We ran into the following problem after upgrading our servers (Windows 2003 through 2008 R2) to Symantec Endpoint Protection 12.1 RTM from Symantec Endpoint Protection 11.
Our Symantec 12.1 RTM package that we deployed on our servers had the following components in it:
- Virus, Spyware, and Basic Download Protection
- Advanced Download Protection
- Proactive Threat Protection
- SONAR Protection
- Application and Device Control
When a user tries to remote desktop into a server OR after remoting into a server tries to launch an application they get the following error:
This application has failed to start because \System32\SYSFER.DLL was not found. Re-installing the application may fix this problem.
If the error comes up during a RDP session you never get to the desktop. I’ve also had it come up when physically in front of a server. Fortunately if you’re physically in front of the server you can click ‘Ok’ on the error and then hit ‘CTRL+ALT+DEL’ and reboot the server. Typically you can get into the server right away after the reboot.
I also had luck trying different accounts when trying to get into servers. If my account didn’t work the local admin account sometimes would.
After a call to Symantec I got two solutions out of them:
- Upgrade to Symantec Endpoint Protection 12.1 RU1
- Remove the ‘Application and Device Control’ component from Symantec Endpoint Protection on each of our servers.
I’ve gone to one of our servers having this problem, removed the ADC component from Symantec and rebooted the server. The error message has not re-appeared after about 1.5 hours.
Update: Removing the ADC component from Symantec has resolved this issue for us.