Hi,
It depneds upon which SEP product (EE OR SBE) you are using.
SEP 11.x licensing is basically just a "paper" license product. However, with SEP 12.1 the licensing is a "software" license product and uses a license file. It is important to become familiar with this license concept.
In SEP 12.1 there are two types of enforcement.
Types of enforcement
When the license goes out of compliance the Symantec Endpoint Protection product goes into enforcement mode. There are two types of enforcement
1) Hard Enforcement: SEP 12.1 Small Business Edition (SBE)
- Content update downloads stop for both server and clients.In Small Business Edition it's 1:1 mapping with CAT server.
- UI changes and log notifications are started.
2) Soft Enforcement: SEP 12.1 Enterprise Edition (EE)
- Content update downloads continue from all the sources.
- UI changes and log notifications are started.
It would be worth to check following article: