Let me clarify a little better (just got off the two hour phone call with support).  In the SEPM console, I noticed SEP detected a virus on one of my clients.  Hmm, I didn't get any email notification from my Monitors.  I issued an "update content and scan" on the client in question.  Three hours later, the console says the client didn't get any notification.  I then called support.

I cannot issue a scan command on any computer including my SEPM server.  Last defwatch scan happened around 9PM on 12/31/08 for my clients (I've yet to find one that ran a scan after that date).  So now I'm wondering if I just got a bad defninition file.  Strange as my computer says latest definitions are today and yet my scan log show my last scan on 12/31.

All computers that I tested are MR4.  Support case is 312-084-585.

Am I the only one with this problem?  So far, all SEP client's are reporting in their GUI, view scan logs and system logs, that nothing is updated beyond 12/31/08.  The SEPM console does report defwatch scans or manual scans are working properly for the computer I checked manually.

I'm wondering if this has to do with the leap year (yes, this theory is waaaaay out there).  One replicated server seem to accept commands from the main SEPM server (update and scan) while the other replicated server does not.

The scan logs on various client computers (including the main SEPM server) report that the last defwatch virus scan happened on 12/31/08 even though I have a scheduled scan for Monday's at 8pm (1/5/09) and clients are getting new virus definitions.

Am I the only one with this problem?  Please let me know.