Group Update Provider stopped updating clients

Products

• Endpoint Protection

Issue/Introduction

Symantec Endpoint Protection (SEP) Group Update Provider (GUP) has stopped updating clients.

It has been verified that the connections between non-GUP clients and the appropriate GUP are not blocked. In addition, the connections between the Symantec Endpoint Protection Manager (SEPM) and all client computers are not blocked.

There may be a build up of 0-byte size TMP files in the folder structure of any appropriate GUP.

For Example: C:\Program Files (x86)\Symantec\Symantec Endpoint Protection\<SEP_Version_Number>\SharedUpdate\LUF{07B590B3-9282-482f-BBAA-6D515D385869}1609130191609060207.TMP

Debug.log will contain entries similar to the below example :

GUProxy - **downloadHelper.CreateUrlRequest failed GET://<SEPM IP>:8014/content/TempCache/{55DE35DC-862A-44c9-8A2B-3EF451665D0A}/160826013/xdelta160826013_To_160905011.dax

Cause

GUPs use WinHttp proxy functionality to fetch client requested definitions from a SEPM.

 

Resolution

Check if there are proxy settings in place using netsh and WinHttp. You should also consider using a 32-bit command prompt to check in addition to the default 64-bit command prompt. The default 64-bit command prompt will only show proxy settings for 64-bit applications. Start a command prompt and issue the following command :

netsh WinHttp Show Proxy

One of the following solutions can be applied:

1. Create a bypass list locally on the OS for the GUP IP address, so traffic WinHttp traffic is not routed through a proxy server.

2. Reset the proxy settings if no other applications will be affected on the same server where GUP functionality is enabled.

Further information on the Netsh commands can be found on :

Netsh Commands for Windows Hypertext Transfer Protocol (WINHTTP)