I have just upgraded SEP from version 11.0.5 to 12.1.4013 on my WinXP SP3 machine. This is a managed installation. I have SEPM 12.1.4013 installed.
Every few minutes, I see denied traffic from WinXP PC to the following IP addresses (I've discovered 2 IPs so far): 166.98.6.70, 143.127.102.40. Those IPs belong to Symantec. It appears SEP 12 is trying to download binary/octet-stream (content type) over http secure (port 443). I set my firewall to deny all octet-stream downloads (EXE, DLL etc) over HTTP, HTTPS and FTP from all internal machines (SEPM machine is allowed to download over FTP).
What is SEP 12 trying to download? Why does SEP still try to get anything directly from the internet instead of the SEPM machine? How can I stop SEP from getting anything directly from the internet?