Endpoint Protection

SPEM console are successfull updated from version 12.1.1 to 12.1.2015 (12.1 RU2), software packet for update of clients is exported (setup.exe).
On the SPEM console we have groups who containing computers from different branch offices.
Each group (branch office) have group provider located in branch office LAN. Installation packet for new version 12.1 RU2 is on the web server who work on the local group provider. Update proccess is set from SEPM: Cients->Install Packages->Add Client Install Package. "Download source" is set to be - http://provider.domain.com/sep/setup.exe и "Distribute upgrades over" 0 days.

The problem is that some of SEP clients in the groups are not updated to newer version.

We saw that on the computers that have this probem the packet (setup.exe) continuously are downloaded in folder: "C:\Program Files\Symantec\Symantec Endpoint Protection\12.1.1101.401.105\Download\" i.e. the packed is downloaded to full size, after a few seconds the size becomes equal to 0 and download proccess starts again. In Event Viewer log on computers with problem no error messages, no file in %TEMP%\SEP_INST.LOG.
The computers with problem operationg on Windows XP and Windows 7.
At the same time, successfully been upgraded 30-40% from all computers into group (XPs and 7s) and all computers update to last antivirus definitions.

Ask for help.

Hello,

Coud you check if the Temp Folders are empty and there is enough space on these machines.

Secondly ensure these machines are restarted once.

I would still advice to upload us the SEP_Inst.log so that we could have a look at them.

What happens if In the Package Upgrade Settings panel, you select Download from the management server?

I would suggest you to check these Articles as well....

Best practices for upgrading to Symantec Endpoint Protection 12.1.2

http://www.symantec.com/docs/TECH163700

Steps to prepare computers to install Symantec Endpoint Protection 12.1 client

http://www.symantec.com/docs/TECH163112

Hope that helps!!

Upload the SEP_INST.log on clients that are not updating.

Also, make sure to restart the affected clients. Perhaps SEP detected a pending restart before it can update.

Hi,

Agreed with Mithun & Brian.

The different locations of the files related to SEP installation since 12.1 RU1:

%TEMP% => SEP_INST.log

SIS_INST.log/roru.log can be useful as well if present on the machine (it would depend during which step the install fails: directly in the beginning to run the setup.exe, middle/end to remove previous file or erase existing files, after the LU session if the client install settings is by default, if it roll back or not, etc etc...) to troubleshoot install issues.

Their location for Windows XP machines:

C:\Documents And Settings\Application Data\Symantec\Symantec Endpoint Protection\12.1.XXXX.XXXX\Data\Install\Logs\

Their location for Windows 7/2008/8/2012 machines:

C:\ProgramData\Symantec\Symantec Endpoint Protection\12.1.XXXX.XXXX\Data\Install\Logs\

Kind Regards,

A. Wesker

Hello, thanks for answers.
When was started update for SEP clients with new version, computers are restarted.

Old installation package (12.1.1101) is removed from SEP approximately 2 weeks, before is starting update until 12.1.2015.

Free disk space on C should be more than 1.5 GB.

It is not possible to start the update directly from SEPM because it would overload the network to a particular office, or you need to set up a large renovation period >1 month. Hope you find the problem faster. In this way, I started update to others office directly from SEPM (~10 computers) and not have any problems.

In following folders (win7) C:\ProgramData\Symantec\Symantec Endpoint Protection\12.1.1101.401.105\Data\Install\Logs\ contain SIS_INST.LOG with creation date 11.05.2012, i.e. log file with previous updates before version 12.1.1101. C:\Windows\Temp\ contains SEP_INST.LOG from 05.11.2011 -> log file since before two versions. The same situation with winXP : C:\Documents and Settings\All Users\Application Data\Symantec\Symantec Endpoint Protection\12.1.1101.401.105\Data\Install\Logs contains SIS_INST.LOG with creation date 21.06.2012, and  C:\Windows\Temp\SEP_INST.LOG with creation date 21.06.2012. Several computers are checked from different group providers – there are missing a new log files. In same time file SIS_INST.LOG is locked from an application (can’t be deleted or renamed). The same situation with 4-5 computers checked from different group providers and different OS (win7 and winXP).

I ran some tests: a new SEPM package was created, for one group update was stopped on SEPM, a new package was placed for corresponding group provider and run an updates again. The problem computers, began to continuously download a new generated package (setup.exe).
What other can I check?

Hi, JonnS

https://www-secure.symantec.com/connect/forums/sepm-1212-not-upgrading-clients#comment-8130501

In my case it helped

Hello,

Appreciate you letting other's know what steps assisted in your case.