Video Screencast Help

Some of the clients are not updared to version 12.1.2015 (12.1 RU2)

Created: 15 Dec 2012 • Updated: 15 Dec 2012 | 6 comments

SPEM console are successfull updated from version 12.1.1 to 12.1.2015 (12.1 RU2), software packet for update of clients is exported (setup.exe).
On the SPEM console we have groups who containing computers from different branch offices.
Each group (branch office) have group provider located in branch office LAN. Installation packet for new version 12.1 RU2 is on the web server who work on the local group provider. Update proccess is set from SEPM: Cients->Install Packages->Add Client Install Package. "Download source" is set to be - и "Distribute upgrades over" 0 days.

The problem is that some of SEP clients in the groups are not updated to newer version.

We saw that on the computers that have this probem the packet (setup.exe) continuously are downloaded in folder: "C:\Program Files\Symantec\Symantec Endpoint Protection\12.1.1101.401.105\Download\" i.e. the packed is downloaded to full size, after a few seconds the size becomes equal to 0 and download proccess starts again. In Event Viewer log on computers with problem no error messages, no file in %TEMP%\SEP_INST.LOG.
The computers with problem operationg on Windows XP and Windows 7.
At the same time, successfully been upgraded 30-40% from all computers into group (XPs and 7s) and all computers update to last antivirus definitions.

Ask for help.

Comments 6 CommentsJump to latest comment

Mithun Sanghavi's picture


Coud you check if the Temp Folders are empty and there is enough space on these machines.

Secondly ensure these machines are restarted once.

I would still advice to upload us the SEP_Inst.log so that we could have a look at them.

What happens if In the Package Upgrade Settings panel, you select Download from the management server?

I would suggest you to check these Articles as well....

Best practices for upgrading to Symantec Endpoint Protection 12.1.2

Steps to prepare computers to install Symantec Endpoint Protection 12.1 client

Hope that helps!!

Mithun Sanghavi
Associate Security Architect


Don't forget to mark your thread as 'SOLVED' with the answer that best helped you.

ᗺrian's picture

Upload the SEP_INST.log on clients that are not updating.

Also, make sure to restart the affected clients. Perhaps SEP detected a pending restart before it can update.

Please click the "Mark as solution" link at bottom left on the post that best answers your question. This will benefit admins looking for a solution to the same problem.

A. Wesker's picture


Agreed with Mithun & Brian.

The different locations of the files related to SEP installation since 12.1 RU1:

%TEMP% => SEP_INST.log

SIS_INST.log/roru.log can be useful as well if present on the machine (it would depend during which step the install fails: directly in the beginning to run the setup.exe, middle/end to remove previous file or erase existing files, after the LU session if the client install settings is by default, if it roll back or not, etc etc...) to troubleshoot install issues.

Their location for Windows XP machines:

C:\Documents And Settings\Application Data\Symantec\Symantec Endpoint Protection\12.1.XXXX.XXXX\Data\Install\Logs\

Their location for Windows 7/2008/8/2012 machines:

C:\ProgramData\Symantec\Symantec Endpoint Protection\12.1.XXXX.XXXX\Data\Install\Logs\

Kind Regards,

A. Wesker

-JonnS-'s picture

Hello, thanks for answers.
When was started update for SEP clients with new version, computers are restarted.

Old installation package (12.1.1101) is removed from SEP approximately 2 weeks, before is starting update until 12.1.2015.

Free disk space on C should be more than 1.5 GB.

It is not possible to start the update directly from SEPM because it would overload the network to a particular office, or you need to set up a large renovation period >1 month. Hope you find the problem faster. In this way, I started update to others office directly from SEPM (~10 computers) and not have any problems.

In following folders (win7) C:\ProgramData\Symantec\Symantec Endpoint Protection\12.1.1101.401.105\Data\Install\Logs\ contain SIS_INST.LOG with creation date 11.05.2012, i.e. log file with previous updates before version 12.1.1101. C:\Windows\Temp\ contains SEP_INST.LOG from 05.11.2011 -> log file since before two versions. The same situation with winXP : C:\Documents and Settings\All Users\Application Data\Symantec\Symantec Endpoint Protection\12.1.1101.401.105\Data\Install\Logs contains SIS_INST.LOG with creation date 21.06.2012, and  C:\Windows\Temp\SEP_INST.LOG with creation date 21.06.2012. Several computers are checked from different group providers – there are missing a new log files. In same time file SIS_INST.LOG is locked from an application (can’t be deleted or renamed). The same situation with 4-5 computers checked from different group providers and different OS (win7 and winXP).

I ran some tests: a new SEPM package was created, for one group update was stopped on SEPM, a new package was placed for corresponding group provider and run an updates again. The problem computers, began to continuously download a new generated package (setup.exe).
What other can I check?

Mithun Sanghavi's picture


Appreciate you letting other's know what steps assisted in your case.

Mithun Sanghavi
Associate Security Architect


Don't forget to mark your thread as 'SOLVED' with the answer that best helped you.