Endpoint Protection

My Virus and Spyware Protection update every day but PTP and NTP are very far behind. Is this normal? Screenshot below:

No, your client should be more up to date than that.

What happens if you run LiveUpdate?

I have it set so the clients can't go out to LiveUpdate.

Looking through the System Logs, some are successful and some fail when trying to get updates from SEPM:

Hello,

This is the Actual Picture as it should be:

Is this a Managed Client or Unmanaged?

Click on Start>Run > Type luall.exe 

What happens than?

I show nearly the same definition dates on my lab system. After running LiveUpdate PTP and NTP still show

PTP - 4/22/11 and NTP - 5/2/11.

BTW, my production box shows 5/5/11 PTP, and 5/6/11 NTP.

Thomas

If I run LiveUpdate, that fails as well saying that it cannot connect to a LU server.

We are behind a proxy but LiveUpdate is allowed out as it works just fine on our SEP11 clients.

Has something changed with regards to that?

It is managed.

When typing luall.exe, I get an error: Windows cannot find luall.exe

Do I need to cd to the correct directory to run?

Upon further review, I don't appear to have LiveUpdate on my system??

I checked in Add/Remove and nothing there.

I also check in the Beta folder I downloaded and there was nothing for LiveUpdate in there either??

A search of the system also comes up empty.

Hi Brian,

So the LUALL.exe message was a red herring :-)  LiveUpdate as a product no longer exists with SEP12 - its a core component of the product.

The command line to run is SepLiveUpdate.exe from here: C:\Program Files\Symantec\Symantec Endpoint Protection

However, thats not going to do much either if you have LU blocked :-)

On further research, your dates match my SEPM that I have updating seperate to Symantec's network - let me dig into this further and work it out for you.

Thanks much Paul

I've enabled LU so I can now run it from the cmd, although it still fails with "The SepLiveUpdate session encountered an error: failure run full interactive SepLiveUpdate, the error code is: a100000f"

According to our fw guru, it is being blocked because it is trying to go out directly thru the firewall, which is not allowed. I'm not sure why this would be since we have no issues with SEP11 clients when running LU.

I see there are now proxy settings to configure on the General tab under Client Management Settings. Should I configure these?

****UPDATE****

So I configured the proxy settings within SEPM and bam! I got out to LiveUpdate and it made 4 updates, although my PTP/NTP definitions did not update but that's ok. So it appears the proxy settings should be configured within the SEPM or on the clients first when behind a proxy if wanting to go out to LU?

Yes you are right, when we have a proxy in the network the same needs to be configured for Liveupdate

Never had to do it with SEP11, which is why I wondered.

Hi Brian,

Is your browser configured with a proxy and if so, what sort of configuration does it have?  LU should use the browser settings by default, there are a couple of circumstances where that wont work though.

thanks

Hi Paul,

Yes, my browser is configured for the proxy and to use a PAC file. This has always been the case.

thanks Brian - assuming the PAC isnt authenticated... it should work fine without having to manually configure anything.  Is it a network based or local PAC file?

got it.. thats why - we can't support authenticated PAC's with SEP12 at this point.

thanks for the confirmation!

Authentication is required.

It is network based.

But what I did was configure it in the SEPM to go directly thru the proxy (no PAC) as no authentication is required here.

You're welcome.

All good on my end, just a little extra configuring :)

Hi all,

Just raising awareness/promoting a dedicated resource: there is a Connect Forum dedicated to SEP 12.1 Beta:  https://www-secure.symantec.com/connect/SEP_12_Beta_Group

Thanks and best regards,

Mick

Just wondering if there was an update? My AV defs are the only ones updating consistently:

This is happening on all oo my SEP 12.x machines.

I show the same dates for my defs, so I assume there are no updates for PTP and NTP.

No updates at this point.  Your dates are still correct