Hello,
I have a problem with my SEP clients. They are all (about 200 PC & Servers) stuck to a previous virus definition. Proactive Threat Protection and Network Threat Protection get and keep the latest definitions. I have tried to solve the problem by upgrading SEPM to the latest version (12.1 RU6 MP5) but this did not fix the problem. Then I upgraded manually the Virus Definition at a client but after 30min the client rolled it back to the previous definition. After that I upgraded the client to the latest version but again after about 30min the definiton was rolled back.
Run the SymHelp tool on client and server only error that I found was at "Symantec Eraser Control driver". The service start mode is set to disabled, when it should be Sysemstart.