Plan your network architecture

Install or migrate the management server

Whether you install the product for the first time, upgrade from a previous version, or migrate from another product, you install Symantec Endpoint Protection Manager first.

See Installing the management server and the console.

See About migrating to Symantec Endpoint Protection.

Increase the time that the console leaves you logged on

The console logs you out after one hour. You can increase this period of time.

See Increasing the time period for staying logged on to the console.

Create groups and locations

You can add the groups that contain computers based on the level of security or function the computers perform. For example, you should put computers with a higher level of security in one group, or a group of Mac computers in another group.

See How you can structure groups.

See Adding a group.

You can migrate existing Active Directory groups when you install Symantec Endpoint Protection Manager. If you are running legacy Symantec protection, you usually upgrade policy and group settings from your older version.

See Importing an existing organizational structure.

You can apply a different level of security to computers based on whether they are inside or outside the company network. To use this method, you create separate locations and apply different security policies to each location. In general, computers connecting to your network from outside of your firewall need to have stronger security than those that are inside your firewall.

You can set up a location that allows the mobile computers that are not in the office to update their definitions automatically from Symantec's servers.

See Adding a location to a group.

Disable inheritance on special groups

By default, groups inherit the security and the policy settings from the default parent group, "My Company." You must disable inheritance before you can change the security and the policy settings for any new groups you create.

See Disabling and enabling a group's inheritance.

Change communication settings to increase performance

See Randomizing content downloads from the default management server or a Group Update Provider.

See Configuring push mode or pull mode to update client policies and content.

For more information, see the Symantec Endpoint Protection sizing and scalability white paper.

Modify the Firewall policy for the remote computers group and the servers group

See Customizing firewall rules.

See Managing locations for remote clients.

Modify the Virus and Spyware Protection policy

Activate the product license

Purchase and activate a license within 60 days of product installation.

See Activating your new or renewed Symantec Endpoint Protection 12.1 product license.

Prepare computers for client installation (optional)

See About firewalls and communication ports.

See Preparing for client installation.

Install the client software with the Client Deployment Wizard

Create a client installation package and deploy it on your client computers.

As a best practice, change the name of the default export package to a name that uniquely identifies the package in your system.

See Deploying clients using a Web link and email.

See Configuring client installation package features.

See Exporting client installation packages.

Check that the computers are listed in the groups that you expected and that the client communicates with the management server

In the management console, on the Clients > Clients page:

See Troubleshooting communication problems between the management server and the client.

Make one client computer in each network segment into a detector for unprotected endpoints

For each network segment, enable one client computer to detect when a new computer that is not protected is added to the network. These computers are called unmanaged detectors and the option is Enable as Unmanaged Detector.

See Configuring a client to detect unknown devices.

Configure the content revisions available to clients to reduce bandwidth

Set the number of content revisions that are stored on the server to reduce bandwidth usage for clients.

For more information about calculating storage and bandwidth needs, see the Symantec Endpoint Protection sizing and scalability white paper.

Check the LiveUpdate schedule and adjust if necessary

Make sure that the content updates download to client computers at a time that affects users the least.

See Configuring the LiveUpdate download schedule for Symantec Endpoint Protection Manager.

Configure Symantec Endpoint Protection Manager to send email alerts

Alerts and notifications are critical to maintaining a secure environment and can also save you time.

See Managing notifications.

Configure notifications for a single risk outbreak and when a new risk is detected

Create a notification for a Single risk event and modify the notification for Risk Outbreak.

For these notifications, do the following:

See Setting up administrator notifications.

Exclude applications and files from being scanned

You can increase performance so that the client does not scan certain folders and files. For example, the client scans the mail server every time a scheduled scan runs.

You can improve performance by excluding the folders and files that are known to cause problems if they are scanned. For example, Symantec Endpoint Protection should not scan the proprietary Microsoft SQL Server files. To enhance performance and avoid any chance of corruption or files being locked when the Microsoft SQL Server must use them, you should create exceptions to prevent scanning of the folders that contain these database files.

For more information, see the knowledge base article, How to exclude MS SQL files and folders using Centralized Exceptions.

You can also exclude files by extension for Auto-Protect scans.

See Creating exceptions for Symantec Endpoint Protection.

See Customizing Auto-Protect for Windows clients.

See About commands you can run on client computers.

Run a quick report and scheduled report after the scheduled scan

Run the quick reports and scheduled reports to see whether the client computers have the correct level of security.

See About the types of reports.

See Running and customizing quick reports.

See Creating scheduled reports.

Check to ensure that scheduled scans have been successful and clients operate as expected

Review monitors, logs, and the status of client computers to make sure that you have the correct level of protection for each group.

See Monitoring endpoint protection.