Sorry for the vague title. Theres a lot more going on and we can't really isolate one specific issue. We've tried multiple troubleshooting steps to no avail. Trying to come up with the best method to tackle this issue.
Roughly 100 of our (1100) endpoints are out-of-date due to Virus Definitions not automatically updating. The out of date number was over 500 due to IPS signatures being out of date, but we were able to (temporarily) mitigate that issue by enabling Third-party updates and using GPO to push out an updated JDB file. Still, most clients are not updating automatically, including the IPS signatures which are still on the version we pushed out manually. We're afraid that out of date number is going to shoot back up once the IPS signatures get out of the allowable range again.
This next part is strange, but hear me out. If i were to go to any of these affected endpoints, open the SEP GUI and click on Live Update manually; the client will go to the server, get all of the updated signatures and continue to update automatically going forward. This also includes IPS signatures. If we try to automate that process by running sepliveupdate.exe from command line using GPO, nothing happens and the client doesn't get any updates. I guess my real intention is to figure out what's happening differently when Live Update is initiated from the SEP GUI as opposed to the command line tool and is there a way to automate this.
We would really like to get this corrected, that way all of the endpoints continue to update automatically. Reinstalling affected clients is also out of the question considering there is over 500 in question, scattered amongst over 20 remote sites. There's nothign in the logs and SymHelp tool doesn't turn up anything relevant on on the affected clients. Also tried a database validation on SEPM, but that didn't make any difference either. Any advice would be greatly appreciated, we're open to any ideas. Thanks.