Windows 10 Anniversary Edition update introduced a new feature named the Linux sub-system. When inside the Linux BASH shell the Endpoint Protection firewall blocks updates even when configured to allow. Updates are allowed if you disable the firewall.
Windows 10 Anniversary Edition update or newer with the Linux sub-system feature installed
Endpoint Protection with firewall component
If firewall traffic log is enabled for the blocking rule, the blocked application path/name will be logged with question marks ("??????") or other odd character combinations (e.g. Asian characters).
The Linux subsystem is considered beta in Windows 10 Anniversary Edition. Currently, it has incomplete support for the required API. The current API doesn't return enough information to be useful by the Symantec drivers