LiveUpdate fails on Exchange 2007 or 2010 Server: "Error LU1845: This product was not updated due to a processing error"

Products

• Mail Security for Microsoft Exchange

Issue/Introduction

On a server where both Symantec Endpoint Protection 11 (SEP 11) and SMSMSE 6 are installed, LiveUpdate fails: "Error LU1845: This product was not updated due to a processing error." The SEP virus definitions are not updated.

This usually happens if SMSMSE 6 was installed on the server before SEP 11, and in circumstances where the SEP 11 client is unmanaged (receives its updates from LiveUpdate servers on the Internet rather than from a SEPM.)

Symptoms

The following text appears in the LiveUpdate application when luall.exe is run:

 

The following updates have been aborted:
> Antivirus and antispyware definitions has 1 aborted update(s).
Reason:
LU1845: This product was not updated due to a processing error.

LiveUpdate session is complete.

The log.liveupdate contains lines similar to the following:

11/17/2008, 9:05:01 GMT -> LiveUpdate aborted product SESC Virus Definitions Win64 (x64) v11 for the following reason (error code 1845), This product was not updated due to a processing error.
11/17/2008, 9:05:03 GMT -> At least one product in coupled group {EBFFA65F-36DD-4053-8F49-5ADBC646DF88} was aborted for the following reason => This product was not updated due to a processing error. error code 1845. LiveUpdate will abort updates for all products that are part of this group
11/17/2008, 9:05:03 GMT -> EVENT - PRODUCT UPDATE FAILED EVENT - Update available for Antivirus and antispyware definitions - MicroDefsB.CurDefs - SymAllLanguages. Update for  takes product from update 0 to . Server name - , Update file - , Signer - , package install code 0. The Update executed with a result code of 1845, => This update was aborted during LiveUpdate Pre-session processing.  This error is most likely due to an expired content subscription.

or

11/20/2008, 19:15:22 GMT -> The PreSession callback for product SESC Virus Definitions Win64 (x64) v11 completed with a result of 0x80004005
11/20/2008, 19:15:22 GMT -> LiveUpdate aborted product SESC Virus Definitions Win64 (x64) v11 for the following reason (error code 1845), This product was not updated due to a processing error.
11/20/2008, 19:15:22 GMT -> Successfully released callback {855BA5F4-6588-4F09-AE61-847E59D08CB0}

If you update the virus definitions via the SIFMSMSE console, and then install the SEP Client, the SEP user interface indicates that definitions are corrupt.

Resolution

Upgrade to SMSMSE 6.0.9 or higher.

Workaround

1. Run Rapid Release Definitions (via FTP) under the Admin tab of the SIFMSMSE console. This should update both the SEP and SIFMSMSE virus definitions.

Applies To

Operating System is 64 bit.