The Symantec Endpoint Protection Manager (SEPM) sends an email notification to the System admin users email addresses in the event of database failure. After changing the email address of a System Admin user within the SEPM, these email alerts are still sent to the previous email address.

A 'database down' email is formatted as follows:

From: SEPM_Server@<domain> (In some cases the sender is SPC_Server@<domain> or a custom email address)

Subject: Database is down

Body:

Message from:

Server Name: <Server Name>

Server IP: <Server IP Address>

The Symantec Endpoint Protection Manager database has gone down and needs immediate attention.

The SEPM caches the email addresses of the System Admin users when the Symantec Endpoint Protection Manager service starts. The cache is not updated except by a service restart.

To update the cached System Admin users account email addresses, restart the Symantec Endpoint Protection Manager service. After the service is restarted, subsequent email alerts will be sent to the updated email addresses.