14 RU1 MP1 clients not updating IPS definitions

Products

• Endpoint Protection

Issue/Introduction

Symantec Endpoint Protection (SEP) 14 RU1 MP1 clients will report as having out of date IPS definitions when reporting to a 14.2 SEPM while a mix of 12.1, 14 RU1 and 14.2 clients are present in the environment.

lulock.dat files are created in ;

C:ProgramDataSymantecLiveUpdateDownloads

and
C:ProgramDataSymantecDefinitionsSymcDataspcCIDSdef

 

Log.LiveUpdate present at C:ProgramDataSymantecLiveUpdate on the SEPM machine will show:

5/20/2019, 21:54:35 GMT -> Added package to cache...
5/20/2019, 21:54:35 GMT ->     DIS - UPDATE("C:ProgramDataSymantecLiveUpdateDownloadsUpdt437", "C:ProgramDataSymantecDefinitionsSymcDataspcCIDSdeftmp1ff3.tmp") <BEGIN>
5/20/2019, 21:54:35 GMT ->         Updating C:ProgramDataSymantecLiveUpdateDownloadsUpdt437CATALOG.999 at C:ProgramDataSymantecDefinitionsSymcDataspcCIDSdeftmp1ff3.tmp.
5/20/2019, 21:54:35 GMT ->         CopyFile failed with error 0x3.
5/20/2019, 21:54:35 GMT ->     DIS - UPDATE(0x802A000B) <END>
5/20/2019, 21:54:35 GMT -> Progress Update: PATCH_ERROR: Patch File: "C:ProgramDataSymantecLiveUpdateDownloadsUpdt4371558194594jtun_ips_sep190429061-190518061.x01", Script File: "C:ProgramDataSymantecLiveUpdateDownloadsUpdt437spcCIDSdefHP.dis", HR: 0x802A000B
5/20/2019, 21:54:35 GMT -> HR 0x802A000B DECODE: E_DIS_COPY_FILE_IN_USE
5/20/2019, 21:54:35 GMT -> Progress Update: PATCH_FINISH: Patch File: "C:ProgramDataSymantecLiveUpdateDownloadsUpdt4371558194594jtun_ips_sep190429061-190518061.x01", Script File: "C:ProgramDataSymantecLiveUpdateDownloadsUpdt437spcCIDSdefHP.dis", HR: 0x802A000B
5/20/2019, 21:54:35 GMT -> HR 0x802A000B DECODE: E_DIS_COPY_FILE_IN_USE
5/20/2019, 21:54:35 GMT -> EVENT - PRODUCT UPDATE FAILED EVENT - Update available for SEPM CIDS Signatures 12.1 RU2 - MicroDefsB.CurDefs - SymAllLanguages. Update for CurDefs takes product from update 190429061 to 190518061. Server name - liveupdate.symantecliveupdate.com, Update file - 1558194594jtun_ips_sep190429061-190518061.x01, Signer - cn=Symantec Corporation,ou=Locality - Tuscon Prod 1 and 2,ou=Product Group - LiveUpdate,ou=SymSignature 2005,o=Symantec Corporation, package install code 0. The Update executed with a result code of 1821, => The install script for this update tried to copy a new file onto a file that was in use.  LiveUpdate aborted the update install.

 

Environment

14.2 SEPM with 14 RU1, 12.1 and 14.2 SEP clients.

Cause

Within the SEPM database, the LuContentCatalog XML content includeds the wrong IPS/CIDS  content properties.

Resolution

Contact Symantec support and an appropriate fix tool can be provided.