The windows firewall will block traffic to Windows KMS servers even though the Security Center says the Windows Firewall is off and being controlled by SEP.
When the SEP firewall is installed, a Windows firewall reconfiguration is not recognized until reboot. For example, Windows firewall may appear to be disabled after making the appropriate GUI or command-line changes, but these changes will not take effect until Windows is restarted.
Symantec is aware of this issue and is investigating.
As a workaround, disable the Windows firewall or otherwise reconfigure it to allow traffic, and reboot the machine. Windows firewall settings should take effect after the machine has been restarted.
This article will be updated as new information becomes available.
SEP 12.1 on Windows 7 Enterprise 32 or 64 bit.