Hello all,

We found that definition updates create registry entry in HKLM\SYSTEM\ControlSet001\Control\Session Manager\PendingFileRenameOperations .  

This was also described in your articel -> https://support.symantec.com/en_US/article.TECH182556.html . I would like to ask you if this registry entry should be visible on all client machines which using agent version 12.1.1000.157 or other conditions must be met on the client? I need this information to  investigate the issue.

Best regards

This is usually due to a scan running at the time of the update. 

When a scan is running on a machine, it will lock the currently loaded definition on the machine. In the mean while if a new definition is downloaded by the SEP client, the old definition will be marked for deletion during reboot (as it is currently being locked).

This issue was identified on SEP clients running 12.1 RU1 MP1 or earlier. But it is not necessary that this will happen on all these clients. This was fixed in SEP 12.1 RU2.

Old definitions require a reboot in order to be removed
Fix ID: 2692127
Symptom: Old definitions appear to require a reboot in order to be removed. This is usually due to a scan running at the time of the update.
Solution: Updated the Common Client component to resolve a condition where the scanner held the virus definitions open, which prevented an update.

SecurityGIV - This was the issue which is running in your current version and symantec was fixed it on higher version.

Only upgradation is the solution for this issue.

Also you have runned with very old version after that version a lot of changes has been done. You are need to upgrade in new version to take the advantages of the new version.

Below are the article for the assistance. Hopeit help you

SEP 12.1.6 is new version

https://symantec.flexnetoperations.com/control/symc/registeranonymouslicensetoken

https://www-secure.symantec.com/connect/blogs/new-release-symantec-endpoint-protection-1216-now-available

What's new in Symantec Endpoint Protection 12.1.6

• Article: HOWTO111067
• Updated: June 6, 2015
• Article URL: http://www.symantec.com/docs/HOWTO111067

Upgrade or migrate to Symantec Endpoint Protection 12.1.6

• Article: TECH230601
• Updated: June 5, 2015
• Article URL: http://www.symantec.com/docs/TECH230601