When the Symantec Endpoint Protection Management (SEPM) server is down, Advanced Threat Protection (ATP) returns a connection and authentication error to SEPM. Instead of warning to check the status of the SEPM server, when the server is down, ATP returns an error that the SEPM authentication credentials are bad.
Check whether the SEPM server is up and running before checking any other causes of error.