In Symantec Endpoint Protection Small Business Edition (cloud), the update starts and sends a request to the server for a restart. Servers are protected during this stage.
During the pre-restart phase, the Endpoint Protection agent user interface is unloaded and subsequently reloaded. Note that this behavior is only apparent to users doing an interactive LiveUpdate or if the user happens to have the client user interface open during the silent run. After the restart, the agent user interface closes, and the tray icon disappears. When the update is complete, it is re-loaded.
During the LiveUpdate process, even though the server requires a restart, it continues to receive and apply policies and send events to the backend.
Servers enter an 'attention' state because of the required restart. It is important to restart as soon as possible. After restart, the update is completed automatically.