You should check the policy serial number on the client to see if it matches the serial number that appears in the management console. If the client communicates
with the management server and receives regular policy updates, the serial numbers should match.
If the policy serial numbers do not match, you can try to manually update the policies on the client computer and check the troubleshooting logs.
To view the policy serial number in the management console
1. In the management console, click Clients.
2. Under "View Clients", select the relevant group, and then select the Details tab.
The policy serial number and the policy date appear at the bottom of the details list.
To view the policy serial number on the client
On the client computer, in the client user interface, click on the Help and Support button, select Troubleshooting.
In the Management section, look at the policy serial number.
The serial number should match the serial number of the policy that the management server pushes to the client.
About performing a manual policy update to check the policy serial number
You can perform a manual policy update to check whether or not the client receives the latest policy update. If the client does not receive the update, there might be
a problem with the client and server communication.
You can try a manual policy update by doing any of the following actions:
In the client click on the Help and Support button, click Troubleshooting. Under Policy Profile, click Update. You can use this method if you
want to perform a manual update on a particular client.
For the clients that are configured for pull mode, the management server downloads policies to the client at regular intervals (heartbeat). You can change
the heartbeat interval so that policies are downloaded to the client group more quickly. After the heartbeat interval, you can check to see if the policy serial
numbers match. (For the clients that are configured for push mode, the clients receive any policy updates immediately.)
After you run a manual policy update, make sure that the policy serial number that appears in the client matches the serial number that appears in the
management console.
Using a browser to test the connectivity to the management server
You can use a Web browser to test the connectivity to the management server.
To use a browser to test the connectivity to the management server:
On the client computer open a Web browser, such as Internet Explorer.
In the browser command line, type a command that is similar to either of the following commands:
If the reporting log-on Web page appears, the client can communicate with the management server.
If the Symantec Endpoint Protection Manager Console page appears, the client can communicate with the management server.
If a Web page does not appear, check for any network problems. Verify the DNS service for the client and check its routing path.
Using Telnet to test the connectivity to the management server
You can use Telnet to test the connectivity to the IIS server on the management server. If the client can Telnet to the management server's HTTP or HTTPS port,
the client and the server can communicate. The default HTTP port is 8014 (80 for the earlier builds of SEP); the default HTTPS port is 443.
Note: You might need to adjust your firewall rules so that the client computer can Telnet into the management server.
For more information about the firewall, see the Administration Guide for Symantec Endpoint Protection and Symantec Network Access Control.
To use Telnet to test the connectivity to the management server
On the client computer, make sure the Telnet service is enabled and started.
Open a command prompt and enter the Telnet command. For example:
telnet ip address 8014
where ip address is the IP address of the management server.
If the Telnet connection fails, verify the client's DNS service and check its routing path.
Verify the Windows Firewall is not enabled on the management server (SEPM) or the client.
Windows Server 2003:
Use the netsh command line to disable the firewall:
netsh firewall set opmode mode = disable
Windows Server 2008
Server 2008 uses a profile based approach to the firewall settings. Again, use the netsh command but you will need to specify profile you want to configure (or disable in this case):
netsh advfirewall set <profile> state off
Values for <profile> are as follows:
allprofiles - change the settings for all the profiles.
currentprofile - change the setting for just the current profile.
domainprofile - change the settings for the domain profile.
privateprofile - change the settings for the private profile.
publicprofile - change the settings for the public profile.
If SEPM and it's associated processes (Tomcat, IIS, etc..) are the only applications on this server, we recommend using the "allprofiles" profile for the command line; otherwise choose the appropriate profile.
http://service1.symantec.com/SUPPORT/ent-security.nsf/docid/2008091215040048