I dont know why Symantec insist on every client / server keeping 3 versions of updates at any one time. Seems weird. Surely the latest and 1 roll back should be sufficient.
To configure the minimum number of content revisions in SEP 11.x:
Ensure the following registry DWORD exists:
HKEY_LOCAL_MACHINE\Software\Symantec\Symantec Endpoint Protection\Content\{}CacheEntriesEx
Modify the registry value to correspond to the number of revisions required.
These settings will take effect the next time that content type is updated on the system.
The
For 64-bit use “{1CD85198-26C6-4bac-8C72-5D34B025DE35}”.
Note: The registry DWORD was named CacheEntries prior to SEP 11.0 Maintenance Release 2 (MR2).