Hello,
Is that SEP 12.1 RU3 unmanaged client going to the interenet LiveUpdate servers to look for its updates, OR is it configured to look in an internal source? (Perhaps a LiveUpdate Administrator 2.x server on your network?)
Examining the log.lue will reveal more details about where it is looking.
Could you check what version of Liveupdate are you running on the machine?
http://www.symantec.com/docs/TECH181305
Try these Articles below:
How to clear out definitions for a Symantec Endpoint Protection 12.1 client manually
http://www.symantec.com/docs/HOWTO59193
How to update definitions for Symantec Endpoint Protection using the Intelligent Updater
http://www.symantec.com/docs/TECH102606
Again, SONAR and IPS Intelligent updater (IU) are now available on :
http://www.symantec.com/security_response/definitions.jsp
NOTE: These SONAR and IPS Intelligent updater are only for SEP 12.1 RU3.
Hope that helps!!