Some LiveUpdate Administrator 2.x Servers Fail to Provide Symantec Endpoint Protection 12.1 RU2 Definitions

book

Article ID: 157526

calendar_today

Updated On:

Products

Endpoint Protection

Issue/Introduction

A Symantec Endpoint Protection Manager (SEPM) or Symantec Endpoint Protection (SEP) client is running version 12.1 RU2 and updates exclusively from an internal LiveUpdate Administrator 2.x server.  This LUA server has been configured for several months to download and make available "Symantec Endpoint Protection 12.1 RU2" materials.  Now it is noticed that the affected SEPMs and SEP clients cannot bring their AntiVirus definitions up-to-date.  The log.liveupdate or log.lue indicates that no newer files are available, but the LUA event log confirms that new Symantec Endpoint Protection 12.1 RU2 contents are successfully downloaded and distributed daily.

Note: other LUA 2.x servers in the organization are able to download SEP 12.1 RU2 definitions.  This issue does not affect all LUA 2.x servers. 

 

 

The SEPM log.liveupdate contains among its entries:

 

[date][time] -> Check for updates to:  Product: SEPM Virus Definitions Win32 12.1 RU2 H, Version: MicroDefsB.CurDefs, Language: SymAllLanguages.  Mini-TRI file name: sepm$20virus$20definitions$20win32$2012.1$20ru2$20h_microdefsb.curdefs_symalllanguages_livetri.zip

[date][time] -> Check for updates to:  Product: SEPM Virus Definitions Win64 (x64) 12.1 RU2 H, Version: MicroDefsB.CurDefs, Language: SymAllLanguages.  Mini-TRI file name: sepm$20virus$20definitions$20win64$20$28x64$29$2012.1$20ru2$20h_microdefsb.curdefs_symalllanguages_livetri.zip

[date][time] -> Check for updates to:  Product: SEPM Virus Definitions Win32 12.1 RU2 H, Version: MicroDefsB.Error, Language: SymAllLanguages.  Mini-TRI file name: sepm$20virus$20definitions$20win32$2012.1$20ru2$20h_microdefsb.error_symalllanguages_livetri.zip

[date][time] -> Check for updates to:  Product: SEPM Virus Definitions Win64 (x64) 12.1 RU2 H, Version: MicroDefsB.Jul, Language: SymAllLanguages.  Mini-TRI file name: sepm$20virus$20definitions$20win64$20$28x64$29$2012.1$20ru2$20h_microdefsb.jul_symalllanguages_livetri.zip

 

Each SEPM LiveUpdate session ends with a report that no newer definitions are available.

 

SEP 12.1 RU2 clients log.lue entries will likewise show if they are requesting H or non-H content:

 

Component: Moniker: {6AAE5D6B-C70C-4cdf-96C9-110AA1378E8C}, P: SEPC Virus Definitions Win32 12.1 RU2 H, V: Hub, L: SymAllLanguages.
Component: Moniker: {535CB6A4-441F-4e8a-A897-804CD859100E}, P: SEPC Virus Definitions Win32 12.1 RU2 H, V: MicroDefsB.CurDefs, L: SymAllLanguages.

 

 

 

Cause

Due to an old Symantec Product catalog on the LUA 2.x server, the affected LUA servers downloading beta files instead of the current "SEP 12.1 RU2 H" files.

 

Resolution

This condition may be corrected by clicking "Update Symantec Product Catalog" from the LUA 2.x server's "My Symantec Products" page.

 

The following changes occur when the SPC is updated:

  1. The old "Symantec Endpoint Protection 12.1 RU2" becomes renamed "Symantec Endpoint Protection 12.1 RU2 (Beta)". This beta product does not have the current H version of definitions.
  2. A new product "Symantec Endpoint Protection 12.1 RU2" is available to be added ("Add To My Symantec Products").  Once this is added, there will be listings in the LUA server for both it and the beta.  This new "Symantec Endpoint Protection 12.1 RU2" does have the necessary H version of definitions.
     

Administrators should then:

  1. Add the new "Symantec Endpoint Protection 12.1 RU2" product to the LUA server's Distribution Centers.  Open the download and distribution tasks and configure these to retrieve and make available "Symantec Endpoint Protection 12.1 RU2" content.
  2. The "Symantec Endpoint Protection v12.1 RU2 (Beta)" may then be deleted.

  

After this is complete, the LUA 2.x server will be downloading the H version of definitions that the current (non-beta) SEP 12.1 RU2 SEPM and SEP 12.1 RU2 clients require.