseplps.MES.plist}
#Get the shortname of the logged in user
CurUser=$(ls -l /dev/console | awk '{print $3}')
#Launch SEP in the user space in the background and hidden
/usr/bin/su - "${CurUser}" -c "/usr/bin/open -jg '/Applications/Symantec Solutions/Symantec Endpoint Protection.app'"
#Wait for SEP to activate with the SysExt
sleep 5
#Close out of SEP
ps aux | grep -i 'Symantec Endpoint Protection' | grep -v grep | awk '{print $2}' | xargs kill -15After that completes, you should be able to run systemextensionsctl list and see Symantec's team ID (9PTGMPNXZ2) shows as active and enabled now. This has reliably worked on new Catalina builds as well as upgrades from 10.14 --> 10.15 (we first uninstall SEP before the upgrade and then install the new agent with the instructions above).
we have major issues with Symantec EndPoint Protection 14.2 RU2 (14.2.5323.2000) and installing onto MacOS Catalina 10.15.x. The SEP Client installs fine but I am constantly getting System Extension Blocked even though in JAMF I have done all the required PPPC ,
Kernel Extension and System Extension Allows for the Configuration Profile.
PLEASE SHARE RESOLUTION IF ANYONE HAVE
