14 RU1 MP1 clients not updating IPS definitions
Article ID: 175168
Updated On:
Products
Issue/Introduction
Symantec Endpoint Protection (SEP) 14 RU1 MP1 clients will report as having out of date IPS definitions when reporting to a 14.2 SEPM while a mix of 12.1, 14 RU1 and 14.2 clients are present in the environment.
C:ProgramDataSymantecDefinitionsSymcDataspcCIDSdef
Log.LiveUpdate present at C:ProgramDataSymantecLiveUpdate on the SEPM machine will show:
5/20/2019, 21:54:35 GMT -> Added package to cache...
5/20/2019, 21:54:35 GMT -> DIS - UPDATE("C:ProgramDataSymantecLiveUpdateDownloadsUpdt437", "C:ProgramDataSymantecDefinitionsSymcDataspcCIDSdeftmp1ff3.tmp") <BEGIN>
5/20/2019, 21:54:35 GMT -> Updating C:ProgramDataSymantecLiveUpdateDownloadsUpdt437CATALOG.999 at C:ProgramDataSymantecDefinitionsSymcDataspcCIDSdeftmp1ff3.tmp.
5/20/2019, 21:54:35 GMT -> CopyFile failed with error 0x3.
5/20/2019, 21:54:35 GMT -> DIS - UPDATE(0x802A000B) <END>
5/20/2019, 21:54:35 GMT -> Progress Update: PATCH_ERROR: Patch File: "C:ProgramDataSymantecLiveUpdateDownloadsUpdt4371558194594jtun_ips_sep190429061-190518061.x01", Script File: "C:ProgramDataSymantecLiveUpdateDownloadsUpdt437spcCIDSdefHP.dis", HR: 0x802A000B
5/20/2019, 21:54:35 GMT -> HR 0x802A000B DECODE: E_DIS_COPY_FILE_IN_USE
5/20/2019, 21:54:35 GMT -> Progress Update: PATCH_FINISH: Patch File: "C:ProgramDataSymantecLiveUpdateDownloadsUpdt4371558194594jtun_ips_sep190429061-190518061.x01", Script File: "C:ProgramDataSymantecLiveUpdateDownloadsUpdt437spcCIDSdefHP.dis", HR: 0x802A000B
5/20/2019, 21:54:35 GMT -> HR 0x802A000B DECODE: E_DIS_COPY_FILE_IN_USE
5/20/2019, 21:54:35 GMT -> EVENT - PRODUCT UPDATE FAILED EVENT - Update available for SEPM CIDS Signatures 12.1 RU2 - MicroDefsB.CurDefs - SymAllLanguages. Update for CurDefs takes product from update 190429061 to 190518061. Server name - liveupdate.symantecliveupdate.com, Update file - 1558194594jtun_ips_sep190429061-190518061.x01, Signer - cn=Symantec Corporation,ou=Locality - Tuscon Prod 1 and 2,ou=Product Group - LiveUpdate,ou=SymSignature 2005,o=Symantec Corporation, package install code 0. The Update executed with a result code of 1821, => The install script for this update tried to copy a new file onto a file that was in use. LiveUpdate aborted the update install.
Environment
14.2 SEPM with 14 RU1, 12.1 and 14.2 SEP clients.
Cause
Within the SEPM database, the LuContentCatalog XML content includeds the wrong IPS/CIDS content properties.
Resolution
Contact Symantec support and an appropriate fix tool can be provided.
Feedback
