Client will stop updating and will not install the latest downloaded definitions. The content is downloaded to the client and the client doesn't update to using the newer content until a restart or reboot of the machine.
Screenshot showing the definition corruption and failure to cleanup old defs and update the usage.dat file appropriately
There is a timing issue with multiple threads executing a similar task
1) MainTimer - CheckPattern ensures the latest good defs are being used. Runs periodically.
2) PostUpdate - Callback from DefUtils to switch to newly available defs.
In this case, the MainTimer is checking for new defs but the new defs are not yet applied. When the PostUpdate handler executes, the defs are ready but the process isn't told to go to DefUtils to check for latest instead it reads the latest defs from the cached values.
This issue is fixed in Symantec Endpoint Protection (SEP) 14.3 RU4. For information on how to obtain the latest build of Symantec Endpoint Protection, see Download the latest version of Symantec software here.