Endpoint Protection Manager remote-push wizard throws error "The service has not been started"

Products

Endpoint Protection

Issue/Introduction

Remote-push wizard shows "Network Provider: Microsoft Windows Network Error: The service has not been started" when browsing the network.

You trying to use Remote-Push functionality of SEP Manager Server to install Symantec Endpoint Protection (SEP) Clients on remote hosts. You trying to browse your network / domain / workgroup, however no remote computers can be displayed and an error "Network Provider: Microsoft Windows Network Error: The service has not been started" is being displayed. If you use "Search Network" function of the Remote Push Wizard, host can be found using their IP addresses.

Also following Events are logged in Event Viewer on SEP Manager Server:

Event Type: Log

Event ID: 8032

Source: BROWSER

System Error

Description: "The browser service has failed to retrieve the backup list too many times on transport {XXXXXXX-XXXX-XXXX-XXXX-XXXXXXXXXXX}. The backup browser is stopping."

and

Date: 8/8/2017 2:08:34 AM

Event Type: Log

Source: BROWSER

System Error

Event ID: 8021

Description: "The browser service was unable to retrieve a list of servers from the browser master \\HOSTNAME_OF_MASTER_BROWSER on the network \Device\NetBT_Tcpip_{XXXXXXX-XXXX-XXXX-XXXX-XXXXXXXXXXX}.

Cause

A Master Browser computer cannot be contacted or is not available. Master Browser is a specified machine in TCP/IP networks, that is responsible for collecting list of network resources in it`s subnet. If the list is collected. a Domain Master Browser is contacted to update the global list of all resources within all subnets. This global list is also being returned to the Master Browser in order to provide a full view of network resources. Master Browser functionality utilizes NetBT (NetBIOS over TCP/IP).

Resolution

You can try following steps on SEPM Server

1. You can display list of all host names listed in NetBIOS cache via command prompt using following command on SEP Manager Server:

nbtstat -c (shows a remote netBIOS cache table of hosts)

You can also check netBIOS names resolved by broadcast by:

nbtstat -r

2. Earlier mentioned Event ID 8021 contains hostname of the Master Browser. Check if Master Browser is on the list of hosts cached in netBIOS. If the same hostname appears on the list as in Event 8021, you can determine the state of Master Browser by following command:

nbtstat -a HOSTNAME_OF_MASTER_BROWSER

(* where entry "HOSTNAME_OF_MASTER_BROWSER" is to be replaced with actual hostname seen in Event ID 8021)

A correct Master Browser entry should return following line: ☺☻__MSBROWSE__☻<01> DOMAIN Registered

3. If the name from Event 8021 does not appear on the list, you can purge and request the list of netBIOS hosts from netBIOS Server by command:

nbtstat -RR

and check for Master Browser entry again with:

nbtstat -a HOSTNAME_OF_MASTER_BROWSER

4. If the name of the Master Browser mentioned in Event 8021 still does not appear after querying it with nbtstat -c but other machines from your environement are listed, you might need to reboot the issued machine .
5. If no host names appear after querying it with nbtstat -c you might need to check if ports used by netBIOS on SEPM Server are open (UDP ports 137 and 138 and TCP Port 139). You might need to open TCP Port 445 for direct host name queries as well. Also check if netBT (netBIOS over TCP/IP) is generally allowed on the SEPM Server`s NIC:

- Control Panel ---> Local Area Connection ---> right-click Properties
- On the General tab ---> Internet Protocol (TCP/IP) ---> Properties.
- Click the Advanced button.
- On the WINS tab ---> switch from "Disable NetBIOS over TCP/IP"