There are four machines showing yellow question marks today. Of the four, using the edit button, all are showing "File system shield inactive". However, they all show "last update" for that shield as occurring earlier this morning. One of them is also showing VPS definition 150701-2 (the machine was not running yesterday when I did the VPS push). This machine shows "Virus definitions last updated" on 7/1/15. The rest are showing VPS definition 150706-1 with "Virus definitions last updated" early yesterday morning, BEFORE I did the VPS push. All of these machines also show as "online".
In itself, this raises a couple of questions:
1. If the "last update" under "File system shield" is not the VPS, then what, exactly, was "updated" this morning?
2. If my VPS push actually succeeded yesterday, as Avast reported that it did, then why are the machines with current VPS definitions showing "Virus definitions last updated" several hours before I executed the push? (Machine clocks on the server and client machines are correct within a few minutes.)
Beyond that, I just physically visited two of the machines discussed above and opened the EndPoint Protection client. One has the most recent VPS; the other has an older version. Both are showing "some shields are turned off", but both are ALSO showing "subscription expired". Attempting to turn on the shield in the client fails under those circumstances.
I should point out that I have program updates turned off in the SOA for this group; the machines only receive VPS updates automatically.
I also need to mention that any "fix" for the problem with these machines is not permanent. They may be randomly chosen again to show a problem within a few days of the "fix". It's just that, due to the random nature of the issue, I have yet to see the same machine report a problem two days in a row.
I have a SAMBA 3 (NT-emulation) domain running on a Linux server, not a true Windows domain. Only some of the Windows domain administration tools work with this domain, so I would be surprised if the Services snap-in would work. It's worth investigating for future purposes, but I would add that having to restart services on several machines every day, even remotely, isn't a very good solution to this problem.
I zipped the Setup.log and tried to attach it to this message. This failed; "zip" is not an allowed extension, nor is any other archive file extension. Wetransfer.com appears to have a learning curve and a download requirement (I don't know for sure; I didn't go further than the "get wetransfer" button), so I would just as soon not deal with that sort of thing.
So I renamed the file to a .png extension, which should be acceptable. Just remember to rename it back when you get it. If that doesn't work, perhaps you could send me a private message here at this board with an email address that I can send the file to?
Thanks for all your help.