Endpoint Protection

I have multiple windows 7 machine with SEP 12.1 Unmanaged clients & non of them are getting update from symantec. Please find the screen shot attached. When i run live update i get this.

The following Symantec products and components are installed on your computer:

> Centralized Reputation Settings
> Intrusion Prevention Signatures (hub)
> Virus and Spyware Definitions Win32
> Intrusion Prevention Signatures
> Virus and Spyware Definitions Win32 (hub)
> Symantec Endpoint Protection Client
> Revocation Data
> Submission Control Thresholds
> SONAR Definitions
> Symantec Whitelist

Initializing...
Connecting to liveupdate.symantecliveupdate.com...
Connected to LiveUpdate server successfully.

There are 10 update(s) to be downloaded.
Downloading catalog file (1 of 10) finished.
Downloading catalog file (2 of 10) finished.
Downloading catalog file (3 of 10) finished.
Downloading catalog file (4 of 10) finished.
Downloading catalog file (5 of 10) finished.
Downloading catalog file (6 of 10) finished.
Downloading catalog file (7 of 10) finished.
Downloading catalog file (8 of 10) finished.
Downloading catalog file (9 of 10) finished.
Downloading catalog file (10 of 10) finished.

Session summary: 0 update(s) available, 0 update(s) installed.
LiveUpdate session is complete.

download exe required for your system based on OS but processor and run it. And monitor for next update.

http://www.symantec.com/security_response/definitions/download/detail.jsp?gid=savce

I already download and run this if u see the screen shot attached you can see only AV/AS is updated till Feb 13 , and i updated this manually download the defination from website.
Even i again download the exe from website it will only update AV/AS ,What about NTP & PTP ?

Regards
Saqib Alam

hi,

did u check it on other machines? is there same situation?

Please check whether you have made any changes

Regards

The manual definition file mentioned (Intelligent updater) is only for AV & AS. It will not update PTP & NTP.

On how many machines you face this issue? Try to uninstall only Live update & re-install. See if that helps.

I have already done all this activity , remove live update and resintall it. No Changes on any machine and its not with Single Machine multiple machines have same issue, Some of machines are directly connected to internet and some machines are behind proxy both have same issue.

Regards
Saqib Alam

can you post log.liveupdate?

Find Attached Log Live Update.

Attachment(s)

Log_13.zip   160 KB 1 version

not sure, if it is for SMG product, it shows that it has installed successfully.

/4/2012, 12:05:19 GMT -> Progress Update: PATCH_PROCESSING_FINISH: Number of patches: 3, Num successful: 3
3/4/2012, 12:05:19 GMT -> EVENT - PRODUCT UPDATE SUCCEEDED EVENT - Update available for Enablement Toolkit 3 - Messaging Gateway 9.5 - Partner Sales_1 - 1.0 - English. Update for CONTENTMODULE takes product from update 20111102 to 20111102. Server name - liveupdate.symantecliveupdate.com, Update file - 1320261535jtun_cm100886_full.v20111102.etp, Signer - cn=Symantec Corporation,ou=Locality - Tucson,ou=Product Group - LiveUpdate,ou=SymSignature 2005,o=Symantec Corporation, package install code 0. The Update executed with a result code of 1800, => Success
3/4/2012, 12:05:19 GMT -> EVENT - PRODUCT UPDATE SUCCEEDED EVENT - Update available for Enablement Toolkit 3 - Messaging Gateway 9.5 - Partner Sales_1 - 1.0 - English. Update for INDEX takes product from update 0 to 20111102. Server name - liveupdate.symantecliveupdate.com, Update file - 1320261535jtun_cm100886_index.etp, Signer - cn=Symantec Corporation,ou=Locality - Tucson,ou=Product Group - LiveUpdate,ou=SymSignature 2005,o=Symantec Corporation, package install code 0. The Update executed with a result code of 1800, => Success
3/4/2012, 12:05:19 GMT -> EVENT - PRODUCT UPDATE SUCCEEDED EVENT - Update available for Enablement Toolkit 3 - Messaging Gateway 9.5 - Partner Sales_1 - 1.0 - English. Update for SEARCH takes product from update 0 to 201111020812. Server name - liveupdate.symantecliveupdate.com, Update file - 1320261535jtun_cm100886_search.v20111102.etp, Signer - cn=Symantec Corporation,ou=Locality - Tucson,ou=Product Group - LiveUpdate,ou=SymSignature 2005,o=Symantec Corporation, package install code 0. The Update executed with a result code of 1800, => Success
3/4/2012, 12:05:19 GMT -> EVENT - SESSION END SUCCESSFUL EVENT - The LiveUpdate session ran in Silent Mode. LiveUpdate found 3 updates available, of which 3 were installed and 0 failed to install.  The LiveUpdate session exited with a return code of 1800, Success

The logs show updates for Symantec Enablement Tool Kit and not for Symantec End Point Protection.

can you try reinstalling liveupdate from the SEP install CD?

I alraedy did it infact i reinstall SEP.

can you open a support case and collect the SEP support tool log?

Just wanted to know, is your SEPM is updating properly with latest definitions.?

Manjunath.K,

the issue is related to unmanaged client, so it should not matter whether the SEPM is updated or not.

uninstall SEP with clean wipe tool completely. then install SEP again.

In SEP 12.1 client, Windows LiveUpdate has been replaced by LiveUpdate Engine, which is embedded to the client. Therefore, looking at log.liveupdate or reinstall LiveUpdate won't be relevant here.

Please reproduce the issue then past log.lue content here (http://www.symantec.com/docs/TECH168602).

I have a customer with the same issue it will only update the machine to January 2012. Then it will say there are no new updates. I have found the Inbox folder to manually Update it. I would really rather fix it to run on its own and not have to go to their site once or twice a week to update the three machines that are independent. Has anyone found anything out on this? I have attached the log file from the machine as well as a screen shot from the Program.

Attachment(s)

Log.Lue_.doc.txt   21 KB 1 version

lnettrouer can you confirm the SEP clientr version?

from the log it look likes you are using the BETA version, you should installing the latest version

  Component: Moniker: {07B590B3-9282-482f-BBAA-6D515D385869}, P: SEPC Virus Definitions Win64 (x64) v12.1 (Beta), V: MicroDefsB.CurDefs, L: SymAllLanguages.
  Component: Moniker: {263395A0-D3D8-4be4-80B5-202C94EF4AA0}, P: SEPC Iron Settings v12.1 (Beta), V: MicroDefsB.CurDefs, L: SymAllLanguages.
  Component: Moniker: {31D8C93E-8DB2-4eeb-8D75-87FD92F1C62C}, P: SEPC CIDS Signatures v12.1 (Beta), V: MicroDefsB.Jan, L: SymAllLanguages.
  Component: Moniker: {55DE35DC-862A-44c9-8A2B-3EF451665D0A}, P: SEPC CIDS Signatures v12.1 (Beta), V: MicroDefsB.CurDefs, L: SymAllLanguages.
  Component: Moniker: {810D5A61-809F-49c2-BD75-177F0647D2BA}, P: SEPC Iron Revocation List v12.1 (Beta), V: MicroDefsB.CurDefs, L: SymAllLanguages.
  Component: Moniker: {A8BA6A8E-8DB4-4575-8C7B-13CAF85B70AB}, P: SESC AntiVirus Client Win64, V: 12.1, L: English.
  Component: Moniker: {B6DC6C8F-46FA-40c7-A806-B669BE1D2D19}, P: SEPC Submission Control Data (Beta), V: 12.1, L: SymAllLanguages.

I agree with Pete, it seems you are currently using Beta version of SEP 12.1.

https://www-secure.symantec.com/connect/forums/sep-12-public-beta-now-available-download

Please install 12.1 RTM/RU1 SBE/EE and confirm it fixes the issue.

Hi Saqib,

Please disable UAC in control panel.

Off the Windows firewall.

1. Pubilc.

2. Private.

3. Domain.

Finds the attached logs.

@ Greet all windows firewall and UAC is already disabled.

Attachment(s)

Logs_LUE.zip   101 KB 1 version

Please copy/paste here the value of HKEY_LOCAL_MACHINE\SOFTWARE\Symantec\Symantec Endpoint Protection\SMC\ProductVersion from registry.

12.1.601.4699

SEP 12.1 RTM => 12.1.671.4971
SEP 12.1 RU1 => 12.1.1000.157

As previously mentioned, you are currently using BETA version of SEP 12.1. Please download and install SEP 12.1 RTM/RU1 to fix the problem.

If you have serial number, you can download sources on https://fileconnect.symantec.com.

Increase timeout in settings.liveupdate from 45 to 45000.

Go to control panel & open symantec liveupdate

Select Interative mode & click ok.

Run manual liveupdate.

Sorry I'm an independent contractor for other users of the software. I called the client and they informed me since the standalone machines didn't update on there own they reverted them back to the prior version they had on those machines. They did leave the 12.1 on the domain controlled machines that has the SEP server attached to. I asked them to allow me to get the information asked for on the machines that still had it for your request to get this fixed. I was informed that since I was unable to complete the request in what they called a timely mannor I am not a contractor for them anymore and I will not be given the information requested. :(

@ John

Thanks for solution you provide, i unistall beta version and installed the latest  version and now its working fine.