Endpoint Protection

Hello,

I have a problem with my SEP clients. They are all (about 200 PC & Servers) stuck to a previous virus definition. Proactive Threat Protection and Network Threat Protection get and keep the latest definitions. I have tried to solve the problem by upgrading SEPM to the latest version (12.1 RU6 MP5) but this did not fix the problem. Then I upgraded manually the Virus Definition at a client but after 30min the client rolled it back to the previous definition. After that I upgraded the client to the latest version but again after about 30min the definiton was rolled back. 

Run the SymHelp tool on client and server only error that I found was at "Symantec Eraser Control driver". The service start mode is set to disabled, when it should be Sysemstart.

Have you got defintion roll back active on the group those machines are checking into? 

Policies > LiveUpdate > LiveUpdate Content tab > select the policy assigned to that group > Security Definitions and check you have all boxes checked to "Use latest available" and that "Select a revision" is NOT selected. Click ok and wait for the machines to check in. 

Thank you, this was the problem in my case. Your reply solved it.