Symantec Endpoint Protection (SEP) 14, up to 14 RU1, exhibit an issue with definition content not automatically purging, thus using up disk space. In some cases, rebooting the SEP client will clear this content out.
DefUtils is tasked with purging old content, after a successful update to definitions. In the event DefUtils is unable to delete the content, it will use the Windows API 'MoveFileEx' to add an entry to the 'PendingFileRenameOperations' registry key so that the Windows operating system can remove content during a system boot cycle.
This issue is fixed in Symantec Endpoint Protection 14 RU1 MP1. For information on how to obtain the latest build of Symantec Endpoint Protection, see Download the latest version of Symantec Endpoint Protection.