Contents of ccSubSDK are growing, can not be deleted
search cancel

Contents of ccSubSDK are growing, can not be deleted

book

Article ID: 155680

calendar_today

Updated On:

Products

Endpoint Protection

Issue/Introduction

The content of the ccSubSDK folder are piling up with files. This is the folder where submissions are staged for delivery to Symantec.
 

Default Folder Path:  C:\ProgramData\Symantec\Symantec Endpoint Protection\CurrentVersion\Data\CmnClnt\ccSubSDK

 

Cause


The machine does not have access to the internet, or communication to the internet is broken.

This may also be caused by a rapid increase in submissions due to a threat outbreak or false positive detection.

Ensure the correct proxy settings are set under Proxy Server tab in External Communications section for the specific SEPM group.

 

 

Resolution

This issue is fixed in Symantec Endpoint Protection (SEP) 14.3 RU1. For information on how to obtain the latest build of Symantec Endpoint Protection, see Download the latest version of Symantec software here.

To workaround this issue:

  1. Purge the Folder: Disable Tamper Protection through Symantec Endpoint Protection client, or at the policy level from the Symantec Endpoint Protection Manager (SEPM.) Manually delete the contents of folder.(Re-enable Tamper Protection when finished). 

  2. Check External URLs required for Symantec Endpoint Protection (SEP) and Symantec Endpoint Security (SES).
     
  3. Change the Submissions Policy if there is no internet connection: Open the SEPM > Clients Icon > My Company (or parent policy of machine) > External Communication Settings.
     
  4. Update Policy

Some environments may experience an accumulation of files in the ccSubSDK folder despite an open connection to Symantec submissions URLs. Work around this with other steps above, and/or a Windows folder quota to limit a backlog of submissions. This article will be updated as new information becomes available.