Symantec Endpoint Protection Manager reports incorrect time if the system time zone is set to Moscow Time.
Last Updated November 14, 2011
You have a Symantec Endpoint Protection Manager (SEPM) on a computer system with its clock set to Moscow Time. After Sunday, October 30th, 2011, all events in the SEPM are listed as occuring one hour earlier than the actual time they occured.
As of 2011, Russia is no longer setting clocks back one hour in fall. It appears the SEPM is not taking this change into account in determining the display time for logs. The issue is with the Java Runtime Environment (JRE) that the SEPM uses for the conversion to and display of local time. Sun (Oracle) has yet to update Java to accomodate the time zone update.
The problem is not with stored data; date/time is stored correctly as GMT in the SEPM database.
Until Sun releases an update to Java that is approved for use with the SEPM, a workaround for the Moscow time zone is to add an adjustment ("-Duser.timezone=GMT+4") to sesm.bat under <sepm>\bin directory>. Stop the local SEPM service and close any open SEPM consoles before editing sesm.bat; the new file should look like this: