After setting an Endpoint Detection and Response (EDR) server to accommodate Insight lookups, the Symantec Endpoint Protection (SEP) client begins exhibiting high CPU utilization. Also, the ccSubSDK (\ProgramData\Symantec\Symantec Endpoint Protection\CurrentVersion\Data\CmnClnt\ccSubSDK) folder is filling up with thousands of files.
The following repetitive errors can be seen in the SEP System log:
Cannot assign a client authentication token. This client is not scheduled to obtain a client authentication token.
The client will attempt to retrieve an authentication token even if submissions are disabled when connected to EDR.
Release :SEP 14.3
A fix was provided in SEP 14.3 RU4. To resolve the issue, upgrade the client to that version or later.
Workarounds:
ESCRT-7730