Endpoint Protection

The problem is that I am getting an Security Attention Needed alert in SEPM.

When I check it out I am advised that intrusion prevention signature failures & Download Protection Content Failures are out of date. This alert is showing that most of my clients are missing the updates (199).

The other components are all good and up to date: Sonar content, Virus Definitions Failures

I have checked the live update settings policy and everything seems to be configured correctly to get updates.

Any ideas on why this may be happening?

Thanks in advance for you assistance.  

Hi All,

After deleting the client from SEPM the client comes back online as being upto date.

Once you delete the client from SEPM, the client will then recoconnect and add it's self back in to the correct OU within SEPM.

I am not sure if this has fixed the problem or just masking it. Any thoughts?

Hi All,

Ignore my last post I spoke too soon.

The problem is still occurring.

I am still getting the problem of Intrusion Prevention Signature Failures (71) & Download Protection Content Failures (203).

From what I can see all my update settings appear to be okay.

I have also run updates with the following command start>run and type 'luall.exe' on the SEPM Server.

Any ideas on what could be causing this would be much appreciated.

is the client updated?

what is the date format selected?

See if this link helps

http://www.symantec.com/business/support/index?page=content&id=TECH164272

This seems to be reporting issue as well, please think in this regard too. Your clients might still be updating. Please check some sample clients.

http://www.symantec.com/business/support/index?page=content&id=TECH164272

The short term fix would be to either increase your Download Protection and IPS thresholds or to switch to using the US date format for reporting temporarily.

Let us know what fix worked finally.

I think Pete is also referring to the same.

Hello,

Are you carrying the Latest version of SEP 12.1?

I would recommend you to migrate to the Latest Version of Symantec Endpoint Protection 12.1 RU1.

This is resolved in this Latest Version.

When getting the latest verson of Symantec Endpoint Protection 12.1 RU1, there are 3 files:

Symantec_Endpoint_Protection_12.1_RU1_SEPM_EN.exe

Symantec_Endpoint_Protection_12.1_RU1__Part1Installation_EN.exe

Symantec_Endpoint_Protection_12.1_RU1_Part2_Tools_and_Documents_EN.exe

This may be a silly question but is there a particular order you must install these files?  Do I need to install all of them?  Can I install during working hours with no disruption to the server? (Small Business Server 2003)

Hello,

Please Download the below Installation files.

1) Symantec_Endpoint_Protection_12.1_RU1_Part1_Installation_EN.exe

2) Symantec_Endpoint_Protection_12.1_RU1_Part2_Tools_and_Documents_EN.exe

Symantec_Endpoint_Protection_12.1_RU1_Part1_Installation_EN.exe includes all the Installation of SEPM 12.1RU1 , SEP 12.1 RU1 32 bit , SEP 12.1 RU1 64 bit, SEP MAC 12.1 RU1 , SEP 12.1RU1 Linux

whereas 

Symantec_Endpoint_Protection_12.1_RU1_Part2_Tools_and_Documents_EN.exe includes Tools and Documents for SEP 12.1 RU1

The other installations like below are single installations provided for convenience, so that they can be downloaded easily and seperately as their size is less (compared to the above full download)

Symantec_Endpoint_Protection_12.1_RU1_Win32-bit_Client_EN.exe 12.1 RU1

Symantec_Endpoint_Protection_12.1_RU1_Win64-bit_Client_EN.exe 12.1 RU1

Symantec_Endpoint_Protection_12.1_RU1_SEPM_EN.exe 12.1 RU1

Symantec_Endpoint_Protection_12.1_RU1_Mac_Client_EN.zip 12.1 RU1

Hi All,

Thanks for all the feed back changing the date in the log and Reporting fixes the issue as a workaround.

I will try installing the suggested updates and see if it fixes the problem permanently.

Thanks All for your assistance.

Please can someone help,

How about getting messages from SEPM console that intrusion prevention signature is out of date?

Updating to RU 1 fixes the problem, well it fixed it for me.

See the below link on how to upgrade 12.1 to RU1:

Upgrading or migrating to Symantec Endpoint Protection 12.1.1000 (RU1)

http://www.symantec.com/business/support/index?page=content&id=TECH174545

You can download the RU1 update from:

https://fileconnect.symantec.com

Youw will just need to enter your prduct serial number.

Can someone help with this issue.

I came acrross this error message in SEPM 12.1 console saying "Download Protection Content Failures".I don't know why?