Hello,

I have a customer with 2000+ SEP 12.1 RU1 MP1 (12.1.1101.401) clients.

Last Friday this error appears on +/- 280 systems: 

"File System Auto-Protect is not functioning correctly. Your protection definitions may be damaged or your product installation may be corrupt."

The systems affected run different versions of Windows. Mostly XP, but also different Windows Server versions and Windows 7 boxes.

This problem can be fixed by running a "repair" of the Client.

However: knowing the fix is one thing, but what I realy want to know why this can suddenly happen on multiple systems at the same time.

Thanks for your input.

This problem is occur due to defintion file corruption. Kindly find the below link. It will help to clear the corrupted defintion

How to clear out definitions for a Symantec Endpoint Protection 12.1 client manually

http://www.symantec.com/docs/HOWTO59193

Check it

File System Auto-Protect is malfunctioning

Thanks for your comment Manish.

If the problem is related to definition file corruption, then I would still like to know why this sort of thing can happen on multiple boxes at the same time, and why this gets resolved by running a "repair" of the SEP Client in Add/Remove Programs. Does the "repair" action also includes a repair or re-download of the latest definition files?

Does this happen after you run any windows update patch?

hello,

After repair sep all services will be restart and client again goes to connect sepm console so may it's searching defination.Symantec artical also indicate for corrupted defination.

Check Symantec KB TECH102962 already provided Mr Admin_SEPM

I was thinking about this as well since it happened on multiple systems on the very same day, so this could very well be the case. Maybe someone on this group experienced the same issue after applying a recent Windows patch/update 

Can you check on these machines if any and if yes what updates were installed last time? Does the time of installation covers the first time autoprotect went down?

Hi

Can you please let me know whether your SEPM is updated with latest definition ?

Regards

Try to clean the defintion on ser ver and check it may be your issue resolve

https://www-secure.symantec.com/connect/articles/how-clear-corrupt-virus-definitions-sepm

Article URL http://www.symantec.com/docs/TECH166923

Are all of these systems located in the same region? I know a possible cause of corruption could be a network connection drop between the systems updating and the system that gives the updates to the clients. Do the clients update from a local GUP or from a remote SEPM?

How to determine if virus definitions of Symantec Endpoint Protection client (SEP) 11 or 12 Small Business Edition, are corrupted

Potential Symantec Endpoint Protection content definition corruption

Thanks for the info, I'll have a look at the articles you've provided.

The systems are located all over the world, reporting to different SEPM Servers. We don't use GUP's.

Latest report shows 100+ additional systems with Auto-Protect issues

Hi, I've noticed something:

All impacted systems have the same:

• Pattern Date: 1/01/1970
• Revision: 0
• Insert Date: 8/11/2011 13:30
• Last Scan Time: 1/01/1970 0.00
• Last Virus Time: 1/01/1970 0.00

But they do communicate with SEPM because their "Last time status changed" and "Last download time" does vary and looks more realistic.

I've attached a screenshot.

Thanks for all the replies so far! Really appreciate it.

Yes, it is.

Hi,

Auto-Protect issues appeared in last Friday's report (26/4).

I've attached a screenshot in this thread which shows that there was activity after this date (last download time)

Hi

Please upgrade to latest version SEP 12.1.2 MP1

Regards