Endpoint Protection

I have about 40 or so machines which refuse to upgrade to RU6A.   I have their containers set to upgrade with no schedule, and to not prompt the user.   For example, in California I set this up over the weekend as no one was signed into our California PCs and they were all powered on.

Yet in California, three weeks later, I have clients which simply do not install RU6A while others do.   These clients are pulling a sustained 40Mbps avg over my MPLS frame network.  That's a 3 week average Mbps.  It bursts much higher.  That's crazy.  That doesn't include what the LAN PCs are pulling.    Each device is requesting the exact same 9MB from the SEPM server on port 8014 over and over.  Hundreds of times in an hour.

As I manually connect to each PC and manually install RU6A, I can see the average Mbps drop.  I can see the 9MB file request drop.  I can't tell what the file is.  Wireshark doesn't make this obvious.

What the heck is going on?   What should I do to get this to work?   I have a lot of PCs I can't remote into.  Laptops!

Is there anything in the C:\Program Files\Symantec\Symantec Endpoint Protection\Download\ directory on the clients?  If so, you could try removing whats contained in it (I would be just one seemingly random named file is in it). 

Often what causes the same item to be downloaded repeatedly is a corrupt file or the hard drive is full.

Generally, a full upgrade package size upto 32MB atleast. However, virus delta definitions are around 2-3MB. Full definitions size would be 75MB or higher.

As you mentioned that it is exactly downloading 9MB, it is neither of above options. If it is, then I guess it is not downloading full package.

Do you have any policy enforced for limited download in that particular group of clients?

Have you tried to apply upgrade package where client can see if installation started or not? or if it is rolling back?

Have you tried to adding the upgrade package again to that group?

 

Yes, there is a 9MB file in that folder.   If I remove the install package from the container on the SEPM server, then add it again, it does not resolve the issue.

The client is not even attempting to install the package.   Again, this doesn't affect everyone in the container.  Most of the PCs download and install just fine.

If I move the client into another container, then the update package will download and install.

Something is apparently buggy in the Symantec 11.0.5 code to resume downloading the upgrade package.

What sucks is that this is affecting laptops I have no remote access to.   I guess I need to try creating subcontainers and moving them into those so the container rules still apply correctly.

Try removing the seemingly random (it looks like it is named PKGb....11.0.5002.337 in your case) named file from the C:\Program Files\Symantec\Symantec Endpoint Protection\Download folder.  You may want to back it up first in another location.  Clearing this out should allow the client to download what it needs to complete the upgrade without moving the client into a different group within the SEPM