Can you check if these are set right?
Endpoint Protection shows definitions out of date at 30 days even when configured to notify after more than 30 days
http://www.symantec.com/business/support/index?page=content&id=TECH186964
There are two types of notifications that can be configured via the Symantec Endpoint Protection Manager (SEPM): Windows Security Center (WSC) and SEP client notifications.
The SEPM allows for a maximum of 99 days before the SEP client will notify about out of date definitions, but the maximum time before a WSC notification is 30 days. When determining when to notify on out of date definitions, the SEP client will use the lower of these two time windows.