I am using version 11.04, I have several users who are not receiving the Proactive Threat Protection update.  Briefly searching through the management console I see that some users have not received any updates

For  the  computers that  have  not  received  any  updates, see if they have  green dot on them, and  also see the  last check in time, from the SEPM.

For those  that  do not have  only  PTP updated, note that, if   they  are  Server Operating systems, PTP is not compatible  with server OS.

If they  are  clients, and  are  communicating   with SEPM , have   AV/AS defs updated, but  still  PTP is outdated, it's  better that, you  upgrade  them to  RU6a

The Pcs which are not geeing updated belongs to same GROUP/gup?

They do have the green dot, and the hosts that do not have the ptp do not have sever operating systems.  Just a handful of computers that never received any update definitions.

is it possible to update certain clients to ru6a?

Yes, they all belong to the same group. computers that do not have the ptp have never been in contact to download any definitions.  Just a small handful of computers

Hi,

Did u try by replacing sylink.xml ?

Please export new sylink.xml from SEPM and try.

To export sylink.xml, Logon to SEPM console --> Select Clients tab--> Right click on my company --> Select export communication settings ..> Export file as a Sylink.xml 

should I try replacing the sylink.xml even though it has a green dot?

Repair   them from add/renmove  programs, if they are  only  a few  computers

vkalani, are you suggesting an uninstall install?  thanks for all the replies

No, I am not  suggesting  uninstall/re-install...just  repair it...

You should consider upgrading to the latest version of SEP, RU6 MP2:

Proactive Threat Protection (PTP) definitions fail to update on some managed clients

http://www.symantec.com/business/support/index?page=content&id=TECH134047&actp=search&viewlocale=en_US&searchid=1296828881992

Wildcat,

Remote into one of the clients and try to force it to update itself via the start>run>cmd>luall.exe

Watch to see if it is successful. As they are all in the same group, you might be having some network trouble, especially if they used to work and now dont, and you arent the type to be messing around in your console a lot. 

If they are unsuccessful, check to see if networking changed the NAT type on the routers.

Re-installing the clients shouldn't be necessary, and if the sylink.xml were wrong, as the other guy suggested, then I would think that all contact would fail due to having the wrong encryption key. 

Hi,

Yes you can try, once replaced Sylink make sure SEPM and SEP client have same policy serial number.

To check policy number on SEPM

Logon to SEPM console --> Click on Clients--> Select group in which client is present --> Right hand side of the screen there is view tab--> Click on drop down and select client status --> you will see policy serial number 

To check policy number on client 

Open SEP client --> Click on Help and Support tab --> Click on troubleshooting --> you will see policy serial number

thanks a lot will try the suggestions and report back

A uninstall reinstall worked, the update of luall.exe did not  I am going to try these solutions:

Some possible workarounds that have been found to work in some customer environents are:

• (HKLM\Software\Symantec\Symantec Endpoint Protection\LiveUpdate\SyknappsContentListReady) to 1
• Uninstall and reinstall affected SEP clients
•  Configure affected SEP clients to update their definitions via an internal LiveUpdate server or the Public LiveUpdate servers.

I also received the error code:

truscan has generated an error code 11: description whitelist failure

Hi,

After uninstall and reinstall PTP updated ? if not;

Use SEP support tool and run power eraser, there can be virus infection possibility. We should consider all the possibilities.

Just for safer side run it on one client & check.

To download SEP support tool use following link.

http://www.symantec.com/business/support/index?page=content&id=TECH105414

Symantec Endpoint Protection error: PTS (or TruScan) has generated an error: code 11: description: Whitelist Failure

http://www.symantec.com/business/support/index?page=content&id=TECH103825&actp=search&viewlocale=en_US&searchid=1296836205891

Brian81, the documentation is not accurate for windows 7 64 bit.  I was able to navigate to the certain files in different folders but it did not fix the issue. 

After the uninstall and the reinstall PTP was active but out dated, after about an hour it turned off as it is still waiting for the updates.

I think, you  must  install atleast, ru6a version, as I mentioned in my  first  comment, for  this  post

It's not updated to show Win7 64-bit paths but have a look at this:

Proactive Threat Protection is not enabled or is waiting for update

http://www.symantec.com/business/support/index?page=content&id=TECH95919&actp=search&viewlocale=en_US&searchid=1296839632420

I would upgrade to the latest version though, at least from personal experience. I've had a few of these and upgrading fixed it.

thanks a lot working on upgrading now

If you're on 11.0.4, make sure you first upgrade to RU6a then upgrade to RU6 MP2. A direct upgrade from 11.0.4 to RU6 MP2 is not supported nor recommended.

Release Update 6 Maintenance Patch 2 (RU6 MP2)

What's new in this version

The current release includes the following improvements that make Symantec Endpoint Protection and Symantec Network Access Control easier and more efficient to use. This maintenance patch cannot be installed over any versions of Symantec Endpoint Protection or Symantec Endpoint Protection Manager prior to RU6. It must be installed over RU6, RU6a, or RU6-MP1.

http://www.symantec.com/business/support/index?page=content&id=TECH103087&actp=search&viewlocale=en_US&searchid=1296840560345

i need clarification, the manager is on version 11.04  and the clients are on 11.05  Both need to be on the same version I am assuming. 

i am getting ready to download this build

before I do I wan tto verify that both manager and cluent have to be on the same version.  thank you

It is always recommended to have both the SEPM and SEP clients on the same version, although it is possible for the SEPM to manage older or newer clients.

If I was doing it, I would first upgrade them SEPM to RU6 or RU6a. If RU6 or RU6a is not available on FileConnect then you can call support and they will set you up with a way to download it.

Once the SEPM is upgraded to RU6 or RU6a, upgrade the clients to the same version you upgraded the SEPM to. Then you can upgrade the SEPM to RU6 MP2 with the clients to follow.

migrating to mp2 has corrected the issue, thanks for all the input and help much appreciated

Don't forget to mark the post solved for whichever one helped as it is useful for future visitors :)