SEP 12.1

In SEP 12.1, IPS content will cache 3 revisions and other content types will have 1 revision only.  The number of revisions cannot be configured for SEP 12.1.

SEP 11.x

The default number of content revisions kept by a SEP 11.x client is 3 revisions per content type and the number of revisions can be customized.  Symantec recommends maintaining the default content revisions of 3 to ensure acceptable performance, stability and security of the SEP client.  SEP clients keep multiple revisions of content to allow the client to quickly roll back, or remediate content.

Note: In certain instances a SEP client may keep more than the minimum number of revisions of a particular type of content. This can occur when different content revisions are being used by multiple Symantec products, when a client is currently processing a content update, or the client is in the process of remediating definitions, or has failed to remediate definitions.

To configure the minimum number of content revisions in SEP 11.x:

1. Ensure the following registry DWORD exists:
   HKEY_LOCAL_MACHINE\Software\Symantec\Symantec Endpoint Protection\Content\{<moniker>}
   CacheEntriesEx
2. Modify the registry value to correspond to the number of revisions required.
3. These settings will take effect the next time that content type is updated on the system.

The <moniker> key for 32-bit AV definitions is "{C60DC234-65F9-4674-94AE-62158EFCA433}".
For 64-bit use "{1CD85198-26C6-4bac-8C72-5D34B025DE35}".

Note: The registry DWORD was named CacheEntries prior to SEP 11.0 Maintenance Release 2 (MR2).