Endpoint Protection Small Business Edition

I have ~20 clients (Win 7) connected to the SEPM 12.1 server (Win Server 2008 r2).  The clients and SEPM server are not connected to the Internet (no firewall used) and therefore logs cannot be provided.  A new definition file was loaded into SEPM this morning.  The clients show the latest definitions dated in April.  All clients have been confirmed to be connected to SEPM.  Disk space is not an issue on the server or any clients.

Troubleshooting attempts include deleting old definitions on the SEPM server, pushing updates from SEPM, pulling updates from clients.

One additional attempt was exporting an installation file for a client with the updated definitions.  It installed successfully and appeared correct, but once it connected to SEPM, it reverted the definitions back to the April definitions.

Any support would be appreciated.  Thanks in advance.

Enable sylink debugging on an affected client:

How to enable Sylink debugging for the Symantec Endpoint Protection 11.x and 12.1 client in the Windows Registry

One other thing to check is your defs are not set to rollback to a certain date.

Go to the Policies page >> select LiveUpdate >> LiveUpdate Content tab (at the top) open it up and see what's set here under Security Definitions..set to roolback to a specific date?

Hi Brian,

I checked the Security Definitions settings as you recommended and found that updates were set to a specific date.  I changed the setting to the most current version and we're good to go.  Thanks again for your quick reply--saved a lot of headaches.

Good deal, happy to help :)