The Symantec Endpoint Protection (SEP) client's system tray icon (shield) displays a green dot indicating connectivity to the Symantec Endpoint Protection Manager (SEPM) briefly when the SEP service starts
After a very short time - usually less than 5 seconds - the green dot disappears, and the client indicates it is not connected to a SEPM
The SEPM Console shows the affected client(s) as offline
The SEPM Internet Information Services Web site logs display 200 level (success) events for the affected client(s) communications
Sylink debug logs from the affected SEP client show a 500 level (server side error) event when attempting to download the index file from SEPM
This issue occurs when a Symantec Endpoint Protection (SEP) client is registered in the Symantec Endpoint Protection Manager (SEPM) with a Group ID for a Group that no longer exists. This happens most frequently in environments using Active Directory Synchronization.