Symantec Endpoint Protection (12.1 RU4 and later) is not operating properly on a Macintosh systems, and upon further inspection, it is determined that symdaemon or other Symantec daemons are not running. When attempting to launch the daemons manually using launchctl a message stating that the "Service is disabled" is received.

"Service is disabled"

In this case the service has been disabled and cannot launch until the service is re-enabled. This is likely the result of the service having been unloaded using launchctl in conjunction with the -w switch, which will disable the service. This condition can remain even if the software is uninstalled and reinstalled.

Note: The command sudo launchctl list | grep symantec should normally show four items:

com.symantec.liveupdate.daemon

com.symantec.symdaemon

com.symantec.sharedsettings

com.symantec.liveupdate.daemon.ondemand

Re-enable the disabled service using the following commands:

com.symantec.symdaemon:

sudo launchctl load -w /Library/LaunchDaemons/com.symantec.symdaemon.*plist

com.symantec.sharedsettings:

sudo launchctl load -w /Library/LaunchDaemons/com.symantec.sharedsettings.*plist

com.symantec.liveupdate.daemon

sudo launchctl load -w /Library/LaunchDaemons/com.symantec.liveupdate.daemon.*plist

com.symantec.liveupdate.daemon.ondemand:

sudo launchctl load -w /Library/LaunchDaemons/com.symantec.liveupdate.daemon.ondemand.*plist

You may be prompted to enter your password when running these commands. In some cases it is recommended you reboot the system after re-enabling the services to ensure everything loads correctly at boot. NOTE: the asterisk in daemon pathnames will accommodate suffix variations - SEP 12.1.x uses .plist and SEP 14.0 uses .NFM.plist