Liveupdate fails to install definitions with error LU 1821

Article:TECH196692  |  Created: 2012-09-14  |  Updated: 2013-10-27  |  Article URL
Article Type
Technical Solution


Virus definition are shown outdated.




LU1821: This update failed because it tried to overwrite a file that was in use.  Close all of your Symantec applications and run LiveUpdate again.  Click here for more information on this error





Process Monitor shows the error:


Date & Time:      12.09.2012 16:36:44

Event Class:        File System

Operation:          CreateFile

Result:  DISK FULL

Path:     C:\ProgramData\Symantec\Definitions\SymcData\virusdefs32\tmp52ba.tmp\CCERASER.DLL

TID:        14728

Duration:             0.0000448

Desired Access:                Generic Write, Read Attributes, Delete

Disposition:        OverwriteIf

Options:               Sequential Access, Synchronous IO Non-Alert, Non-Directory File

Attributes:          A

ShareMode:       None

AllocationSize:   3'016'864



The copy of a file or folder in the target “C:\ProgramData\Symantec\Definitions\SymcData\virusdefs32” prompts the following error message.

Disk is full, but it shows at the same time 65 GB free space. The result is that the file cannot be moved from root c:\ as well as the Antivirus definitions.





Windows SBS 2008 SP2

12GB – RAM

200GB Disk space


SEP 12.0


SMS for Exchange 6.5.7 – 279

German Operating System. This issue was reproduced in an English OS as well.



“Windows System Resource Manager” caps the disk space preventing LiveUpdate to download the full set of definitions.




·         First solution:

Adjust the quota in “Windows System Resource Manager” to accommodate virus definitions in the folder:



·         Second solution:

Navigate in the Server Manager panel and disable/remove the “Windows System Resource Manager” role under file services if it is not necessary.


German version of Server Manager panel.








Article URL

Terms of use for this information are found in Legal Notices