Endpoint Protection

When I view the client status in SEPM, the virus definition shows the clients are "Not available" even though the clients have already received the latest virus definition and even the policy number.

Did the following:

I have restarted the server . Still the same.

I have deleted one of the clients and waiting for it to re-registered. After re-registry, it still shows " Not available"

This has happened after the clients were upgraded from SEP 12.1.RU6 MP4 to SEP 12.1.RU 6 MP5

Please help...

The support says its a known issue. re-installing the client will fix it. Test on one to confirm first.

Re-installing client on 1000++ is not any easy task.

Please provide us with an alternative methods. Experts need your valuable suggestions.

Doesn't make any sense to reinstall 1000+ clients just to fix the reporting glitch. There should be some alternative convenient method to fix it. 

Go on the client side, bring up the SEP client and go to Help -> Troubleshooting.

Does it show that the client is connected to the SEPM server? It would appear there is no communications between both of them. Has there been any changes to your firewall?

As a test, in SEPM, click on Clients, pick a group, right click and select 'Run a command on the group' -> Update Content.

Once done, give it an hour, then go to Monitors -> Command Status and see if it's successful or not.

Doing an update content only forces client out to liveupdate this doesn't make sense.

I already told you fix is to reinstall. Sorry you don't like answer.

We had public holiday for past 5 days last week. This issue has occured after that. Is it that the downloads are stuck somewhere?

Many clients are actually showing outdated. Even my PC as well. I re-started a couple of times. The policy mentioned on client and server is the same. It has a green dot but the definition date is showing 17th saturday  but it has to show 18th Sunday.

support can go into detail asit is client side issue. we create powershell script to remotely fix the issue and push as we need it.

"We had public holiday for past 5 days last week."

That might be related. I'm assuming all PCs were powered off? If so,make sure all of them are powered on, hopefully by the end of today, they should now be all updated.

Do come back to us if the issue is still the same by the end of tomorrow.

if they were out of date they wouldn't show not available, they would show whatever date it was

as I said known issue

SEP 12.1 RU6 MP6 is due for the release. If support has confimed it's a known issue can upgrade the SEPM after GA.

12.1.6 MP6 was just released. Looks to be fixed in this version:

New fixes and component versions in Symantec Endpoint Protection 12.1.6 MP6

The virus definition date becomes "Unavailable" on SEPM console after the reboot of the SEP client machine

FIX ID: 3747451

Symptom: After your Symantec Endpoint Protection client computers restart, you notice that they report that their virus definition date is “Unavailable.”

Solution: The registry entry for PatternFileSequence is no longer set to zero during the startup of ccSvc

Most of the PC's have been powered on since 18th Sunday. I fixed the issue on my PC by "Repair". But on these 1024 PC's this cannot be done. Even Scan is not running on them because of this?

So how can I repair these clients? Please need suggestions and solutions

Regarding Upgrade. we have Symantec Upgrades every 3-4 months? This is too much of pressure when we need to upgrade 1000's of clients Bu the time one upgrade has been patched on all clients. the next version is released. So this is like a never-ending process.

If there is an upgrade once or twice a year its Ok. Really Weird

In order for Symantec to 'keep up' with the ever fast envolving of viruses, malware, etc spreading and trying to bypass the security software, they need to be kept up to date to keep up with them, hopefully be ahead of the game. I'm afraid this is the fact of life with working in IT department. We use SCCM to manage & deploy clients which makes our jobs easier.

You can also use the auto-upgrade feature within SEPM console, in per group settings which might help you to manage the roll out of new clients.

As someone mentioned, there is a new version released and I'd advise you to give it a try on a few PCs to see if it has resolved the issue you're seeing.

There does seem to be a fix for defintions not reporting correctly in the new sep 12.1 RU6 MP6 released yesterday. 

it's fact of IT life that you need to upgrade frequently. do you patch? that's upgrading and that happens monthly.

All you have to do is reboot one of the computers as a test to see if they are facing the issue that was addressed in the latest build.  A reboot would fix the hang and the client would then be updated.. We have an alternate workaround as well.

Regarding this case we have a workaround in the kb link below.
Symantec Endpoint Protection definitions stop updating
https://support.symantec.com/en_US/article.TECH235075.html

Please reboot the system before upgrading so the service is not hung.

SepMasterService stops and definitions do not update until system is restarted

FIX ID: 3980481

Symptom: The SepMasterService is stuck in a Stopping state, which causes the definitions that the management server hosts for its clients not to update. If you restart the server that runs Symantec Endpoint Protection Manager, then the service runs as expected and definitions start updating.

Solution: Modified code to prevent SepMasterService from shutting down.

You can find the 12.1.6 MP6 build on fileconnect.

The PC have reduced to 270. The decomposer engine was blocked by the whitlesting software. But there are amny online PC's and still out-dated