ALERT: Some images may not load properly within the Knowledge Base Article. If you see a broken image, please right-click and select 'Open image in a new tab'. We apologize for this inconvenience.

After installing the 14.3 RU1 or 14.3 RU1-MP1 Mac agent, IPS content updates once and then stops updating.

book

Article ID: 213839

calendar_today

Updated On:

Products

Endpoint Protection

Issue/Introduction

After installing the 14.3 RU1 or 14.3 RU1-MP1 Mac agent the IPS content updates on the client initially but then seems to stop getting new IPS content.

Cause

This can be caused by a setting called 'Download Symantec Endpoint Protection product updates' in the Liveupdate policy for SEPM versions 14.3 RU1 and RU1-MP1.

Environment

14.3 RU1
14.3 RU1-MP1

Resolution

Look inside the LiveUpdate policy assigned to the Macs. Under the Mac Settings > Advanced Settings, please make sure that the Download Symantec Endpoint Protection product updates option is checked. It is checked by default.

If this is not checked, then when the Mac client checks in it will disable LiveUpdate from checking for IPS content. This setting will be enabled by default and hidden in SEP 14.3 RU2.




Important note:

If the SEPM has been upgraded to 14.3 RU2 and this setting was not yet enabled before the upgrade then there will not be a setting present to enable. There may be 14.3 RU1 and 14.3 RU1-MP1 Mac clients that are stuck in the state where IPS content is not requested.

In this scenario, please update your SEP for Mac clients to 14.3 RU2.

Additional Information

When reviewing the lux.log you can see a distinct difference between successful IPS content checks and non-successful ones.

Expected Component listing when running Liveupdate. This will check for IPS content.
10:00:43.450478 [Component List - START]
10:00:43.450548 {6DD36F31-4525-49CD-80F4-51FB38E61C49} : Symantec Endpoint Protection Client Mac Branding : Symantec Endpoint Protection Client Mac Branding_14.3 RU1_SymAllLanguages
10:00:43.450605 {344C918B-AC37-48D8-A60B-5287CC882C3B} : WSS Traffic Redirection for Mac : SEPC WTR For Mac_14.3 RU1_SymAllLanguages
10:00:43.450659 {3F7A569E-7473-4BE1-8695-8FCDFA785C66} : Symantec Endpoint Protection Client Mac : Symantec Endpoint Protection Client Mac_14.3 RU1_SymAllLanguages
10:00:43.450711 {57BC15BB-2B85-4081-B21C-1CF22DE8E987} : AntiVirus Signatures : SEPC Virus Definitions Mac 14.3 RU1_MicroDefsB.CurDefs_SymAllLanguages
10:00:43.450764 {DE0078CD-65D4-48AC-8783-2FFBE614A18D} : Symantec Endpoint Foundation : SymPlatform_Mac-SEP 14.3 RU1_MicroDefsB.CurDefs_SymAllLanguages
10:00:43.450817 {3AA6B4DD-A60D-4EE8-96F5-6A5F58065FA5} : Submission Control Data for Mac : Submission Control Data for Mac_14.3 RU1_SymAllLanguages
10:00:43.450862 [Component List - END]

Actual results AFTER the initial successful download if the policy setting is disabled. This will not check for IPS content.
11:43:40.452388 [Component List - START]
11:43:40.452498 {3AA6B4DD-A60D-4EE8-96F5-6A5F58065FA5} : Submission Control Data for Mac : Submission Control Data for Mac_14.3 RU1_SymAllLanguages
11:43:40.452560 {57BC15BB-2B85-4081-B21C-1CF22DE8E987} : AntiVirus Signatures : SEPC Virus Definitions Mac 14.3 RU1_MicroDefsB.CurDefs_SymAllLanguages
11:43:40.452608 [Component List - END]

In the above example the IPS content is the following reference:
Symantec Endpoint Foundation : SymPlatform_Mac-SEP 14.3 RU1_MicroDefsB.CurDefs_SymAllLanguages

Attachments