Auto upgrade to Endpoint Protection 14 results in missing definitions

Products

• Endpoint Protection

Issue/Introduction

I deployed a Symantec Endpoint Protection (SEP) 14 Auto Upgrade package with the "Include latest content in the client installation package" box checked.

When clients upgrade, and then reboot, SEP reports that definitions are out of date. 

Shortly afterward, SEP user interface may report that the definitions are missing or corrupt.

SEP User Interface displays "Virus and Spyware Protection definitions are out of date." After a time, this turns to "Your Virus and Spyware definitions are missing of corrupted. This computer will not be protected against viruses and spyware until new definitions are downloaded."

SEP System Log shows "Error: Symantec Endpoint Protection has determined that the virus definitions are missing on this computer. This computer will remain unprotected from viruses until virus definitions are downloaded to this computer."

Environment

SEP 12.1 upgrading to SEP 14.

Cause

Symantec Endpoint Protection Manager (SEPM) does not include content in an upgrade package if the package is not a delta from a previous build. Definitions are only included when the SEPM has both the old and new version of client packages present in the database.

Resolution

Solution:
Import the legacy SEP 12.1 package, from which you are migrating, into the SEPM prior to assigning auto-upgrade. This allows a delta package to be created between the 12.1 and 14.x package. The SEPM adds definitions content to the delta upgrade package. See: Importing client installation packages into Symantec Endpoint Protection Manager.

Workaround:
Client systems eventually self-correct after contacting their SEPM. If you have a long heartbeat interval and download randomization set to a large window, it may take some time to correct the problem.