Endpoint Protection

 View Only
  • 1.  SEPM LiveUpdates Not Working

    Posted Jan 06, 2010 02:23 PM
    So as of 12/31/09 I haven't been able to update Virus Defs 32 or 64 on SEPM.

    Update log shown below:
    January 6, 2010 1:48:35 PM EST:  LiveUpdate succeeded.   [Site: xxxxxx]  [Server: xxxxxx]
    January 6, 2010 1:48:35 PM EST:  LUALL.EXE finished running.  [Site: xxxxxx]  [Server: xxxxxx]
    January 6, 2010 1:48:35 PM EST:  LUALL.EXE successfully updated the content. Return code = 0.  [Site: xxxxxx]  [Server: xxxxxx]
    January 6, 2010 1:48:16 PM EST:  Symantec Endpoint Protection Win64 11.0.5002.333 (English) is up-to-date.    [Site: xxxxxx]  [Server: xxxxxx]
    January 6, 2010 1:48:15 PM EST:  Symantec Endpoint Protection Win64 11.0.4000.2295 (English) failed to update.  [Site: xxxxxx]  [Server: xxxxxx]
    January 6, 2010 1:48:08 PM EST:  Symantec Endpoint Protection Win32 11.0.5002.333 (English) is up-to-date.    [Site: xxxxxx]  [Server: xxxxxx]
    January 6, 2010 1:48:07 PM EST:  Symantec Endpoint Protection Win32 11.0.4000.2295 (English) failed to update.  [Site: xxxxxx]  [Server: xxxxxx]
    January 6, 2010 1:47:45 PM EST:  Intrusion Prevention signatures Win32 11.0 is up-to-date.    [Site: xxxxxx]  [Server: xxxxxx]
    January 6, 2010 1:42:43 PM EST:  LUALL.EXE has been launched.  [Site: xxxxxx]  [Server: xxxxxx]
    January 6, 2010 1:42:43 PM EST:  Download started.  [Site: xxxxxx]  [Server: xxxxxx]

    I already tried the following and it didn't work

    1. Stop SEPM server service.

    2. Go to C:\program files\symantec\symantec endpoint protection manager\Inetpub\content\{C60DC234-65F9-4674-94AE-62158EFCA433}" folder and move all of the subfolders to another place, such as C:\Temp if you want a backup, otherwise delete the sub-folders.

    3) Go to C:\Program Files\Common Files\Symantec Shared\SymcData\ and delete the following folders:
    sesmipsdef32
    sesmipsdef64
    sesmvirdef32
    sesmvirdef64

    4)In the registry, navigate to HKEY_LOCAL_MACHINE\SOFTWARE\Symantec\InstalledApps.
    Delete these keys
    SymcData-sesmipsdef32
    SymcData-sesmipsdef64
    SymcData-sesmvirdef32
    SymcData-sesmvirdef64

    5). In the registry, navigate to and delete the following keys:

    HKEY_LOCAL_MACHINE\SOFTWARE\Symantec\SharedDefs\SymcData-sesmipsdef32
    HKEY_LOCAL_MACHINE\SOFTWARE\Symantec\SharedDefs\SymcData-sesmipsdef64
    HKEY_LOCAL_MACHINE\SOFTWARE\Symantec\SharedDefs\SymcData-sesmvirdef32
    HKEY_LOCAL_MACHINE\SOFTWARE\Symantec\SharedDefs\SymcData-sesmvirdef64

    6). Start the SEPM service back up.

    7). Run Live update from within the Symantec Endpoint Protection Management console.

    Any ideas?




  • 2.  RE: SEPM LiveUpdates Not Working

    Posted Jan 06, 2010 02:28 PM
     Defs are working as advertised..  Look at the revision numbers, they are getting higher, just not the date.  That is the workaround Symantec has implemented.
     This is a bug Symantec is working on.

    If you looked at just the first page of these forums, you would have seen the 10 other threads on this very same issue.

    Symantec will rollout an update for RU5 through liveupdate, older builds will need a patch respective to each MR release.


  • 3.  RE: SEPM LiveUpdates Not Working

    Posted Jan 06, 2010 02:35 PM


  • 4.  RE: SEPM LiveUpdates Not Working

    Posted Jan 06, 2010 02:54 PM
    Yea I just found that article as well. Sorry for the duplicate post.


  • 5.  RE: SEPM LiveUpdates Not Working

    Posted Jan 06, 2010 03:20 PM
    teiva-boy, just to be clear on this - we will patch ALL builds via LiveUpdate, not just RU5.

    The only situation where manual intervention will be required is for a SEPM that doesn't connect to LiveUpdate (on a dark or disconnected site for instance)



  • 6.  RE: SEPM LiveUpdates Not Working

    Posted Jan 06, 2010 04:02 PM
    Any Idea about the Patch Release Date - Max time Frame needed by Symantec


  • 7.  RE: SEPM LiveUpdates Not Working

    Posted Jan 12, 2010 02:50 AM

    I have not seen any change in the scenario, the problem is still lying unresolved i think.

    In my case, the SEPM Machine Client is updated to 11 Jan 2010, five machines in the LAN are updated to 7 Jan 2010 and the rest are still with 31-12-2009.