The environment has clients including Windows 7 and Windows 2008 R2. These operating systems only support up to 14.3 RU7.
However the ICDm is trying to push newer versions of the client (RU9/ RU10) to these endpoints, resulting in error messages in LiveUpdate and the SEP installation log.
Windows 7 and Windows 2008 R2 only support up to 14.3 RU7. For reference:
Windows compatibility with Symantec Endpoint Protection clients
The workaround involves disabling the auto-upgrade option, and (manually) installing the latest version the client supports:
1. Disable Auto-Upgrade in the System Policy
2. Export a 14.3 RU7 package instead, which *can* be installed on these two operating systems.