Endpoint Protection

Hi.

I updraded my SEP Managers to the latest 11.0.7 version and now Liveupdate fails - or is Intermittent at best.

I uninstalled Liveupdate on Friday from both my SEPM servers and re-installed from the 11.0.7 media and initiated a liveupdate and it worked. but now it's trying to connect as per the schedule and fails. Even subsequent manual updates are failing

"Live update encountered one or more errors. Return code = 4"

any ideas? I bet if I uninstall it and re-install it again it will work for the first manual run and then fail after that for every other try

Thanks

Solution

This error can be caused for different reasons including, but not limited to, the following:

1. Internet access is being blocked by a proxy server.<Please see the Technical Information section of this document for steps to configure Liveupdate for use with a proxy>

2. Symantec Endpoint Protection Manager is trying to contact via an internal LiveUpdate server and the URL supplied to LiveUpdate is not correct.

3. Enhanced Security is enabled in Internet Explorer <Please see the Technical Information section of this document for steps to disable IE Enhanced Security>

4. A firewall that requires authentication to get to the internet is used.

5. Re-register the SEPM with LiveUpdate.

6. Web filtering device detects and blocks certain items.

Note: To re-register the SEPM with LiveUpdate, follow the steps below:

1. Open a command window, then browse to:
   C:\Program Files\Symantec\Symantec Endpoint Protection Manager\bin

2. Type lucatalog -update and press Enter.

3. Run LiveUpdate to verify that there are no errors.

 For Symantec Endpoint Protection 12.1, follow the steps below:

1. Open a command window, then browse to:
   C:\Program Files\Symantec\Symantec Endpoint Protection Manager\bin

2. Type lucatalog -cleanup and press Enter.

3. Type lucatalog -forcedupdate and press Enter.

4. Run LiveUpdate to verify that there are no errors.

If the error persists, examine Log.LiveUpdate for more detailed information or error codes.


References
More detailed information about why LiveUpdate failed can be found in the following log file:

<drive></drive><Drive>:\Documents and Settings\All Users\Application Data\Symantec\LiveUpdate\Log.LiveUpdate

ok - great - thanks

It's not being blocked - otherwise it wouldn't work at all

curiously it works when I restart the SEPM service

i'll re-register Liveupdate with SEPM tomorrow and see if that works

cheers

re-registering liveupdate did not work.....however checking the liveupdate log file provides the following

// Start LuComServer
////////////////////////////////////////////////////////////////////////////////
////////////////////////////////////////////////////////////////////////////////
22/11/2011, 10:02:14 GMT -> LuComServer version: 3.3.0.107
22/11/2011, 10:02:14 GMT -> LiveUpdate Language: English
22/11/2011, 10:02:14 GMT -> LuComServer Sequence Number: 20110526
22/11/2011, 10:02:14 GMT -> OS: Windows 2003 Standard, Service Pack: 2, Major: 5, Minor: 2, Build: 3790 (32-bit)
22/11/2011, 10:02:14 GMT -> System Language:[0x0809], User Language:[0x0809]
22/11/2011, 10:02:14 GMT -> IE7 support.
22/11/2011, 10:02:14 GMT -> ComCtl32 version: 6.0
22/11/2011, 10:02:14 GMT -> IP Addresses: 192.168.20.227
22/11/2011, 10:02:14 GMT -> Loading C:\Documents and Settings\All Users\Application Data\Symantec\LiveUpdate\Product.Inventory.LiveUpdate
22/11/2011, 10:02:14 GMT -> Opened the product inventory at "C:\Documents and Settings\All Users\Application Data\Symantec\LiveUpdate\Product.Inventory.LiveUpdate".
22/11/2011, 10:02:14 GMT -> Account launching LiveUpdate is not a logged in user's account
22/11/2011, 10:02:14 GMT -> Combined Product Inventory Flags 0, Permanent Flags 0, Permanent Flags Filter 0
22/11/2011, 10:02:14 GMT -> LiveUpdate flag value for this run is 0
22/11/2011, 10:02:14 GMT -> ProductRegCom/luProductReg(PID=10412/TID=8148): Successfully created an instance of an luProductReg object!
22/11/2011, 10:02:14 GMT -> ProductRegCom/luProductReg(PID=10412/TID=8148): Path for calling process executable is C:\Program Files\Symantec AntiVirus\SescLU.exe.
22/11/2011, 10:02:14 GMT -> ProductRegCom/luProductReg(PID=10412/TID=8148): Destroyed luProductReg object.
22/11/2011, 10:02:15 GMT -> LuComServer version: 3.3.0.107
22/11/2011, 10:02:15 GMT -> LiveUpdate Language: English
22/11/2011, 10:02:15 GMT -> LuComServer Sequence Number: 20110526
22/11/2011, 10:02:15 GMT -> OS: Windows 2003 Standard, Service Pack: 2, Major: 5, Minor: 2, Build: 3790 (32-bit)
22/11/2011, 10:02:15 GMT -> System Language:[0x0809], User Language:[0x0809]
22/11/2011, 10:02:15 GMT -> IE7 support.
22/11/2011, 10:02:15 GMT -> ComCtl32 version: 6.0
22/11/2011, 10:02:15 GMT -> IP Addresses: 192.168.20.227
22/11/2011, 10:02:15 GMT -> Loading C:\Documents and Settings\All Users\Application Data\Symantec\LiveUpdate\Product.Inventory.LiveUpdate
22/11/2011, 10:02:15 GMT -> Opened the product inventory at "C:\Documents and Settings\All Users\Application Data\Symantec\LiveUpdate\Product.Inventory.LiveUpdate".
22/11/2011, 10:02:15 GMT -> Account launching LiveUpdate is not a logged in user's account
22/11/2011, 10:02:15 GMT -> Combined Product Inventory Flags 0, Permanent Flags 0, Permanent Flags Filter 0
22/11/2011, 10:02:15 GMT -> LiveUpdate flag value for this run is 0
22/11/2011, 10:02:15 GMT -> ProductRegCom/luProductReg(PID=10412/TID=11244): Successfully created an instance of an luProductReg object!
22/11/2011, 10:02:15 GMT -> ProductRegCom/luProductReg(PID=10412/TID=11244): Path for calling process executable is C:\Program Files\Symantec AntiVirus\SescLU.exe.
22/11/2011, 10:02:15 GMT -> ProductRegCom/luProductReg(PID=10412/TID=11244): Destroyed luProductReg object.
////////////////////////////////////////////////////////////////////////////////
////////////////////////////////////////////////////////////////////////////////
// End LuComServer

Is the following line something to worry about?

Account launching LiveUpdate is not a logged in user's account
 

Hello,

"Liveupdate encountered one or more errors. Return code = 4" is a generic LiveUpdate error.

What Operating system have you installed Symantec Endpoint Protection Manager on??

Are you using a Proxy??

If yes, The Symantec Endpoint Protection Manager must manually be configured and setup with proxy settings if internet access is routed through a proxy server. The manager is not able to use existing proxy settings that are established or used with Internet Explorer.

Click on Admin-> Servers->In the "view servers pane" select the name of the manager under local site->After selecting your server, in the tasks pane, click on Edit Server Properties, a dialog box will open up->Click on Proxy Server->Fill out your appropriate settings and credentials for HTTP and FTP as required for access.

then need to check the system account proxy. 

Also, Check this Article:

Symantec Endpoint Protection: LiveUpdate Troubleshooting Flowchart

http://www.symantec.com/docs/TECH95790

Hope that helps!!

yeah, it's not the proxy - as I said, it works when I unsinstall it and re-install it

It did however only start happening when I upgraded to 11.0.7

Anyway.... I've removed liveupdate again....deleted left over folders....res-installed....re-registered it...

worked with a manual run live update - and i've just checked again now to see if the scheduled one has worked and it has...

lets hope it stays like this....

cheers

checked it just now - looks like liveupdate is working as normal now

Looks like I needed to do both, re-install liveupdate and re-resgister it

Thanks,