Technical Anshu
Tutorials Blog
🔄 Content and Definitions

Keep SEP Clients Updated With the LiveUpdate Policy

Installing the agent is the visible half of the job. The invisible half decides whether the protection is real a month later: virus definitions and content must keep flowing to every client, every day. SEP has a deliberate design for this — the manager fetches once, the clients pull from the manager — and a policy that controls the exceptions. This guide explains the flow in plain words, without pinning settings that vary between setups.

✍️ Technical Anshu🖥️ SEPM Policies⏱️ Set it once, watch the date
🎥 Watch the full deployment in the video — SEPM console, wizard and push, step by step

A managed SEP client does not normally wander the internet looking for updates. It talks to its manager: SEPM downloads new content once, and each client picks that content up from the manager on its regular check-ins. That design saves office bandwidth and keeps updates under your control. The LiveUpdate policy is where you decide the details — most importantly, whether clients may also fetch content directly, and on what schedule.

How content reaches a managed client
LiveUpdate servers --> SEPM downloads content once SEPM --> every client pulls content at check-in Client definitions date on the Clients page = the number that tells you the flow is alive
Manager in the middle, clients behind it. If definitions stop moving, the break is in this chain — find which link. (Illustrative panel.)
1

How Content Normally Flows

Understanding the chain makes every later update problem easy to locate:

  1. The manager connects to the LiveUpdate servers and downloads new definitions and content.
  2. Clients receive that content from the manager when they check in — no per-PC internet downloads needed.
  3. A client that cannot reach the manager cannot receive this flow; its definitions freeze at the last successful check-in.
  4. The definitions included in a fresh install package are only a starting point — the flow takes over from there.
2

What the LiveUpdate Policy Decides

In SEPM, a LiveUpdate policy is attached to your client groups and controls how clients get content. Exact options vary by version and setup, but the decisions are these:

  1. Whether clients take content only from the manager, or may also run LiveUpdate directly against the external servers — useful for laptops that are rarely in the office.
  2. The schedule — how often clients look for new content.
  3. Settings are applied per group, so laptops and fixed office PCs can honestly have different answers.
  4. Change the policy in one group first and watch a day, like any other rollout — policy mistakes also deploy at scale.
3

Group Update Provider for Big or Branch Sites

If one site has many PCs and a thin connection to the manager, every client pulling content across that link wastes it. SEP's answer is a Group Update Provider (GUP):

  1. One designated client at the site downloads content from the manager.
  2. The other clients at that site take their content from that local provider instead.
  3. The manager still manages everyone — only the content's last hop moves closer.
  4. Small single-site offices honestly do not need this; it earns its keep at branch sites and large floors.
4

The One Number to Watch

You do not need a dashboard obsession. One habit catches nearly every update problem early:

  1. On the Clients page, glance at the definitions date across your groups whenever you are in the console.
  2. A client a day behind is normal life (it was off); a client many days behind while switched on is a broken link in the chain.
  3. Investigate the worst offenders first: is the PC reaching the manager at all, and does its group's policy allow it content?
  4. A fleet whose dates are fresh is a fleet whose deployment is still working — this is the cheapest health check you own.
🟡 Honest framing: exact LiveUpdate policy options and screen names differ between SEP versions and between sites that use additional update sources. The flow described here — manager fetches, clients pull, policy decides the exceptions — is the stable part. Check the screens in your own console rather than memorising another version's.

🎥 Watch the Full Video

See the complete SEP agent deployment on screen — every wizard screen and the result in the console.

▶ Watch Full Video
❓ Common Questions (FAQ)

Do managed SEP clients download definitions from the internet directly?

By default, managed clients receive content from their manager, which downloads it once for everyone. The LiveUpdate policy in SEPM controls whether clients may also download directly, which some offices allow for laptops that travel.

What is a Group Update Provider in simple words?

A nominated PC at a site that fetches content from the manager once and shares it with the other clients at that site, so dozens of PCs do not each pull the same definitions across a slow link.

How often should client definitions update?

New content is released frequently — daily or more often — and healthy clients stay within a day or so of current. The practical check is the definitions date on the Clients page: investigate any working PC that falls many days behind.

This guide is based on the Technical Anshu video on deploying the SEP agent • Stuck on a step? Ask in the video comments 🙏