Endpoint Protection

Hello,

We recently installed Symantec Endpoint Protection Manager 11.0.4000.2295 on a Server 2003 64 bit machine on a closed network that has no access to the internet.  I downloaded the most recent virus signatures vd318c03.jdb and placed them in C:\program files (x86)\symantec\Symantec Endpoint Manager\data\inbox\content\incoming .   The file never decompresses and the server and clients never receive the latest defs.  Any ideas out there on what I can do.  I have a server on a different network that works perfectly.  I don't see any differences in the two.  Help 

Are you using the correct files?

Where can you get VirusDefs files (VDB/JDB) that you can drop on a Symantec Endpoint Protection Manager's incoming directory?

ftp://ftp.symantec.com/AVDEFS/symantec_antivirus_corp/vdb/

ftp://ftp.symantec.com/AVDEFS/symantec_antivirus_corp/rapidrelease

I believe so.  I'm getting the files from http://www.symantec.com/business/security_response/definitions/download/detail.jsp?gid=savce 

I noticed that the 32 and 64 bit files are the same file.

I place the file into the directory above and expect the file to automatically create a folder of the same as the file name and decompress from there.  It's not doing that.  I feel like there is a service or a part of the manager that isn't checked. 

Try restating Symantec Embedded Database and Symantec Endpoint Protection Manager service.

Also check in SEPM -Admin- Notification Area if you are getting any errors regarding Rapid Release definitions.

Thanks for everyones help.  I restarted the both services and no change.  I went into SEPM -Admin and clicked the Servers tab and checked those log entries.  What I found is the following:
LiveUpdate retry started
LUALL.exe has been launched
LiveUpdate encountered one or more errors. Return code = 4
LUALL.exe finished running
LiveUpdate retry failed.  Will try again.

All of this happend with a matter of a minute time frame.

I've changed my server to be the primary server to distribute defs and that is the only selection for the clients to receive from.

try this document and then put the jdb file after restarting sepm service

http://service1.symantec.com/support/ent-security.nsf/docid/2008041516215948

Thanks for the help.  I copied the most recent files to the incoming folder with no change.

I would perform a repair install in a console session. If you are using RDP make sure you connect using microsoft directions to get console as this is the only supported method of using RDP with our software while installing or using.

My partner and I did exactly what the article said.  These are the results:

These folders were not there:

• %programfiles%\symantec\symantec endpoint protection manager\inetpub\content\{1CD85...
• %programfiles%\symantec\symantec endpoint protection manager\inetpub\content\{C60DC...

These folders were not there but were created manually:

• %programfiles%\common files\Symantec Shared\SymcData\sesmvirdef32
• %programfiles%\common files\Symantec Shared\SymcData\sesmvirdef64

Emptied this folder:
 

%programfiles%\common files\Symantec Shared\VirusDefs

Some of these folders recreated themselves.

Started the LUALL.exe and it completed.  I didn't knwo what this would do since we are on a closed network that has no connection to the internet.

Restarted the services

These folders were not created:
%programfiles%\symantec\symantec endpoint protection manager\inetpub\content\{1CD85...
%programfiles%\symantec\symantec endpoint protection manager\inetpub\content\{C60DC...

Log on to Symantec Endpoint Protection Manager Console and launch a LiveUpdate from Admin > Server > Local Site > Download LiveUpdate content.
Verified the files and nothing has changed.

 

there should be an inetpub/content folder
make sure you are checking in the right patch
for 64 bit it will be under programx86 :) did you check that?

Let me explain my actions.  The content folder is there but the {1CD85... and {C60DC... folders do not appear.  This is all being done at the ...program files (X86) folder.

Thanks again for your time.
 

We performed the repair with no success.  The .jdb file just isn't decompressing.  Everything looks fine.

no harm in upgrading your manager
upgrade to latest version ; just the manager
then put the jdb file lets us know if thats successfull
you can get the latest from here
https:;//fileconnect.symantec.com
put the serial number
download it
run the setup.exe
put the jdb file after completion

Hey Guys,

Thanks for all your time and effort on helping me out.  We ended up rebuilding the server from scratch and re-installing the SEPM from the console and everything seems to be working fine.  I don't know what was different this time.  Thanks again for all your help.

Rob T.