SEP appears to just stop updating signatures and running scheduled scans on Mac clients - w/o as much as a peep from SEPM or the clients. The only indication we could get so far is an "old signatures" report - which we have adjusted since from 14 to 2 days, and programmatically check for certain log file age giving us an idea when the last scan was run.
I'd like reiterate that this loss of protection appears to be silent: there's no indication in the icon, or in the management console, that a client's last sigs update failed, and that it didn't run a scheduled scan.
Note in the screenshots below how the "last updated" timestamp is April 4 while the Definitions are from March 25 - over 10 days old.
This started happening on 12.1.5 and keeps happening on 12.1.6 (12.1.6465.6200f1), on random systems.
How do we fix this?
Thanks!