search cancel

Configuring the number of content revisions kept by the Symantec Endpoint Protection client


Article ID: 151409


Updated On:


Endpoint Protection


How can the number of content revisions stored on the Symantec Endpoint Protection (SEP) client be configured?



SEP 12.1

In SEP 12.1, IPS content will cache 3 revisions and other content types will have 1 revision only.  The number of revisions cannot be configured for SEP 12.1.


SEP 11.x

The default number of content revisions kept by a SEP 11.x client is 3 revisions per content type and the number of revisions can be customized.  Symantec recommends maintaining the default content revisions of 3 to ensure acceptable performance, stability and security of the SEP client.  SEP clients keep multiple revisions of content to allow the client to quickly roll back, or remediate content.

Note: In certain instances a SEP client may keep more than the minimum number of revisions of a particular type of content. This can occur when different content revisions are being used by multiple Symantec products, when a client is currently processing a content update, or the client is in the process of remediating definitions, or has failed to remediate definitions.


To configure the minimum number of content revisions in SEP 11.x:

  1. Ensure the following registry DWORD exists:
    HKEY_LOCAL_MACHINE\Software\Symantec\Symantec Endpoint Protection\Content\{<moniker>}
  2. Modify the registry value to correspond to the number of revisions required.
  3. These settings will take effect the next time that content type is updated on the system.

The <moniker> key for 32-bit AV definitions is "{C60DC234-65F9-4674-94AE-62158EFCA433}".
For 64-bit use "{1CD85198-26C6-4bac-8C72-5D34B025DE35}".


Note: The registry DWORD was named CacheEntries prior to SEP 11.0 Maintenance Release 2 (MR2).