Symantec Endpoint Protection Manager is unable successfully run scheduled LiveUpdate sessions

Products

• Endpoint Protection

Issue/Introduction

The Symantec Endpoint Protection Manager (SEPM) does not update definitions automatically, but when Luall.exe is manually run, new content is successfully downloaded. 

 

When LiveUpdate is executed through the SEPM console, the result is an error "Return code =2"

Cause

When LiveUpdate runs automatically, it uses the Local System account.  When a user manually runs LiveUpdate, it uses the logged in user's account. In some scenarios the Local System account does not have enough privileges to download content from the internet.  This is typically seen in environments with certain proxy servers or firewalls. 

Resolution

First, ensure that all proxy settings are configured correctly with valid credentials.  Details of the locations to configure can be found in How to Update the Proxy settings in the Symantec Endpoint Protection Manager (SEPM) 12.1.

Should that be unsuccessful, follow the steps below to resolve the issue:
 

1. Go to Start, Click on Run and Type services.msc
2. Right click on Liveupdate Service and go to Properties
3. Click on the Log On tab and select "This Account"
4. Provide the Local Administrator Username and Password

Now LiveUpdate should be able to download definitions automatically.