You build a new server and move the Symantec Endpoint Protection Manager database using the Database Back Up and Restore Wizard. However, the clients do not display a green dot on the notification shield icon after the move.

Symptoms

• The new server has a different machine name but the same IP address.
• Clients show a green dot in the Symantec Endpoint Protection Manager.
• The clients' Sylink logs include the following message: "Signature verification failed for index file content."
• Sylink.xml appears to be correct but the server name in the certificate is wrong.

The server certificate is invalid or failed to update.

To verify the issue:

1. Log on to the Symantec Endpoint Protection Manager, then click on Clients.
2. Select a group with clients, or a parent group if policies are inherited.
3. Click the Policies tab and then click General Settings.
4. On the Security Settings tab, uncheck Enable secure communications between the management server and clients by using digital certificates for authentication.
5. Click OK to save the change.
6. Right-click the group name, and then click Export Communications Settings.
7. Save the file to a convenient location (such as the desktop) as Sylink.xml.
8. Using SylinkDrop, update the communications settings on a client machine.
9. Once the services, restart you should see a green dot on the client shield.

To resolve the issue:

I. Run the Management Server Configuration Wizard

1. Exit the Symantec Endpoint Protection Manager and stop the Symantec Endpoint Protection Manager service.
2. Click Start > Programs > Symantec Endpoint Protection Manager > Management Server Configuration Wizard.
3. Reconfigure the management server and ensure the correct server name is listed.
4. Select the appropriate database type and provide the database password (or admin if unspecified).
5. Complete the wizard and log on to the Symantec Endpoint Protection Manager.
   Note: If there is an error applying ACLs to the data folder, please verify that the folder %programfiles%\Symantec\Symantec Endpoint Protection Manager\data has full control for everyone on it and all sub folders. You may need to stop the World Wide Web Publishing service to apply the changes.

II. Back up existing certificate

1. In Symantec Endpoint Protection Manager, click Admin > Servers, and then click on the name of the server under Servers > Local Site.
2. Click Manage Server Certificate under Tasks, and then select Back up the server certificate.
3. Follow the steps to back up the existing certificate to a new location.

III. Update the server certificate

1. While still in Admin > Servers, click Manage Server Certificate under Tasks again. This time, select Update the server certificate.
2. Select the JKS keystore type and then click Next.
3. Click Browse, then navigate to %programfiles%\Symantec\Symantec Endpoint Protection Manager\Server Private Key Backup, then choose the keystore that matches the date and time you reinstalled the Symantec Endpoint Protection Manager. The file should have the fomat of ServerCertBackup_timestamp.zip. Older Endpoint Protection versions may have files with a .jks file type.
4. If Keystore password and Key password do not automatically populate, locate the required value:
   1. In a separate Windows Explorer window, navigate to the same file location as in the previous step.
   2. Double-click the server-timestamp.xml file that matches the timestamp of the keystore you chose.
      Note: This file may be inside the .zip file. If so, double-click on the .zip file to open it.
   3. Locate the value for keystorePass= and copy the data between the quotes.
   4. Paste this data in both Keystore password and Key password fields. Note: The only supported paste mechanism is Ctrl + V.
5. Click Next to finish the update process, exit the Symantec Endpoint Protection Manager and restart the Symantec Endpoint Protection Manager service.

IV. Update the clients with the new Sylink.xml file

1. Log back on to the Symantec Endpoint Protection Manager.
2. Perform one of the following tasks:
   1. Use the Client Deployment Wizard to push out the new sylink.xml to all of the clients. On the Home tab, next to Common Tasks, click Install protection client to to computers, and then choose the Communication Update Package Deployment option. Follow the steps to complete the wizard.
   2. Export the communications settings from a client group as you did to verify the issue, then use SylinkDrop to push the file to them.

After the Sylink file updates, the clients should then begin to display the green dot.

Technical Information

You can find the SylinkDrop tool in the Tools directory of the downloaded installation disk that you get from FileConnect.

Running the Management Server Configuration Wizard updates the server name in the database with the correct name.

Applying the server certificate from the new install forces a clean certificate to be loaded with the new server name.