Endpoint Protection

After upgrading clients from 12.1.1101.401 to 12.1.2015.2015 and rebooting twice I am still seeing content for the old version in the ProgramData\Symantec\Symantec Endpoint Protection folder.

I am also finding clients that still have client data from the previous upgrade from 11.0.6300. Is this working as intended? Is there a known script that I can run across the domain to remove old definition files? This is especially important on our windows servers as their disk is stored on expensive Netapp trays.

SEP 11.x stores 3 content revisions, while 12.1 now only stores 1.

That being said I believe these should be removed on uprgade.

You can probably delete them however, I would call Symantec and open a case. There was a utility called Rx4defs that was used in 11.x. I think it was used for corrupt defs but you should call. Not sure if there is one for 12.1 as I've never had to use.

See this thread on obtaining

https://www-secure.symantec.com/connect/forums/rx4defssep-utility

You can have a look at the documentation for manual cleanup of the definitions:

http://www.symantec.com/docs/HOWTO59193

There was a known defect regarding the amount of kept AV defs on OS Server systems:

http://www.symantec.com/docs/TECH180056 ...this should be fixed in RU2 after the upgrade.

What old content are you exactly seeing in the ProgramData\Symantec\Symantec Endpoint Protection folder?