On a managed Symantec Endpoint Protection (SEP) client, the gold shield in the system tray on the client has a red circle-backslash symbol over it. Hovering over the shield shows an error:
Download Insight is disabled

Right-clicking the shield and selecting Enable Symantec Endpoint Protection fixes the error, but it re-appears after reboot.

Opening the SEP client interface and clicking the Fix button fixes the error, but it re-appears after reboot.

Download Insight is disabled.
Click Fix to enable Download Insight.

Download Insight is disabled in the Virus and Spyware Protection policy applied to this client, but the option is not locked.

Solution 1: Enable Download Insight in the Virus and Spyware Protection policy applied to this client.

1. Login to the Symantec Endpoint Protection Manager (SEPM) and go to the Policies section on the left.
2. Click Virus and Spyware Protection under Policies.
3. In the right pane, double click the policy that is in use by the affected client, to edit it.
4. Go to the Download Protection section of the policy.
5. Check the box beside Enable Download Insight to detect potential risks in downloaded files based on file reputation.
6. Click the OK button to save the changes.
7. Wait for the client to check in and receive the new policy.

Solution 2: Leave Download Insight disabled in the Virus and Spyware Protection policy applied to this client and lock the option.

1. Login to the Symantec Endpoint Protection Manager (SEPM) and go to the Policies section on the left.
2. Click Virus and Spyware Protection under Policies.
3. In the right pane, double click the policy that is in use by the affected client, to edit it.
4. Go to the Download Protection section of the policy.
5. Click the padlock beside the Enable Download Insight to detect potential risks in downloaded files based on file reputation checkbox, to lock the setting.
6. Click the OK button to save the changes.
7. Wait for the client to check in and receive the new policy.