search cancel

Failed to install or un-compress definition updates on Endpoint Protection Manager with error LU1832

book

Article ID: 164176

calendar_today

Updated On:

Products

Endpoint Protection

Issue/Introduction

Live update fails to complete on Symantec Endpoint Protection Manager (SEPM) with error suggesting insufficient disk space.

"LU1832: Live-update was unable to un-compress an update. Because the update was corrupted during the download"

SesmLu.log:
12/20 10:12:07 [1d8c:1dc8] INFO(Med)  spcVirDef64SDS ProductUtil Response code: 0x0
12/20 10:12:07 [1d8c:1dc8] INFO(Med)  spcVirDef64SDS SesmLu Successfully notified sever of failure.
12/20 10:12:07 [1d8c:1dc8] INFO(Med)  spcVirDef64SDS MicroDefs25DefUtilsContentHandler Cleaning temp directories and reg keys
12/20 10:12:07 [1d8c:1dc8] ERROR      spcVirDef64SDS MicroDefs25DefUtilsContentHandler DU_S_OKat MicroDefs25DefUtilsContentHandler.cpp[420]
12/20 10:12:07 [1d8c:1dc8] ERROR      spcVirDef64SDS SesmLu Error cleaning up.at SesmLu.cpp[1457]
12/20 10:12:07 [1d8c:1dc8] INFO(Med)  spcVirDef64ReducedSDS SesmLu ---- PostSession Processing ---- 
12/20 10:12:07 [1d8c:1dc8] INFO(Med)  spcVirDef64ReducedSDS AbstractLuContentHandler UpdateStatus: 'CURDEFS:YES'.
12/20 10:12:07 [1d8c:1dc8] INFO(Med)  spcVirDef64ReducedSDS AbstractLuContentHandler DownloadStatus: 'CURDEFS:0'.
12/20 10:12:07 [1d8c:1dc8] INFO(Med)  spcVirDef64ReducedSDS AbstractLuContentHandler PatchStatus: 'CURDEFS:4'.
12/20 10:12:07 [1d8c:1dc8] ERROR      spcVirDef64ReducedSDS SesmLu LiveUpdate failed to deliver our package: UPDATE_FAILED_TO_PATCHat SesmLu.cpp[1450]

Environment

Windows Server 2008 R2 64-bit
SEPM 14.0.1904.0000

Cause

While this can be due to insufficient disk space, another possible cause is having an application control policy to "Prevent Modification of executable files" or to block write attempts made by .exe files.

Resolution

Isolate first by stopping SMC service (smc -stop). If the live update is successfull after stopping SMC, then check the application control policy for any custom rule-set that blocks modification of executable files and adjust the policy or disable as-necessary.