Hi,

We are deploying SEP 12.1  clients to various machines through windows images.

We have some across a situation, where a client that was deployed from the image 2 months back, is not getting updates fromt he SEPM server.

In the SEPm server we have set the number of updates to keep as 20. So the SEPm server is having the updates for the last 20 days only.

Now when this image which was taken 2 months back is not getting updates from SEPM.

Is this the way SEPm 12.1  is supposed to work and should we run an internet live update on the clients to get the latest updates in sync with SEPM?

Or will SEPm force the new update son this client even if there are not revisions 2 months back in the server?

Please advice..

was this machine getting updates earlier?

hope you have followed this article

http://www.symantec.com/business/support/index?page=content&id=HOWTO54706

These cleints are online on Server?

You are using image disk. So this may be areason that your client not getting update.

Replace the sylink file and check

Hi,

Is the sep client showing Online in SEPM console ?

You can enable Sylink Debugging  and provide logs file

How to enable Sylink debugging for the Symantec Endpoint Protection 11.x and 12.1 client in the Windows Registry

 Symantec Endpoint Protection: Troubleshooting Client/Server Connectivity

Since these are from image, these will have duplicate HW ID, did you check if these are showing up in the console? if you delete the HW ID it should communicate and take the defs.

How to prepare a Symantec Endpoint Protection 12.1 client for cloning

http://www.symantec.com/business/support/index?page=content&id=HOWTO54706

Use the link to connect with Server after communication that client will be get latest defintion from SEPM.

How to repair duplicate IDs on cloned Symantec Endpoint Protection 12.1 clients

Either you can use sylink replacer tool to replace the sylink file

The client was imaged using the task sequencer and it didnt have the issue before. The deployed images were getting the updates from the SEPM server.

This particular client was reimaged today and after that only we are seeing this issue.

And in the SEPM, we are seeing 2 entries for the client as seen in the attached snapshot..  one is offline and other in online.

Please advice.

Delete the two entries.

on the client

start - run

smc -stop

wait for few secs

smc -start

open sep interface click on  help and support-> troubleshooting, 

does it show the server name or it shows server offline? 

if its offline, replace the sylink file and check the windowes firewall.

http://www.symantec.com/business/support/index?page=content&id=TECH199124

if the defs are corrupt you can use the intelligent updater, update the defs, monitor if its taking news defs from sepm

http://www.symantec.com/business/support/index?page=content&id=TECH102606

Rafeeq,

Thanks for the steps.  Will check that. :)

Let me ask a doubt..

1. An image (with windows and SEP client installe din it, taken 2 months ago following the Symantec best practices) is being deployed to a new machine.

2. In the SEPm server we have set the number of updates/revisions to keep as 20. So the SEPm server is having the updates for the last 20 days only.

Now when we start the new deployed client, will it take the updates from the live update as the SEPM will not have updates before 2 months and then onwards sync with SEPM?

 Or will SEPm force the latest definition it has on the client?

it depends on your policy in Liveupdate.

in LU policy you can set it to check from Manager only or manager plus LU using internet.

check what you have configured.

If you have configure the policy to get the defintion from SEPM Server then it will be get it from Server.

Check the policy from Server.

Ther is not require the old defintion on server. Server will direct update the latest defintion to clients.

okay.. 

Thank you all for the information We have set to get the updates from both the SEPm server and the internet LU server.

Removed the duplicate client and it got updated now...

Thanks everyone..

Hi

Are those imaged clients

Regards