Endpoint Protection

Hello,

i've a Problem with my SEPM that most of the Cilents are not updating to the latest Virus definitons!

As SEPM says the latest Version are on the SEPM itself... but the clients stays on the version when the got installed...

it looks like this behaviour startet after updating to 12.1.1101.401 RU1 MP1 but there is more see below...

all Clients stays on the file from 30.7.2012 r17...

but i also tried to deinstall and reinstall one client... a few days ago... now this clients still have the definition from this date (13.8.2012 r19) and isn't updateing...

so i gues the files shouldn't be corrupt...

i've a second sepm in my environment, in a different site, the 2 sepm's are replicated, the 2nd Site just looks fine, all clients updating normally..

at beginning i had a mgmt-server list where both serveres where in for all clients... now i splitted up the things, the main site list (site 1) has just the "faulty" mgmt server in... the 2nd Site List (site2) hast both.. but on first hand the sepm server from site 2... 

before i did the change all clients from site 1 got their updates from site 2 server! we saw'd that in the network logs.. but there isn't a big connection at all that alls 200Clients from Site 1 can get their update from a remote site! and they got the update because site 1 sepm didn't responds or deliver updates anymore... looks like...

hope you understand my problem and maybe someone can help me fix this issue!

thx

Steve

Hi,

I think old or corrupted virus definitions present on the SEPM prevent the SEPM's ability to update the SEP clients with new virus definitions.maybe this article can help you:

Article URL http://www.symantec.com/docs/TECH166923

Also check this setting :

Admin-> Servers-> Edit Site Properties -> Live Update -> Edit Download Schedule -> Check if it is NOT Continuously (Because I have Experienced this issue in Large and Enterprise companies,if Continuously is selected in this companies with low network bandwidth, it will cuase the problem )

Good Luck ;)

Hello, thx for the input but,

i tried the steps from the Article.. but no luck.. CLients just stay on the old definitions...

also i've set the update time to 4h, not continously, so that wasn't the problem...

any other suggestions?!

HI,

Kindly check SEP Client policy both site are same or not ?

Try create new group in sepm server and replace systelink file some system ?

Edit...

Could you please try Updating the SEPM with the Latest .jdb, check this Article:

How to update definitions for Symantec Endpoint Protection Manager using a JDB file

http://www.symantec.com/business/support/index?page=content&id=TECH102607

So please use the link below and capture communication logs between one or two of your clients:

(do not stop and save the log until you see something usefull !!! for example the download process is finished with some errors.)

https://www-secure.symantec.com/connect/articles/how-capture-sep-sepm-communication-logs-sylinkmonitor-mr3-onwards-troubleshooting-communica

and put the log here, so we can troubleshoot further :) and No Worries ;)

It looks like that the article + or maybe the restart itself fixed the Problem... the clients are now updating... finally.. 

thx for help anyway :)