In Multiple Site, SEPM replication scenarios, Symantec Endpoint Protection[SEP] definitions are shown with older definitions in reports after completion of the Symantec Endpoint Protection Manager [SEPM] Replication cycle.
The definitions on the SEP agents are not affected post-replication, only the SEPM reports will show the older definitions.
SEPM and SEP client version 14.X
In Multiple SEPM Site replication scenarios, where mostly the SEP client system is the roaming profile switches to the SEPM sites frequently.
The Full opstate info is not uploaded to the SEPM whenever there is site change detected, but on the next interval of the scheduler. It just updates the last connection status in turn updates the USN of that agent.
Post replication, by design the Latest USN data is considered , causing the older definitions to reflect in the reports.
There is a change in the SEP client architecture, it will send the full opstate information in the same heartbeat to SEPM whenever it notices the site change.
This fix is added in the SEP client build 14.3 RU8. Please upgrade SEP/M to 14.3 RU8