I've been bashing my head over this one. My company has about 400 SEP clients in a main site and spread across 13 remote sites which are all defined as groups in SEPM. Each remote site has a server that acts as a GUP.
At one site, I have 2 clients that are not getting virus definition updates. The other 15 at this location have been getting them. All clients are Windows 7 x64.
All clients have been running SEP version 12.1.4100.4126. Today I've had access to one of these problem computers to run some troubleshooting.
From SEPM, I send the command to update content, and although the command status monitor says it completes, the virus defs. do not get updated on this computer.
I have uninstalled SEP, rebooted. Then I ran the CleanWipe utility and rebooted. I checked C:\Programdata , C:\Program Files , and C:\Program Files (x86), and all of the symantec folders were gone.
Then I installed version 12.1.5337.5000. The installation was done from a package I exported from SEPM that was configured as a managed client.
After rebooting, the client connects to the central SEPM and updates its policy. The Proactive Threat Protection and Network Threat Protection definitions did get updated. Just not the Virus and Spyware definitions.
Something strange through, I tried running SEPLiveUpdate.exe from a command prompt, and I was returned the following error: "LiveUpdate has been disabled. Please contact your System Administrator for more Information."
The policy for this group in SEPM appears to have "Allow the user to manually launch LiveUpdate" CHECKED.
On the client management settings on the client itself however, the LiveUpdate settings tab shows the following box UNCHECKED: "Enable automatic updates".
I tried moving it into a different group and updating the policy. It still won't update the Virus & spyware definitions.
I downloaded SymHelp.exe and ran a scan. There were no issues. When trying to open a case with SymHelp on this computer, SymHelp crashes towards the end of collecting data.
Can anyone provide any guidance? This is driving me nuts.
EDIT: I've also modified the registry:
\\HKLM\SOFTWARE\Symantec\Symantec Endpoint Protection\LiveUpdate\ ----> AllowManualLiveUpdate changed from 0 to 1