Endpoint Protection

I have an estate that has 7 GUPs on it all the other GUPs seem to work fine and update at a good rate but I have one GUP that seems to be constantly be playing catch up and always seems to be a definition behind. Checked the server and there is enough disk space and memory. Machine has the same network bandwidth as all the others.

GUP client is on 12.1.4013.4013 

SEPM is on 12.1.4104.4130

Anything different in terms of the policy, heartbeat setting, etc?

Did you enable sylink debugging on it?

Did you check the GUPs time zone?

Nope policy on it is also identical nothing different that intially stands out.

GUP time zone is correct same as the SEPM's

How do you mean playing catch up?

Are you saying that the SEP Client itself (that is playing the GUP role) is behind in its defs?  Does this affect any of the clients served by this GUP?

There are known issues around the 12.1RU4 GUP so check if it's being affected by this:

http://www.symantec.com/docs/TECH213461

GUP was in the same group it was providing so was trying to source it's updates from itself and was not going to the SEPM for updates till 3 hours later as SEP in the policy. Moved GUP to it's own group and now is updating as expected. 

Seems when you have the GUP in the same group as the clients it's trying to update it tries to pull updates from itself as a GUP instead of going to the SEPM pulling it's updates and then attempting to supply it to all other machines in that group. 

It is normal behaviour for a SEP Client to attempt to update via itself when acting as a GUP, the question is more why it failed.

In this new group on its own, is it actually still a GUP?  If not, then you may well be affected by the issue I linked.

In this new group it is still acting as a GUP the smc is not failing like in the issue mentioned.