Have you checked this?

Unexpected, frequent LiveUpdate sessions launch on SEP for Macintosh client

http://www.symantec.com/business/support/index?page=content&id=TECH144410&actp=search&viewlocale=en_US&searchid=1294639035747

Hi Joseph,

With a few extra details in hand, I am sure that community memebers can swiftly provide steps to resolve this.

Which Symantec product and version are you using?

Are the clients managed (by a SEPM, for instance) or unmanaged (stand-alone)?

Also, how do the clients update: do they go to the Internet or to an internal LiveUpdate Administrator 2.x server?

Thanks and best regards,

Mick

When the client machine is turned on, the SEP client tries to contact the SEPM or the LUA, GUP depending on how it is configured. The communication method also plays a vital role when the live update starts. If the clients are managed then try configuring the Live update policy and check for the configured schedule.

Joseph,

If your clients are standalone, then the tech article listed in twilight123's post would explain what's going on.

If your clients are managed, LiveUpdate policy sets a schedule for off hours (i.e. the evening), and people log off of their machines (or shut them down), it will run as a missed event the next morning. LiveUpdate cannot run on a Mac if no one is logged in. This is due to a security requirement of the OS that no program capable of launching a window can run if no one is logged in. (Obviously, it cannot at all run if the machine is turned off. )

Sandip, that is a Windows screenshot; it will not help on a Mac.  The schedules configured by the SEPM can be viewed via Terminal by entering "sudo symsched -l" (then authenticate when prompted).

sandra