Error: "469 CONTENT PENDING" in sylink.log and clients are not getting updates from Endpoint Protection Manager

Products

• Endpoint Protection

Issue/Introduction

Symantec Endpoint Protection (SEP) clients are not receiving updated definitions from Symantec Endpoint Protection Manager (SEPM), even though SEPM has the latest definitions. The sylink.log has the error, "469 CONTENT PENDING".

SEP clients may also display the green dot on the Symantec Tray Shield and are receiving updated policies from SEPM. There is no GUP configured for clients.

Cause

Due to corrupt definitions, SEPM cannot create delta definitions for the SEP clients.

The "Content Pending" message is sent by SEPM to SEP clients when it is preparing a Delta definition set for the client. When a SEP client receives the "469" code, it will put itself in an accelerated heartbeat mode, waiting for SEPM to finish the creation of the Delta.

Resolution

To resolve this issue, clean up the definitions in SEPM.

1.  Stop the Symantec Endpoint Protection Manager service.
2. Clean up the file system:
   
   
   1. Go to \Program Files\Symantec\Symantec Endpoint Protection Manager\Inetpub\content
   2. Delete all numbered folders (e.g. 90920019) in each alphanumeric folders (e.g. {1CD85198-26C6-4bac-8C72-5D34B025DE35})
       
3. Clean up the database. Go to \Program Files\Common Files\Symantec Shared\SymcData\ and delete the following folders:
   
   
   • sesmipsdef32
   • sesmipsdef64
   • sesmvirdef32
   • sesmvirdef64
      
4. Open Registry Editor and export the current registry settings as a backup.
5. In Registry Editor, go to the following key
   
   
   • 32-bit: HKEY_LOCAL_MACHINE\SOFTWARE\Symantec\InstalledApps
   • 64-bit: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Symantec\InstalledApps
     
     
6. In the right pane, delete the following value entries:
   
   
   • SymcData-sesmipsdef32
   • SymcData-sesmipsdef64
   • SymcData-sesmvirdef32
   • SymcData-sesmvirdef64
      
7. Delete the following Registry Keys
   • 32-bit:
     
     
     • HKEY_LOCAL_MACHINE\SOFTWARE\Symantec\SharedDefs\SymcData-sesmipsdef32
     • HKEY_LOCAL_MACHINE\SOFTWARE\Symantec\SharedDefs\SymcData-sesmipsdef64
     • HKEY_LOCAL_MACHINE\SOFTWARE\Symantec\SharedDefs\SymcData-sesmvirdef32
     • HKEY_LOCAL_MACHINE\SOFTWARE\Symantec\SharedDefs\SymcData-sesmvirdef64
        
   • 64-bit:
     
     
     • HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Symantec\SharedDefs\SymcData-sesmipsdef32
     • HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Symantec\SharedDefs\SymcData-sesmipsdef64
     • HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Symantec\SharedDefs\SymcData-sesmvirdef32
     • HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Symantec\SharedDefs\SymcData-sesmvirdef64
        
8. Delete the contents of folder C:\Documents and Settings\All Users\Application Data\Symantec\LiveUpdate\Downloads.
9. Start Symantec Endpoint Protection Manager service.
10. Re-register SEPM with LiveUpdate:
    1. Click Start > Run.
    2. Type cmd, then click OK. The command prompt opens.
    3. At the command prompt type cd and the path to lucatalog.exe. For example:
       
       cd C:\Program Files\Symantec\Symantec Endpoint Protection Manager\bin
        
    4. Type lucatalog.exe -Cleanup
    5. After the first command executed, type lucatalog.exe -update
    6. Run Liveu pdate in SEPM.

SEPM will now be able to create delta definitions for the SEP clients and distribute them.