"There were no new content updates. Return code = 1" Definitions are not up to date on the Symantec Endpoint Protection Manager

Article:TECH95830  |  Created: 2009-01-28  |  Updated: 2011-09-28  |  Article URL http://www.symantec.com/docs/TECH95830
Article Type
Technical Solution



The Symantec Endpoint Protection Manager (SEPM) no longer updates content from LiveUpdate (LU).


While checking the Liveupdate downloads in the SEPM under Admin>Servers>Local Site>Show Liveupdate Downloads, it shows that the definitions revision are outdated.

When running Luall.exe in interactive mode, the Liveupdate pop-up window returns the following message: "There were no new content updates. Return code = 1"




log.liveupdate may contain entries similar to the following:

    5/20/2010, 3:52:00 GMT -> EVENT - SESSION END FAILED EVENT - The LiveUpdate session ran in Silent Mode. LiveUpdate found 0 updates available, of which 0 were installed and 0 failed to install.  The LiveUpdate session exited with a return code of 1805, There are no products on this computer that can be updated by LiveUpdate.
    5/20/2010, 3:52:00 GMT -> 
    Only the LiveUpdate command lines were registered in the Product.Inventory.LiveUpdate file. <---


This issue can occur when the SEPM's content monikers are no longer registered with the LiveUpdate client. When this occurs, the LiveUpdate client no longer knows to check for SEPM content updates.


This can be corrected by registering the SEPM with LiveUpdate.

To register SEPM with LiveUpdate:

  1. Click Start, then Run.
  2. Type cmd , click OK.
  3. At the command prompt type CD and the path to lucatalog.exe. By default the command would be:
    cd C:\Program Files\Symantec\Symantec Endpoint Protection Manager\bin
  4. Type lucatalog -cleanup
  5. Type lucatalog -update
  6. Run Live Update


Legacy ID


Article URL http://www.symantec.com/docs/TECH95830

Terms of use for this information are found in Legal Notices