EventLog Analyzer WMI events polling compatibility with Symantec Endpoint Protection 12.1 RU1 MP1

Recently i've been testing new SEP version (we were using 11 version) and after installing just Antivirus-Antispyware setup onto Windows 2003 server with ELA on it, all servers became disconnected in ELA (Orange status). After uninstalling SEP the issue disappeared. Also after loggin into that server i once saw a SEP warning message about some risk detected, but Risk log was empty. In Symante forums they ask for the logs and can't say whether new SEP version can block WMI queries (outgoing). So far i have reverted to 11 version. Have anyone else experienced the same issue? We are not using Snare or other agent based polling.