Scan completes immediately and completed with 0 files scanned

Products

• Endpoint Protection

Issue/Introduction

Endpoint Protection (SEP) scan completes immediately and shows completed with 0 files scanned

Environment

Symantec Endpoint Protection 14.3 RU2 and lower.

Cause

This is related to a new certificate being used to sign SDS 1.21 for endpoints running 14.3 RU2 and older, this would require an update to SymVT in order to load the engine successfully.

Resolution

There are 3 options to resolve the issue.

1. Upgrade the SEP to 14.3 RU3 and later.
2. Use LiveUpdate Administrator to download SymVT content
3. Host the contents of SymVT-20231108T230607Z-001.zip on an HTTP server and point the SEPM/Clients at that location to update SymVT content.
   IIS can be configured on the SEPM server to do this as follows:
   - Install/configure IIS as per the steps on How to configure a Remote Windows Server as a Distribution Center for LiveUpdate Administrator 2.x content
   - Extract the content of "SymVT-20231108T230607Z-001.zip" and keep it on the root folder; like this:

Then configure SEPM to download updates from this location:

Run the LiveUpdate download task on SEPM and verify it is successful. Then revert to original setting.

Configure the clients to download this content from SEPM.

Additional Information

How to update contents on Endpoint protection clients using Symantec ( LUA / SEPM) webserver.