The Symantec Endpoint Protection Manager (SEPM) does not update definitions automatically, but when Luall.exe is manually run, new content is successfully downloaded.
When LiveUpdate is executed through the SEPM console, the result is an error "Return code =2"
When LiveUpdate runs automatically, it uses the Local System account. When a user manually runs LiveUpdate, it uses the logged in user's account. In some scenarios the Local System account does not have enough privileges to download content from the internet. This is typically seen in environments with certain proxy servers or firewalls.
First, ensure that all proxy settings are configured correctly with valid credentials. Details of the locations to configure can be found in How to Update the Proxy settings in the Symantec Endpoint Protection Manager (SEPM) 12.1.
Should that be unsuccessful, follow the steps below to resolve the issue:
Now LiveUpdate should be able to download definitions automatically.