By default when VSE is installed, a default update task is enabled which runs at 5pm (randomised by an hour) local time.
Because you're managing via EPO, you have also created update tasks there, but the default one will remain active.
There is a setting (think it's under "VSE General" - someone will have to correct me) for "Disable Default Update Task".
Thanks for the reply
For 8.7 it's under the User Interface Policies and for 8.8 it's under the General Options Policies.
I already have this ticked and if I check the log for the default update task on the clients it hasn't run since last year.
Any other ideas?
Only other thing I can think of is that Global Updating is enabled and running:when the new dat is downloaded from McAfee.
Can't really provide any more info on this (not at work, not near EPO etc etc), but I'd be checking that as a possible culprit.
Thanks for the pointer. I'll check the Global Update settings.
Global updating was enabled.
I've disabled it now so I'll see what happens between 5-6 today.