ManInBlack, You are using the latest build available. Are you running any other security software on these systems?
Are you upgrading from an older Symantec product?

Thomas

No, there are no other products running. They were previously running CA Etrust 8.1 but this was completely removed before installing SEP.

 ManInBlack:
Following up from earlier conversation.
1. do you see on all 25 clients the same behaviour?
2. Did you pushed the client  software packages from SPC and does  all the clients are managed?
3. What do you mean by liveupdate runs every four hours?

Suren:

1.)Probably 75% of the clients exhibit this behaviour.

2.) Yes. They were remote install clients from SPC and are all managed via policies.

3.) I mean the clients check for new virus definitions every 4 hours.