Live update fails to complete on Symantec Endpoint Protection Manager (SEPM) with error suggesting insufficient disk space.
"LU1832: Live-update was unable to un-compress an update. Because the update was corrupted during the download"
SesmLu.log:
12/20 10:12:07 [1d8c:1dc8] INFO(Med) spcVirDef64SDS ProductUtil Response code: 0x0
12/20 10:12:07 [1d8c:1dc8] INFO(Med) spcVirDef64SDS SesmLu Successfully notified sever of failure.
12/20 10:12:07 [1d8c:1dc8] INFO(Med) spcVirDef64SDS MicroDefs25DefUtilsContentHandler Cleaning temp directories and reg keys
12/20 10:12:07 [1d8c:1dc8] ERROR spcVirDef64SDS MicroDefs25DefUtilsContentHandler DU_S_OKat MicroDefs25DefUtilsContentHandler.cpp[420]
12/20 10:12:07 [1d8c:1dc8] ERROR spcVirDef64SDS SesmLu Error cleaning up.at SesmLu.cpp[1457]
12/20 10:12:07 [1d8c:1dc8] INFO(Med) spcVirDef64ReducedSDS SesmLu ---- PostSession Processing ----
12/20 10:12:07 [1d8c:1dc8] INFO(Med) spcVirDef64ReducedSDS AbstractLuContentHandler UpdateStatus: 'CURDEFS:YES'.
12/20 10:12:07 [1d8c:1dc8] INFO(Med) spcVirDef64ReducedSDS AbstractLuContentHandler DownloadStatus: 'CURDEFS:0'.
12/20 10:12:07 [1d8c:1dc8] INFO(Med) spcVirDef64ReducedSDS AbstractLuContentHandler PatchStatus: 'CURDEFS:4'.
12/20 10:12:07 [1d8c:1dc8] ERROR spcVirDef64ReducedSDS SesmLu LiveUpdate failed to deliver our package: UPDATE_FAILED_TO_PATCHat SesmLu.cpp[1450]
Windows Server 2008 R2 64-bit
SEPM 14.0.1904.0000
While this can be due to insufficient disk space, another possible cause is having an application control policy to "Prevent Modification of executable files" or to block write attempts made by .exe files.
Isolate first by stopping SMC service (smc -stop). If the live update is successfull after stopping SMC, then check the application control policy for any custom rule-set that blocks modification of executable files and adjust the policy or disable as-necessary.