Endpoints Online but Virus Signature Updates Are Not Working on Some Clients

Sameena Jameel Lv1Posted 2026-Jun-03 12:30

We are using Sangfor Endpoint Secure in our environment. Recently, I noticed that some client PCs are showing online in the management console, but their virus signature database is not updating properly. I have already checked internet connectivity, agent service status, and communication with the management server, but the issue still persists on a few endpoints.

Has anyone faced a similar issue where endpoints remain connected but antivirus signatures do not update automatically? Are there any specific logs, services, or troubleshooting steps that I should check from the Endpoint Secure console or client side?

Any guidance would be appreciated.

Thanks.

Humayun Ahmed has solved this question and earned 20 coins.

Posting a reply earns you 2 coins. An accepted reply earns you 20 coins and another 10 coins for replying within 10 minutes. (Expired) What is Coin?

Enter your mobile phone number and company name for better service. Go

Re-register or Reinstall the Agent.

If only a small number of endpoints are affected:

Remove the endpoint from management.
Re-register the agent.
If necessary, reinstall the agent package.
Force a signature update.

This often resolves corrupted local update components.
Is this answer helpful?
Muhammad Abid Lv3Posted 2026-Jun-03 13:01
  
I have encountered a similar situation in a few deployments. If the endpoint is showing Online in Sangfor Endpoint Secure but the virus signature database is not updating, I would recommend checking the following points:

Verify Update Policy Assignment
Ensure the affected endpoints are assigned to the correct antivirus update policy.
Compare the policy with a healthy endpoint that is updating successfully.

Check Update Task Status
In the Endpoint Secure console, review the Antivirus Update Task and confirm whether the update job is being executed successfully or failing with an error.

Review Client Logs
Check the Endpoint Secure Agent logs on the affected client.
Look for update-related errors such as download failures, repository access issues, timeout messages, or signature verification errors.

Confirm Access to Update Source
If updates are downloaded through the management server, verify that the server itself is receiving the latest virus signatures.
If clients update directly from the internet, check whether any firewall, proxy, DNS, or web filtering policy is blocking access to the update servers.

Check Disk Space and Permissions
Insufficient disk space or corrupted update folders can prevent signature updates even when the agent remains online.

Restart Endpoint Secure Services
Restart the Endpoint Secure Agent services on the affected endpoints and trigger a manual signature update from the console.

Compare Agent Versions
Ensure all affected endpoints are running the latest supported Endpoint Secure agent version. Older agents may experience update synchronization issues.

Check Management Server Health
Review server logs for update synchronization failures.
Verify that the antivirus signature repository on the management server is current and updating normally.

As a troubleshooting step, try forcing a manual update on one affected endpoint and review the exact error message returned in the client log. That usually helps identify whether the issue is related to connectivity, policy configuration, repository synchronization, or local client corruption.

Has anyone else seen this behavior in recent Endpoint Secure versions? It would be interesting to know whether there are any known bugs or hotfixes related to antivirus signature updates.

I Can Help:

Change

Moderator on This Board

2
1
0

Started Topics

Followers

Follow

1
1
0

Started Topics

Followers

Follow

1000
207
99

Started Topics

Followers

Follow

Trending Topics

Board Leaders