Video Screencast Help
Give us your opinion and win with Symantec! Please help us by taking this survey to tell us about your experience with Symantec Connect, so that we can continue to grow and improve.  Take the survey.

Client SEP Can't download virus definition from SEPM.

Created: 04 Oct 2012 | 6 comments

Dear All,

I need your help to fix this problem,

I have 1 client SEP 12.1.xx can't download virus definition since more than 7 days,

When i try to test connection between SEPM and Client is OK,

I used browser to check connection " SEPM_IP:8014/secars/secars.dll?hello,secars" and the result is "OK"

But when i try to access " http://SEPM_IP:2967/content " is can't.

and when i check the syslog is " Downloaded new content update from the management server failed."

also "An update for Virus and Spyware Definitions Win64 failed to install.  Error: 0x80004003, DuResult: 0. "

So what should i do ??? that's maybe port 2967 is blocked, i have turn of windows firewall,

Thank you for your attention,,,

Comments 6 CommentsJump to latest comment

Ashish-Sharma's picture


Troubleshooting Client Communication with SEPM

Port 2967 using when SEP client update on GUP.

Thanks In Advance

Ashish Sharma

chandz89's picture

Dear Ashish ,

Thanks for your reply,

I think the connection between SEPM and Client is OK,

Could you tell me more spesific what should i do ???

Thank you

Ashish-Sharma's picture


How many system having problem ?

OS Version ?

Windows firewall should be off ?

Download and install the Intelligent updater (64 bit) on this client machine? 

How to update definitions for Symantec Endpoint Protection using the Intelligent Updater

Symantec Endpoint Protection Manager (SEPM) 12.1 is not updating 32 or 64 bit virus definitions.

Check this thread

Thanks In Advance

Ashish Sharma

Chetan Savade's picture


The affected client is acting as a GUP?

If yes then port 2967 should be open on the SEP client machine not on the SEPM machine.

Test SEP to GUP and GUP to SEPM communication

Could you please which component definitions are not updating? AV/AS or PTP or NTP?

Have you tried to reinstall liveupdate?

Liveupdate setup download from here.

Chetan Savade
Sr.Technical Support Engineer, Endpoint Security
Enterprise Technical Support

Don't forget to mark your thread as 'SOLVED' with the answer that best helps you.<

Riya31's picture

If its single client you can run intelligent updater...also enable sylink log for futher analysis.

Mithun Sanghavi's picture


Is the client receiving updates from SEPM OR GUP?

GUP uses the port 2967. Incase, if the clients should be taking the updates from SEPM and no GUP's are assigned, then I see no reason for you to concentrate on Port 2967.

In your case, this issue is occurying only on 1 client machine, correct?

I would then request you to work on the articles below:

How to clear out definitions for a Symantec Endpoint Protection 12.1 client manually

How to update definitions for Symantec Endpoint Protection using the Intelligent Updater

Hope that helps!!

Mithun Sanghavi
Associate Security Architect


Don't forget to mark your thread as 'SOLVED' with the answer that best helped you.