SEP v12 EOL - No more AV def updates after 4/3/21 in SEPM v14 environment?

[John Owens]

SEP 14.x SEPMs will be able to provide content however no testing will be done for content for 12.1.x clients any longer. So there is a big risk there. If you did run into issues say for content crashing a windows client or server running sep 12.1.x there will be no support offered.

It is suggested to get these systems to 14.x as soon as possible. 

[Aleksandar Devecerski]

Hello

Since Friday last week, all of my remaining v12 clients have "Out-of-date" status (yes, I know I should go to v14, but these are Windows Server2003/XP computers which run software "alergic" to newer OSs). More precisely, Sonar content is in question.
SEPM is v14.3 MP1, fully updated, nothing else to report. Clients in question are v12.1.6 MP10.
Anyone else seeing this?

Regards

[tzamarin]

We are seeing this in our environment as well on our 2003 servers.

------------------------------

------------------------------

[Darrel Maltby]

What view are you using in your SEP Manager?  I looked at our Windows 2003 servers ("allergic" to newer OS's as well... I like that term :) ), and I'm seeing many of them are also showing October 27 or 28, but also a few showing November 2 r1 for SONAR content.

I realize Definition updates for SEP 12 will stop on April 3, 2021, but we're not there yet, and according to Broadcom's SONAR definition download page, current SONAR definitions are still supported for SEP 12 and 14:

https://www.broadcom.com/support/security-center/definitions/download/detail?gid=sonar

How are multiple customers experiencing the same issue with similar SONAR dates on their legacy systems?

EDIT: I just looked at the LiveUpdate Downloads for our SEPM, and noticed most of the content only refers to 14.0, 14.2 or 14.3.  SONAR and IPS appear to be among those that don't have 12.x signatures within the SEPM anymore.  So does that Broadcom is pulling the definition support plug a little early?

[John Owens]

Hi All,

Intelligent Updater for 12.1.3 and newer is still updated and being published. - Virus Definitions & Security Updates (broadcom.com). I would check your log.liveupdate logs to see what could be happening or your Sylink logs if clients are getting content from the SEPM.

------------------------------
John Owens
Strategic Support Engineer | Symantec Enterprise Division (SED)
Symantec
United States
------------------------------

[Aleksandar Devecerski]

Hello guys

John, clients seem to be updating as usual (screens are from one of them).

Few days ago I tried manual SEPM update, made no difference.
Green dot is there, commands from SEPM console are executed normally.

I've checked liveupdate logs (if by that you meant LiveUpdateTask*.log files located in Symantec Endpoint Protection Manager\tomcat\logs folder), didn't see anything out of the ordinary. Few warnings, no errors/criticals.
If not these, please specify which exact logs should we check.

Bobkatt2020, this is just "Out-of-date Endpoints" report (web console -> Endpoint Status -> Out-of-date).

Regards

[tzamarin]

The view I am using is when you come to the dashboard and clicking on the number of clients that are showing "out of date" here is my screenshot (ignore the client showing OOD on antivirus content that isnt a 2003 server)

------------------------------
Tracey Z
------------------------------

[Kristiansen]

We have experience the same issue. Sonar defs stuck at 02/11/20 Rev 1 on Windows 2003 client with SEP 12.1.

Manually downloading the definition from

https://www.broadcom.com/support/security-center/definitions/download/detail?gid=sonar
makes no different. Looks like there is a bug in the definition. I have created a case at Broadcom, but they won't look at the issue without a support agreement for "Extended support on 12.1"

All our legacy client have Sonar defs from 2/11/20 or older.

------------------------------
Syscom AS
------------------------------

[Aleksandar Devecerski]

So, it looks like we've reached the definite end of v12.x life. SEPM definitions, for v12, are now stuck at May 20th.

As I really cannot retire these clients and, as mentioned earlier, cannot upgrade them to v14 compatible OS, something else has to be done.
Anyone here in similar situation? Any plans or thoughts how to resolve this situation?

[John Owens]

You may need to look into locking these down as much as possible with a Firewall.  As content has stopped these systems will not be protected from any new threats after 5/20.

------------------------------
John Owens
Strategic Support Engineer | Symantec Enterprise Division (SED)
Symantec
United States
------------------------------

[John Owens]

FAQ - Endpoint Protection 12.1.x content (definitions) no longer available for download (broadcom.com)

------------------------------
John Owens
Strategic Support Engineer | Symantec Enterprise Division (SED)
Symantec
United States
------------------------------