Endpoint Protection

hi
i install the symantec endpoint protection 11 mr4 sp1 in network without internet connection.
i want to update my def on the server manually.
i download the jdb file from the site and upload it to :
c:\program files\symantec\symantec endpoint protection manager\data\inbox\content\incoming\
the server is not processing the file and thr is stiil in the directory.
i have an old server with endpoint protection 11 mr2 and there it work perfectly.
i need some advise for this....
i try to do anything even to repair the installition and stiil have the same problem.
any ideas.....
tnx
koby
 

Is this a 64 bit server?

tnx for the replay/
its a 32 bit platform

Do you have on windows firewall enabled ? If yes, check if there is listed the symantec endpoint protection.

Yo should use Live update feature of SEP. I think it consumes less bandwidth then downloading the jdb file manually every time.Am I right ? can any symantec guy confirm  this .

Can you verify the permissions on the incoming directory?
Also does restarting the SEPM service make no difference?

I have been having this same issue under similar circumstances:
SEP 11 MR4 SP1a on workgroup w/1 server (32 bit OS) and 15 clients and no internet connectivity.

After the initial installation of the manager and the clients, I was able to upload a .jdb file, which processed normally and all the clients got that first upload.  Subsequently, it was necessary to shutdown and physically move the server to another location.  Since bringing it back up, the .jdb file is not processing and just sits in the ...incoming folder.  The clients are all still connected and reporting their status to the manager. Restarting the SEPM service makes no difference.  Permissions on the directory are Everyone, Full Control.  When I check the log, the following is repeated about every 10 seconds:
Apr 08 09, 04:22:11 AM INFO(High)  SesmLu: ***************************************************************************************************************

Apr 08 09, 04:22:11 AM INFO(High)  SesmLu: ****                                Starting New SesmLu Session                                            ****

Apr 08 09, 04:22:11 AM INFO(High)  SesmLu: **** Platform: Microsoft Windows Server 2003

Apr 08 09, 04:22:11 AM INFO(High)  SesmLu: **** SesmLu Version: 11.0.4014.26

Apr 08 09, 04:22:11 AM INFO(High)  SesmLu: ***************************************************************************************************************

Apr 08 09, 04:22:11 AM INFO(Med)  SesmContentCatalog: Entered Init().

Apr 08 09, 04:22:11 AM INFO(Low)  ProductUtil: Data root = C:\Program Files\Symantec\Symantec Endpoint Protection Manager\data

Apr 08 09, 04:22:11 AM ERROR  SesmLu: CoCreateInstance failed to create an IluProductReg instance: (-2147024770) The specified module could not be found.

 at .\SesmLu.cpp[633]

Apr 08 09, 04:22:11 AM ERROR  SesmLu: Unitilizing COM. at .\SesmLu.cpp[634]

Apr 08 09, 04:22:11 AM ERROR  SesmLu: Failed to initialize COM. Aborting. at .\SesmLu.cpp[130]

Apr 08 09, 04:22:11 AM ERROR  SesmLu: Failed to initialize SesmLu. Aborting. at .\SesmLu.cpp[292]

Apr 08 09, 04:22:11 AM INFO(Med)  SesmContentCatalog: Entered Init().

Apr 08 09, 04:22:11 AM ERROR  SesmLu: Failed to initialize COM. Aborting. at .\SesmLu.cpp[130]

Apr 08 09, 04:22:11 AM ERROR  SesmLu: Failed to initialize SesmLu. Aborting. at .\SesmLu.cpp[292]

Any help with this is greatly appreciated.

Try to Re-Register the SEPM with Liveudpate

"C:\Program Files\Symantec\Symantec Endpoint Protection Manager\bin\LuCatalog.exe" -cleanup

"C:\Program Files\Symantec\Symantec Endpoint Protection Manager\bin\LuCatalog.exe" -update

I tried running the suggested commands, but there seems to be no difference.  Do you know which log may have captured any errors from the LuCatalog commands?  Any other ideas?

I found the log for LuCatalog.  Both commands seem to do the same thing.  I did not see any errors and both commands finished with the line:
Apr 09 09, 08:59:38 AM INFO(High)  LuCatalog: Finished LU Catalog update.

Hi,

I also facing the same but after stopping all the services of Symantec and copy the JDB file to incoming folder my SEPM get updated.

Then after you have to start your services I missed the point to mention.

Hi

Please do the following activities

1) Delete all temp folders.
2) Run RXDEF Tool

SAMEER

sorry Sameer, but what is or when I can find RXDEF tool ?

 It a tool which removes the old definitons. You will need to contact tech support to get the tool.

thanks Saeed

Did that RxDefs.exe really worked for u????

Try this & let me know if it works

1.) Unzip the .jdb file to C:\vd2c6a03 (for example)
2.) Start command line and input this command:

"C:\Program Files\Symantec\Symantec Endpoint Protection Manager\bin\sesmcontinst.exe" -src c:\vd2c6a03

3.) Check if Symantec Endpoint Protection Manager has been updated correctly

If you have still the same issue Clear corrupted definitions using this KB:

Symantec Endpoint Protection Manager 11.x is not updating 32 or 64 bit virus definitions.
http://service1.symantec.com/SUPPORT/ent-security.nsf/docid/2008041516215948

<Apr 08 09, 04:22:11 AM ERROR SesmLu: Failed to initialize SesmLu. Aborting. at .\SesmLu.cpp[292]>

This indicates a problem with the Live Update

Try reinstalling Live Update and then update the definitions with the Intelligent Updater (.JDB)

HI have you tried to rename the file that you downloaded? because by default it will not automatically .jdb you need to manually changed extension name to .jdb and upload it to the same path that you mentioned.

What your seeing is an LU registration error code

to resolve this uninstall Live update, ensure that the two following directories are removed, if they still exist please delete them.

 C:\Documents and Settings\All Users\Application Data\Symantec\LiveUpdate

 C:\Program Files\Symantec\LiveUpdate

Install via this link (LUSETUP version 3.3)
ftp://ftp.symantec.com/public/english_us_canada/liveupdate/3.3.0/LUSETUP.EXE

Once Live update is re-installed run this command from within a comand prompt

cd c:\Program Files\Symantec\Symantec Endpoint Protection Manager\bin

lucatalog.exe –update

Once this is complete please type luall.exe from within a run dialogue box and hit enter.

Live update will need some time to get all of the available updates.

Hope this helps.