Windows 10 Anniversary Edition update introduced a new feature named the Linux sub-system. When inside the Linux BASH shell the Endpoint Protection firewall blocks updates even when configured to allow. Updates are allowed if you disable the firewall.
If firewall traffic log is enabled for the blocking rule, the blocked application path/name will be logged with question marks ("??????") or other odd character combinations (e.g. Asian characters).
The Linux subsystem is considered beta in Windows 10 Anniversary Edition. Currently, it has incomplete support for the required API. The current API doesn't return enough information to be useful by the Symantec drivers
This issue is fixed in Symantec Endpoint Protection 126.96.36.199 (14 MP2). For information on how to obtain the latest build of Symantec Endpoint Protection, see Download the latest version of Symantec Endpoint Protection.