Definition updates add entries to "PendingFileRenameOperations" registry key on a frequent basis


Article ID: 155981


Updated On:


Endpoint Protection


On a regular basis, virus definition files for Symantec Endpoint Protection are added to the "PendingFileRenameOperations" registry key.  Is this expected behavior?

Registry key: HKLM\SYSTEM\ControlSet001\Control\Session Manager\PendingFileRenameOperations

Key's value data: \??\C:\ProgramData\Symantec\Symantec Endpoint Protection\12.1.1000.157.105\Data\Definitions\IPSDefs\20120131.002\IDSxpx86.dll


Definition files are being replaced; old definition files are not removed until after reboot.


The issue has been fixed in SEP 12.1 RU2. 

You can obtain a copy of SEP 12.1 RU2 at the following location:

The following are some helpful links to documentation regarding this new release:

 Obtaining the latest version of Endpoint Protection or Network Access Control

 Upgrading or migrating to Symantec Endpoint Protection 12.1.2011 (RU2)

 What's new in Symantec Endpoint Protection 12.1.2

Release Notes and System Requirements for all versions of Symantec Endpoint Protection and Symantec Network Access Control

New fixes and enhancements in Symantec Endpoint Protection 12.1 Release Update 2

Applies To

Windows 7

Windows XP
Windows Server 2008 R2
32- and 64-bit
Symantec Endpoint Protection 12.1 RU1