Endpoint Protection

Hello,

I have a server 2008 R2 64 and 12.1.4100.4126, I download def from http://www.symantec.com/security_response/definitions/download/detail.jsp?gid=sep

Rename *.zip *.jdb, put into C:\Program Files(x86), Symantec, Symantec Endpoint Protection Manager, Data, Inbox, Content, Incoming

I push to clients

a.  Symantec Endpoint Protection Manager
b.  Clients
c.  Under Default Group, Clients tab
e.  Under Task, Add a Client
d.  New Package Deployment
e.  Install Feature Sets: Virus and Spyware Only
f.  Install Settings: Virus and Spyware Only
g.  Content Options: All Content (Recommended)
h.  Remote Push
i.  Browse Network
j.  Add Desktops and Server
k.  Next, push

Under Default Group, Clients, the 'Virus Definitions' show current, but at client themselves tha are outdated until I reboot server and desktop clients.

Speaking to Symantec Support, they say I do not have to reboot as long as Policy Serial Number is current,

Any ideas?  Or does clients require a reboot after a definition push?  Seems like some sort of Cache'ing issue.

If this is posted to wrong forum, please move

Thanks

b.

Are any clients getting updated? No reboot is needed nor should a service restart be needed. It all happens in the background.

May want to go thru some troubleshooting steps. Do they update if you force an LU from the clietn side?

Enable sylink debugging to see what's going on

How to enable Sylink debugging for the Symantec Endpoint Protection 11.x and 12.1 client in the Windows Registry

http://www.symantec.com/docs/TECH104758

No, the clients are not getting updated, wait about 45 minutes, SEP Manager says they are, clients are not.  Symantec Tech Support had me use SEP CleanWipe 12 once, works, but them comes back.  I used SymHelp Tool, wow, can't believe what the reports says is wrong.

This works pushing our definitions for abot 2 to 3 weeks, then I have to reboot.  I also notice that after putting the def file into C:\Program Files(x86), Symantec, Symantec Endpoint Protection Manager, Data, Inbox, Content, Incoming and it runs for 20 minutes doing it's thing, I have to push right away,

b.

What did the report show?

Running it now, submit to Symantec support, or post here?

If you log a support case, you'll need that report. You can also post here for review.

Thank you

There is no smc_debuglog_on under HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Symantec\Symantec Endpoint Protection\SMC or HKEY_LOCAL_MACHINE\SOFTWARE\Symantec\Symantec Endpoint Protection\SMC

I am looking into creating that manually

Correct. That's what needs to be done.