Definition updates add entries to "PendingFileRenameOperations" registry key on a frequent basis

Article:TECH182556

Created: 2012-02-28

Updated: 2012-11-20

Article URL http://www.symantec.com/docs/TECH182556

Article Type
Technical Solution

Product(s)

Show all

Languages

Show all

Problem

On a regular basis, virus definition files for Symantec Endpoint Protection are added to the "PendingFileRenameOperations" registry key. Is this expected behavior?

Error

Registry key: HKLM\SYSTEM\ControlSet001\Control\Session Manager\PendingFileRenameOperations

Key's value data: \??\C:\ProgramData\Symantec\Symantec Endpoint Protection\12.1.1000.157.105\Data\Definitions\IPSDefs\20120131.002\IDSxpx86.dll

Environment

Windows 7

Windows XP

Windows Server 2008 R2

32- and 64-bit

Symantec Endpoint Protection 12.1 RU1

Cause

Definition files are being replaced; old definition files are not removed until after reboot.

Solution

The issue has been fixed in SEP 12.1 RU2.

You can obtain a copy of SEP 12.1 RU2 at the following location:

https://fileconnect.symantec.com

The following are some helpful links to documentation regarding this new release:

Obtaining the latest version of Endpoint Protection or Network Access Control

http://www.symantec.com/docs/TECH103088

Upgrading or migrating to Symantec Endpoint Protection 12.1.2011 (RU2)

http://www.symantec.com/docs/TECH197426

What's new in Symantec Endpoint Protection 12.1.2

http://www.symantec.com/docs/HOWTO81091

Release Notes and System Requirements for all versions of Symantec Endpoint Protection and Symantec Network Access Control

http://www.symantec.com/docs/TECH163829

New fixes and enhancements in Symantec Endpoint Protection 12.1 Release Update 2

http://www.symantec.com/TECH199676

Supplemental Materials

Source	ETrack
Value	2692127