Endpoint Protection

Scenario: one SEPM11MR5 server working fine. I have four location, in different physical sites, each one with their respective GUP with version SEP11MR5.
Most of the clients are SEP11MR4MP2, some 11MR5, but - i repeat - all the GUP are 11MR5.

After the issue with the 31-dec-2009 definitions, all the server and clients started to get definitions as usual. In the locations, the GUP talks correctly to the SEPM server and then distribute the definitions to the client.
Except one location... and i don't understand why. Can you help me troubleshooting this issue?
I now that the best is to move the entire infrstructure to MR5, but i'm busy wiht other activities and i will do it later, in February - and i don't want to leave client not up to date.

Other info:
- in the location wiht problems,GUP and clients are all in the same subnet
- The GUP server receives from SEPM server definitions in the right way
- looking at client's log, seems that policy is correctly seen from the desktops
- telnet the GUP on port 2967 it's ok
- I tried to move two of this desktops (11MR4MP2) to a sublocation of the "problematic" location, using a specific LU policy telling them to download  to the symantec  live update server and... they are updated!
  Still 11MR4MP2, but with most updated definitions. This confirm that policies are correctly propagated to the clients.

I suspect that the problem resides on GUP... But after two days of tries, i have no idea.. =(
Help...

Whether your RU5 clients are getting updates?
How do you defined GUP ?(single,multiple)
Troubleshooting the Group Update Provider (GUP) in Symantec Endpoint Protection
 

Another strange fact is this - looking at the SEPM console, i see that the "not updated clients" have:

virus definitions 31-12-2009
truscan definitions 20-01-2010
ips definitions 19-01-2010

?

Have you configured a Single GUP or Multiple GUP.

In case its a single GUP try using the multiple option and check whether it helps. You can crate a test group move in 1 or 2 clients and apply the multiple GUP policy and check.

@AravindKM

GUP get updates from SEPM, no problems.
Clients get updates from their location's GUP, still no problem except the faulty location of course.
GUPs are single for each site.

@sandip_sali: this group must contain both clients and GUP or i can leave the GUP in their default locations?

Are you sure that ther has been no change in the Group Policy?

Check that also.

I am using 11.0.5002.333 with 20 GUP.  All are working fine, except for the fact that my 31-12-2009 issue is still pending.  The patch is not getting installed.

Leonard

Leonard, what do you mean with your post regarding policy? What i should check exactly?

Also, the definitions on the GUP might be damaged.
This might be the reason that it hasn't updated.

Try this -
Deleted the LiveUpdate store:
C:\Documents and Settings\All Users\Application Data\Symantec\LiveUpdate\Downloads

Delete the the numbered folders in the following directory:
C:\Program Files\Common Files\Symantec Shared\VirusDefs

Try to to update the the GUP box by using the update command in the SEPM
Clients>Group>Right click on GUP box>Run Command on Client>Update Content

Mike

I have experienced that a restart of the client (GUP) needs to be done, before it updated the date on AV def.

Everything tried yesterday, both the solution from postechgeek and the restart as suggested by Viper5.
No result.

What i'm trying now - i'm moving the client to a group with a LU policy that tell them to update directly from SEPM, just to keep them updated. It's working.
Tomorrow, when all the clients will be updated i'll move them back to the normal group - i mean the faulty one - and then see if they start to speek corectly with their GUP.

I'll let you know if it works.

@ Paglia

That's a good idea. I hope it works for you.

Mike

Can you assign another computer from that group as GUP ? 

Check this out in your SEPM

I have attached a couple of screen shots above, just check it out.

SOLVED! :)

I moved all the pcs and servers of the faulty group to a new group. Maybe ther was a fault with policies - anyway after this change everything ok!