During a recent Symantec Endpoint Protection deployment, I started to notice an interesting anomaly. Every time a user accessed the web interface and launched a Citrix icon, a new process would spawn and minimize to the users tray (SEP Notification Icon). You can also see the pending process by opening the Citrix Connection Center and expanding the servername (active/servername/).
Whats interesting about this specific issue is after the user closed out of the published application, the SEP Notification icon remained and the user still had an active session on the server. As a result of this action we started to notice our concurrent license usage was at levels we did not anticipate which prompted further investigation.
In the event you do have the Notification Icon after updating SEP, simply logon on the server in question and add/modify the following registry key:
Windows Registry Editor Version 5.00 [HKEY_LOCAL_MACHINE\SOFTWARE\Symantec\Symantec Endpoint Protection\SMC] "LaunchSMCGui"=dword:00000000 [HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run] "ccApp"=-
Now that you have hidden LaunchSMCgui an purged the run key of unnecessary Symantec launches you should be good to go and will no longer have lingering sessions.
