The Symantec Endpoint Protection Manager (SEPM) does not update definitions automatically, but when Luall.exe is manually run, new content is successfully downloaded.
When LiveUpdate is executed through the SEPM console, the result is an error "Return code =2"
When LiveUpdate runs automatically, it uses the Local System account. When a user manually runs LiveUpdate, it uses the logged in user's account. In some scenarios the Local System account does not have enough privileges to download content from the internet. This is typically seen in environments with certain proxy servers or firewalls.