Endpoint Protection

For some reason, my SEP desktop clients in the desktop groups have stopped getting definitions from the SEP server. I noticed today that the conectivity icon is yellow and not green. The servers have gotten the latest update which right now is 2014-03-09 rev.024 but the desktops which are in their own client groups have 2014-02-06 rev.024

The clients are able to ping the management server. The clients in SEPM show connectivity with the SEP server. I am running SEP 11.0.5. Any help is appreciated.

Has the LiveUpdate policy changed recently? Are all in the group not updating?

Can you enable sylink debugging on one affected client to see what is going on?

How to enable Sylink debugging for the Symantec Endpoint Protection 11.x and 12.1 client in the Windows Registry

http://www.symantec.com/docs/TECH104758

Other helpful articles to review:

Troubleshooting Client Communication with SEPM

http://www.symantec.com/docs/TECH95789

Troubleshooting communication problems between the management server and the client

http://www.symantec.com/docs/HOWTO80740

Testing Communication from an Endpoint Protection client to the Endpoint Protection Manager

http://www.symantec.com/docs/TECH102682

Symantec Endpoint Protection Manager 11.x Communication Troubleshooting

http://www.symantec.com/docs/TECH102681

the onces who have the latest, can you check the liveupdate setting if they are configured to get liveupdate from internet or from SEPM?

Good one, I should have checked this first instead of assuming they are all the same. The ones that are working are getting their updates from Symantec. The ones that are not working are getting their definition updates from a internal management server.

_Brian, liveupdate policy has not changed. Turns out all the groups being updated by the internal management server are not getting updated.

I will enable sylink and test shortly. Thanks.

1) Please check if you management server is updated with the lastest defs,

2) Cleints communicating with green dot?

3) with 11.5 , there is always possible that IIS is hung.

4) And yes, sylink will give the exact reason

Restart the database service and run the update content command from server for that group.

Hi,

your site clients are on same subnet or different subnet using GUP? If local subnet , check LU setting on SEPM, whether you selected option "Use the Default Management server" or update from Symantec Live Update". suggested option for your local site systems to : use default management Server" only checked, rest all unchecked. you can also select Live update server, but all client if fails to receive update from SEPM, will communicate to Symantec Live update server if internet Enabled whihc cause Internet bandwidht issues.

you can check current live udpate setting from client side too that waht live update policy applies to client at preset to check through registry as follows

HKEY_Local_Machine\software\symantec\symantec endpoint Protection\LiveUpdate

here check the value on which (1) is enableed e.g. if enabled live update policy from SEPM the value will be (1) in UseManagementServer option if Update policyt  from Live Update  (1)  value will whow against UseLiveUpdateServer option.

We have seen this problem also in the past, there are different reasons for it. In teh previous post i have seen some of those solutions/reasons. But i have one that is'nt there depnds if you use locations awareness. If you use this and you have have different policy for locations you need to check on the clients on wich location they are. 

We had this problem in the past when we changed DHCP server. Our location was set if he could reach the dhcp server or wich DHCP server so we could use site policy for GUP.

Could you please update your thread?