I've been working with someone on an Ironport S160 regarding an issue where users will be blocked from website in the morning. But later in the day the block will go away and the user will be able to access the website normally. The only pattern I've really observed is this: when looking up a user's IP address I'm able to see "Allow" listing where it shows their Active Directory username and the IP next to it but when the blocking occurs it show a "Block" status and shows their computer's name instead of the Active Directory username. I don't know if it's coincidence but a lot of the occurrences will show a listing for "http://liveupdate.symantecliveupdate.com" then the blocks will occur. The opposite will happen for them where the "http://liveupdate.symantecliveupdate.com" listing will show up and the block will go away.
The users it affects are random from what I've seen. It doesn't seem to be a specific group or division. Has anyone come across anything like this in their experience?
