When running the Virus Definition Distribution report and selecting a server within that report to bring up the "Out of Date Clients for Server X" report you find that this report shows a different number of clients and incorrect results from the filtering selected.
The report for "Out of Date Clients for Server X"includes a query that does not take into account the server name; clients from other servers are mistakenly included in the report. This issue is fixed in Symantec Endpoint Protection 12.1 Release Update 5 (RU5).
Upgrade to Symantec Endpoint Protection 12.1 Release Update 5 (RU5). For guidance in downloading the latest version of Symantec Endpoint Protection, see Obtaining the latest version of Symantec Endpoint Protection or Symantec Network Access Control.
As a work-around, use other reporting or logging functions within the SEPM to obtain lists of clients for particular parent servers. For example: Computer Status Report, Client Inventory Details, advanced settings: choose definition date "mm/dd/yyyy and older" and server name.