SEP Version: SEP 12.1

We have a server (Windows Server 2012) which has been having issues with updating the AV Definitions.

Ove the past two months we have had to; reinstall SEP, install the Definitions from the SEP site directly and reboot, also run our own full active scan in order to get the most recent definitions installed on the server, we have also ran the SEP Troubleshooting Tool and cleared down previous definitions.

Each time, this only appears to be a temporary fix. It also appears as when we have fixed the issue, the scheduled daily/weekly scan will not run again. I beleive this may be the cause of the issue.

This is not the server which the SEP Management Console is located on and up until the start of June this issue was not present. No other users/servers within the business is experiencing the issue.

Could you please advise, and many thanks for any offerred opinions in order to try and get this issue resolved once and for all.

How do you have the policy configured, to get from SEPM or Symantec LU?

You can post the sylink debug log if getting from SEPM

Also, run the symhelp tool on the PC as it will shopw if defs are corrupt

Symantec Help (SymHelp) Download

http://www.symantec.com/docs/TECH170752

Download the Symantec Help (SymHelp) diagnostic tool to detect Symantec product issues

http://www.symantec.com/docs/TECH170752

Start by checking the windows event viewer from when it stopped taking definitions.

Check if it has constant connection to SEPM  for policies/ updates

Does it have enough space? If you are still not on 12.1.4 , please upgrade and check the behaviour It saves troubleshooting  time.

Could i ask what/how can i check the policies ?

I can confirm that we are on 12.1.4

Try to clean SEP client (Cleanwipe tool) and remove all SEP related folder.

Troubleshooting content update problems

open the livuepdate policy and check if its configured to take updates from SEPM / GUP or go out using internet, if its from sepm then we need to check the event viewer, if its others we need to check connectivity between these, 

I recommend you that first of all you can replace the sylink file after that remove the defintion of that client and will wait for some time to check it going update or not.

How to change the sylink.xml file in Symantec Endpoint Protection (SEP) 12.1

How to clear out definitions for a Symantec Endpoint Protection 12.1 client manually

Incase it not be work then recommend you to run symhelp to find the cause of issue

http://www.symantec.com/docs/TECH170752

Still no resolution as of yet and reboots are continuously being requested.

Could anyone confirm the following:

I have noticed that various scheduled scans are taking 5day+ to run and ALWAYS when the machine is out of date a scan is running. Is there anything related to scans running and machines not updating, as when the scan is complete it appears the issue resolves. But i am guessing that scans shouldnt be taking 5-6 days to comeplete.

Any ideas?

I suggest you can raised support ticket.

Where can i do this?

How to create a new case in MySymantec

http://www.symantec.com/business/support/index?pag...

Phone numbers to contact Tech Support:

Regional Support Telephone Numbers:

    United States: https://support.broadcom.comhttps://support.broadcom.com">https://support.broadcom.com"> (407-357-7600 from outside the United States)
    Australia: 1300 365510 (+61 2 8220 7111 from outside Australia)
    United Kingdom: +44 (0) 870 606 6000

Additional contact numbers: http://www.symantec.com/support/contact_techsupp_s...

Modify to set the schedule to take less time

https://www-secure.symantec.com/connect/articles/sep-121-and-advance-scanning

Adjusting scans to improve computer performance

Also try this one in your case

https://www-secure.symantec.com/connect/forums/understanding-scheduled-scan-options-sepm