Endpoint Protection

I've just gotten the installers working, but it doesn't seem to have any updates on the clients from the last few days. I ran a manual live update on the SEPM -> and it says:

December 22, 2011 10:26:29 AM EST: LiveUpdate succeeded. [Site: CLASSE] [Server: MS2]
December 22, 2011 10:26:29 AM EST: LUALL.EXE finished running. [Site: CLASSE] [Server: MS2]
December 22, 2011 10:26:29 AM EST: LUALL.EXE successfully updated the content. Return code = 0. [Site: CLASSE] [Server: MS2]
December 22, 2011 10:26:27 AM EST: No updates found for SPC AntiVirus Client Mac 11.0 (English). [Site: CLASSE] [Server: MS2]
December 22, 2011 10:26:27 AM EST: No updates found for Symantec Endpoint Protection Win64 12.1 (English). [Site: CLASSE] [Server: MS2]
December 22, 2011 10:26:27 AM EST: No updates found for Symantec Endpoint Protection Win32 12.1 (English). [Site: CLASSE] [Server: MS2]
December 22, 2011 10:22:34 AM EST: No updates found for SONAR scan engine Win32 11.0. [Site: CLASSE] [Server: MS2]
December 22, 2011 10:22:33 AM EST: Symantec Endpoint Protection Manager could not update TruScan proactive threat scan commercial application list Win32 11.0. [Site: CLASSE] [Server: MS2]
December 22, 2011 10:22:33 AM EST: Symantec Endpoint Protection Manager could not update SONAR scan whitelist Win64 11.0. [Site: CLASSE] [Server: MS2]
December 22, 2011 10:22:33 AM EST: Symantec Endpoint Protection Manager could not update Virus and Spyware definitions Win32 12.1. [Site: CLASSE] [Server: MS2]
December 22, 2011 10:18:42 AM EST: Symantec Endpoint Protection Manager could not update Client Intrusion Detection System signatures 12.1. [Site: CLASSE] [Server: MS2]
December 22, 2011 10:14:48 AM EST: No updates found for SONAR scan engine Win64 11.0. [Site: CLASSE] [Server: MS2]
December 22, 2011 10:14:48 AM EST: No updates found for Submission Control signatures 11.0. [Site: CLASSE] [Server: MS2]
December 22, 2011 10:14:48 AM EST: No updates found for Submission Control signatures 12.1. [Site: CLASSE] [Server: MS2]
December 22, 2011 10:14:48 AM EST: No updates found for SONAR scan data 11.0. [Site: CLASSE] [Server: MS2]
December 22, 2011 10:07:02 AM EST: Symantec Endpoint Protection Manager could not update SONAR scan whitelist Win32 11.0. [Site: CLASSE] [Server: MS2]
December 22, 2011 10:07:02 AM EST: Symantec Endpoint Protection Manager could not update TruScan proactive threat scan commercial application list Win64 11.0. [Site: CLASSE] [Server: MS2]
December 22, 2011 10:07:02 AM EST: No updates found for SONAR scan commercial application engine 11.0. [Site: CLASSE] [Server: MS2]
December 22, 2011 10:02:57 AM EST: No updates found for Symantec Endpoint Protection Manager Content Catalog 12.1. [Site: CLASSE] [Server: MS2]
December 22, 2011 9:53:07 AM EST: LUALL.EXE has been launched. [Site: CLASSE] [Server: MS2]
December 22, 2011 9:53:07 AM EST: Download started. [Site: CLASSE] [Server: MS2]

 

The actual download versions look old too...

Virus and Spyware definitions Win32 12.1    12/18/2011 r9    December 19, 2011 4:34:52 PM EST

Virus and Spyware definitions Win64 12.1    12/19/2011 r35    December 20, 2011 10:43:03 AM EST

etc . . . 

Any ideas?

Hello,

Could you Run a Repair on the Symantec Endpoint Protection Manager and check if that works.

If it does not work, then work on the article provided below:

Symantec Endpoint Protection Manager (SEPM) 12.1 is not updating 32 or 64 bit virus definitions.

http://www.symantec.com/docs/TECH166923

I have done a repair install. I'm trying to follow the instructions on the link, but the first step I can't do as that directory doesn't exist on Server 2008R2 - no C:\Documents And Settings ...

Note: In Server 2008, the Downloads folder in step 1 is located at  %programdata%\Symantec\LIveUpdate\Downloads
 

Note 2: In 64 bit operating system,%commonprogramfiles%\Symantec Shared is located in %programdata%\Symantec

LUALL.exe fails

Installing SEPM Virus Definitions Win32 v12.1 (1 of 1), failed.
LU1825: LiveUpdate could not understand how to install this update. You may need to get the latest version of LiveUpdate before you can install this update.
Installing SEPM CIDS Signatures v12.1 (1 of 2), failed.
LU1825: LiveUpdate could not understand how to install this update. You may need to get the latest version of LiveUpdate before you can install this update.
Installing SEPM CIDS Signatures v12.1 (2 of 2), failed.
LU1825: LiveUpdate could not understand how to install this update. You may need to get the latest version of LiveUpdate before you can install this update.

 

I have v3.3.1.23 ...

Hello,

Work on the Steps provided in the Article:

Disabling UAC seemed to do it, Live Update successfully completed.

 

THANKS!!!

Nope, I was wrong - it completed but the SEPM downloaded updates still showed the old version.

If I wipe and reinstall the Server OS and then install SEPM12.1 -> what happens to the old existing SEP 11.6 clients?

Hi,

in case of reinstall of SEPM, follow the DR steps, this will ensure that certs and DB are restored and client will still be able to connect to the SEPM.

SEP 12- Disaster recovery

http://www.symantec.com/docs/TECH160736

Before reinstall atleast try updating the SEPM with the jdb file.

updating SEPM(server) using jdb ( only AV will be updated)

http://www.symantec.com/business/support/index?page=content&id=TECH102607

Hello,

Could you now try updating the SEPM with .jdb??

Follow the steps below:

http://www.symantec.com/docs/TECH102607

However, answering your Question, If you format the machine, then Install SEPM 12.1, the Existing SEP 11.6 clients would not be reporting to any SEPM till the time you have a new SEPM installed and restored the Database to it.

NOTE: You would not be able to Install SEPM 12.1 with the retore files of SEPM 11.6

However, I personally would recommend you doing this without a proper plan.

Hope that helps!!

I tried the .jdb - waited 15 minutes. The incoming folder was not empty, instead I had a vd372c20.jdb.err file left in it. Not sure what logs to check. This is on a 64 bit server so I grabbed the 64 bit jdb file. Also, I'm wondering - does this need a bunch of disk space? I have 12GB free, but maybe I need to increase the disk?

hi,

clear the temp folder. 12 GB for the system drive seems good. If it does not help, try repair.

Which temp folder? The Windows one?

yea, windows temp folder.

Hey

I have the same problem...

Any idea?

hi all

i have done this: http://www.symantec.com/docs/TECH166923

but after that, the content folder has the same old definitions.

what can i do?

Hello

We have the same probem: SEPM gets the correct definitions from the Symantec LiveUpdate Servers but doesn't deliver any definitions update to any client since 21.12.2011.

Considering that we have 1050 clients connected to management server it's a big problem for us.

Maybe somebody from Symantec will help us ...

LiveUpdate reports same error.  We have ~500 active clients. We recently re-imaged this server to work around some other issues.  The SEPM server before and after the reimage appear to be "stuck" at:
AV = 12/21/2011
NTP = 12/20/2011
PTP = 12/10/2011

SEPM liveupdate says the following:

December 29, 2011 7:26:53 PM EST:  Symantec Endpoint Protection Manager could not update Client Intrusion Detection System signatures 12.1. 
December 29, 2011 7:23:06 PM EST:  No updates found for SONAR scan engine Win64 11.0.
December 29, 2011 7:23:06 PM EST:  No updates found for Submission Control signatures 11.0.
December 29, 2011 7:23:06 PM EST:  No updates found for Submission Control signatures 12.1.
December 29, 2011 7:23:06 PM EST:  No updates found for SONAR scan data 11.0.
December 29, 2011 7:19:17 PM EST:  No updates found for SONAR Heuristics engine 12.1.
December 29, 2011 7:11:45 PM EST:  No updates found for SONAR scan commercial application engine 11.0.
December 29, 2011 7:11:45 PM EST:  Symantec Endpoint Protection Manager could not update Virus and Spyware definitions Win64 12.1.
December 29, 2011 7:11:44 PM EST:  No updates found for Symantec Endpoint Protection Manager Content Catalog 12.1.

Yes, In sepm 12.1 this problem is occured and didnt find any solution till noe....this problem is occured after jan 2012...

Is there any correct solutions plz suggest as soon as possible......

As far as I could tell, there was no solution. In my experiance, you *cannot* upgrade a SEPM install successfully. It hasn't worked for us for v9->10 or 10->11 or 11->12 now. I had to stand up a separate server, install SEPM 12.1 clean and migrate over the clients. Once we've gotten all the stragglers, we'll shut down our old SEPM server.

Hello jmp242,

i had an Customer where 12.1 was installed directly, so no upgrade.

And his pattern are stuck in middle of february.

I will try reinstall liveupdate and other steps above.

Results will be posted here later.

 

We also have a SEPM 12.1, fresh install on w2k8r2, and had the same problem in december 2011, followed this procedure http://www.symantec.com/business/support/index?page=content&id=TECH166923 , it worked for about 3 months, now updates are downloaded but not installed, luall.exe gives this error on all downloads LU1825: LiveUpdate could not understand how to install this update already tried reinstall of liveupdate, forcedupdate of lucatalog etc. still trying (hoping) to resolve this problem

same problem. reinstall liveupdate does not change anything

Hi guys, 

I'm in the same boat. SEPM stopped getting updated with new virus definitions on March 18th. I tried all the above suggestions and none of them worked. SEPM is actually downloading the updates from the Internet but it cannot install them. Tried reinstalling LU, JDB file, SEPM repair, cleanup of virus definitions, no go!

One thing I have noticed is that under the Admin section, under Servers and Local site, the log window shows several "unexpected server error"

I guess the only solution would be to reinstall from scratch using the DR steps provided by pete_4u2002

Either that or place a call with Support...

I had the same problem, for serveral days, and I did try lucatalog -update and it solves the problemas it did en previous SEP 11.xx versions when we had the same situation.

Hope this help !!!

the only thing that worked: restart of all manager services every day.