Endpoint Protection showing older definitions in reports after replication

Products

• Endpoint Protection

Issue/Introduction

In Multiple Site, SEPM replication scenarios, Symantec Endpoint Protection[SEP] definitions are shown with older definitions in reports after completion of the Symantec Endpoint Protection Manager [SEPM] Replication cycle. 
The definitions on the SEP agents are not affected post-replication, only the SEPM reports will show the older definitions.

 

Environment

SEPM and SEP client version  14.X 

Cause

In Multiple SEPM Site replication scenarios, where mostly the SEP client system is the roaming profile switches to the SEPM sites frequently.

The Full opstate info is not uploaded to the SEPM whenever there is site change detected, but on the next interval of the scheduler. It just updates the last connection status in turn updates the USN of that agent. 

Post replication, by design the Latest USN data is considered , causing the older definitions to reflect in the reports. 

 

 

Resolution

There is a change in the SEP client architecture, it will send the full opstate information in the same heartbeat to SEPM whenever it notices the site change.

This fix is added in the SEP client build 14.3 RU8. Please upgrade SEP/M to 14.3 RU8