Endpoint Protection Small Business Edition

Below is my test environment :

Server S -  SEPM  12.1.3

Client A - SEP 12.1.3  ( Set as GUP,  its System Log show that it is downloaded the new content update from itself , not the SEPM ...)

Client B - SEP 12.1.3 ( Sucessful download update from GUP )

Client C - SEP 12.1.3 ( Sucessful download update from GUP )

Client D - SEP 12.1.3 ( Sucessful download pdate from SEPM )

Why A will show the new content update is from itself ? arent it is download from SEPM ?

You need to make here a distinction between the SEP Client on a GUP machine and the GUP itself on the same machine - this is not the same thing.

* SEP client will get updates as per assigned policy - here as specified from the GUP = which is a matter of fact  the same machine.

* GUP (feature) will take the updates always from SEPM only and provide them to clients (this download action in not reported or logged in the default SEP client logs).

Both the SEP client and GUP definitions are different files and are not shared between the two - even though these files are located on the same machine.

If you want to further trace the GUP downloads from SEPM and distribution to SEP clients I can recommend enabling the SEP Debug - that will show you those actions:

How to debug the Symantec Endpoint Protection client

Got it,

thank you