Endpoint Protection

"Disk space management for downloads"

I have it set to "Number of content revisions to keep" = 10

Do you have a lot of clients that are mobile? It's only about 3 days of revisions so clients that are out of date longer than 3 days will download a full def instead of a delta.

About 21 users are virtual.

This is more for space on the SEPM not necessarily bandwidth.

Assuming you have users configured to get updated from Symantec LU when off network, they should still be able to get deltas instead of full.

Figure 3 content revisions per day, so it's only about 3.1 days worth. I believe Syamntec recommends 30 revisions kept but it varies on your environment.

The below article suggests 42 revisiosn is "not uncommon"

http://www.symantec.com/docs/TECH92051

What's right for you though, is very subjective.  More revisions means more disk space is used, but it does mean that deltas can be provided for clients running older versions of defs.

The question is: if you have a high enough number of machines requesting the full fat defs (i.e. currently for you, those with defs older than 3 days) that providing deltas insteadv would result in a significant bandwidth saving?

If you only encounter machines once in a blue moon with defs older than 3 days, then you're probably fine as you are.  However, if you have loads of machines with defs older than 3 days (each pulling down the full defs and causing bandwidth issues) then you'd benefit from increasing the number of revisions retained (thereby allowing the SEPM to provide smaller, delta def updates, at the cost of more disk space being used on the SEPM).

I love both of these answers, I have requested a split solution for both of you. Thank you for the clear and very detailed information.

Glad to lend a hand amigo