Clients will download content from the Endpoint Protection Manager (SEPM) and Symantec LiveUpdate servers instead of failing over as expected.
LiveUpdate is configured to use default LiveUpdate servers and the default management server.
It is expected that this configuration is to work as a failover, connecting to the Management server first, and only failing over to the LiveUpdate servers if the connection to the management server is down.
"The client opted to download an update for AV definitions from LiveUpdate rather than download a full definitions package from the manager or the GUP"
Endpoint Protection is working as designed.
If clients are configured for both options, they will use both options. The scheduling of either option triggers Independently.
If the client is set to heartbeat every hour, and LiveUpdate is set to run every 4 hours, then the client will try the manager every hour and LiveUpdate every 4 hours. Where it downloads it's content from is based on which schedule has the content available first. There is no other prioritization in place.
You can specify either an external Symantec LiveUpdate server (recommended), or one or more internal LiveUpdate servers that have previously been installed and configured.
If a failover configuration is desired, Symantec recommends utilizing LiveUpdate Administrator as a failover, or enabling location switching with your LiveUpdate policy.