Endpoint Protection

Hi All , i have a issue with the IPS definitions that are not updated.

We have migrated from 14.0 to 14.2 and clients to 3332.

All clients are affected? Download the IPS Intelligent Updater and install it on an affected client to see if it fixes it:

https://www.symantec.com/security_response/definitions/download/detail.jsp?gid=ips

Otherwise, download and run SymDiag on an affected system to do error checking.

900 computers not updating , i think is related to version mismach between SEPM and clients

Depends. Newest SEPM should be able to manage all versions of the client. I'd start with SymDiag then and see what it shows.

I have the exact same thing. The upgrade went very well and I did that last month. This morning I have about 700 out of 5000 reporting that IPS definitions are out of date. No changes whatsoever where done in the environment.

I have the same issue, upgraded to 14.2 from 14.0 and clients to 14.2.335.1000, and were now showing over 800 machines of 1700 that are reporting that the IPS definitions are out of date (virus defs are correctly updating however). 

Updating a machines IPS definitions manually works, but obviously its not practical to update all in this way.  No other changes have been made in the environment.

Sounds like people need to get cases opened up so Symantec can gather and review logs for this.

This was the closest I could find in their KB section:

https://support.symantec.com/content/unifiedweb/us/en/article.TECH255124.html

...but it may not apply here. Regardless, logs will need to be reviewed as it sounds like an issue between SEPM and client only.

Same here. I upgraded SEPM from 14.2 MP1 to 14.2 RU1. IPS definitions not updating. 

Has anyone engaged support on this?

I am on the phone for last 15 minutes and waiting for the support to pick up my call. It is frustrating.

Endpoint Protection 14.2 RU1 clients do not update IPS definitions when Endpoint Protection Manager 14.2 RU1 is updated using JDB

https://support.symantec.com/us/en/article.TECH254691.html

Yes, I do use JDB file to update IPS definitions in SEPM. I don't think they have a fix for it. It is crazy how Symantec want us to update each client individuallly using the intelligent update tool. PLEASE FIX THIS ASAP.

If anyone from Symantec is watching this thread, here is the escalation# ESCRT-1546 or CONTENG-9060 from symantec support to their engineering department. It has been more than a month and no fix yet. I am ready to ditch this product.