After setting an Endpoint Detection and Response (EDR) server to accommodate Insight lookups, the Symantec Endpoint Protection (SEP) client begins exhibiting high CPU utilization. Also, the ccSubSDK (\ProgramData\Symantec\Symantec Endpoint Protection\CurrentVersion\Data\CmnClnt\ccSubSDK) folder is filling up with thousands of files.
The following repetitive errors can be seen in the SEP System log:
Cannot assign a client authentication token. This client is not scheduled to obtain a client authentication token.
Release :SEP 14.3
The client will attempt to retrieve an authentication token even if submissions are disabled when connected to EDR.
A fix was provided in SEP 14.3 RU4. To resolve the issue, upgrade the client to that version or later.
Note: This fix does not apply if "Client submissions" are still enabled. Only Insight (reputation) lookup queries are permitted without a client authentication token. Client Submissions (broadcom.com)