The Symantec Endpoint Protection (SEP) 11.0.6300.803 client downloads the Gup List from the SEPM. Although the file downloads successfully (HTTP status code 200), the client displays an error in the Sylink log which says "CheckSum do not match!"

As a result, the SEP client does not update definitions.

The following error was captured in Sylink logging:

<mfn_MakeGetGupListUrl:>Request is: action=320&hostid=839D8714xxx...
<GetGupList:>http://192.168.0.25:8014/secars/secars.dll?h=F622A4D0xxx...
<GetGupList:>SMS return=200
<ParseHTTPStatusCode:>200=>200 OK
<mfn_DoGetGupList200>Content Lenght => 452
<mfn_DoGetGupList200>Got Gup List from server, read bytes=452
<mfn_DoGetGupList200> CheckSum do not match!
<mfn_DoGetGupList200>Content Size=3547
<mfn_DoGetGupList200>completed
<GetGupList:>RECEIVE STAGE COMPLETED
<GetGupList:>COMPLETED

The Gup List on the SEPM has become corrupted.

Recreate the Gup List using the following steps:

1. Stop the service named Symantec Endpoint Protection Manager
2. Go to: C:\Program Files (x86)\Symantec\Symantec Endpoint Protection Manager\data\outbox\agent\gup
3. Delete globalist.dax
4. Delete globalist.xml
5. Start the service named Symantec Endpoint Protection Manager
6. The GUP list (globalist.xml) will be recreated almost immediately, but it may take some time before it is populated with the IPs of GUPs again.
7. Monitor the SEP clients to confirm they begin updating.