Endpoint Protection

I have just recently finished upgrading our SEPM and clients to 11.6a.  Now I want to get ready to move them to 11.6 MP2.  I downloaded that from File Connect and unzipped it all.  

When I go to add it to the SEPM, it is giving me a "Failed to Add Package" message.  I verified on the SEPM we have version 11.0.6005.652.  I believe the MP2 version is 11.0.6100.  

Any idea why I cannot import this? Is it because the SEPM already sees a package for 11.0.6? If so how do I get the MP2 update on their without upgrading the entire SEPM?

Well..it should add fine..Try Restarting SEPM service then try to add again..or run Management server config wiz then try to add the packge again.

MP2 is 11.0.6200.754

Upgrade the SEPM to RU6 MP2 and during the upgrade it will automatically add the latest package

Hi,

May I ask why you want to upgrade clients only? I always advise to keep the environment as homogeneous as possible. In example the clients in higher version may rapport to the lower version console something it cannot "understand" - hence errors.

The reason is because it take alot more for us to upgrade the server than to upgrade the clients.  

The SEPM upgrade is handled by our server administrators who are extremely busy most of the time.  To give an example it took well over 2 months to get the SEPM upgraded to 11.0.6a whereas it has taken us roughly a month to upgrade all our clients 3000+.

If we have to upgrade the server, I will start working through that process but was hoping we could upgrade the clients without upgrading the server.  

It just seems like by the time we upgrade the server and then all the clients a new update will be out and we will have to start all over again. 

Is there a way to upgrade just the clients without upgrading the server? Is there that much of a difference between 11.6a and 11.6MP2?

Also is there someplace that lists the version numbers for all these updates? I.E 11.6MP2 is 11.0.6200, etc.

I think you can do this using Product Update Option present in Liveupdate Policy.

Download product updates using LiveUpdate Downloads and installs client software updates automatically when users click LiveUpdate or when a scheduled LiveUpdate session runs. When disabled, prevents downloading and installing client software updates, even if another Symantec product runs LiveUpdate on the client computer.

If the LiveUpdate Settings policy specifies that clients download updates from a Symantec Endpoint Protection Manager or Group Update Provider, the updates are in the form of microdefs. If the LiveUpdate Settings policy specifies that clients download updates from a LiveUpdate server, the updates are in the form of MSP (patch) files.

This setting lets you control client software versions. When this setting is disabled, client software can only be manually updated with the Symantec Endpoint Protection Manager Console. When the Symantec Endpoint Protection Manager downloads and processes patches, it creates a microdef, which automatically appears as a new package. The new package appears in the Client Install Packages pane. You can then select the package, and use the Upgrade Groups with Package feature.

Enable scheduling in the 3rd Tab of the Below Image and then in the Advanced Settings Enable Product Updates.

Sorry to say, but i really disagree with  Mudit. That check box would not upgrade  clients  from one version to other, as far as I understand. That is for some other product upgrades, like scan engines upgrades, some patches etc...

There needs to be a clear definiton as to what is meant by "Product Updates."

To me, it would seem like a product update would include upgrading the client when a new version/maintenance patch is available.

Brian, your understanding is absolutely correct. And we can easily veryfy this, if we have access to a SEP Manager.
On SEPM UI>> Go to Policies>> Liveupdate>> Edit Liveupdate Settings Policy>> Advanced Settings>> where we have an option of "Product Update Settings".
Then Click 'Help' on the bottom in the right, where we get enough information on 'Product Update Settings' and 'Download Symantec Endpoint Protection product updates using a LiveUpdate server' options.

There is another way of confirming the same thing- with Installation Guide. As you have downloaded RU6a and RU6MP2 already, in Documentation folder, you may find Installation Guide. As per "Installation_Guide_SEP11.0.6.pdf", as stated on Page: 142, it says,-
"In the Advanced Settings pane, under Product Update Settings, do one of the
following:
■ To automatically update client software, check Download Symantec
Endpoint Protection product updates using a LiveUpdate server.
■ To manually update client software with the Upgrade Groups with Package
feature with the Symantec Endpoint Protection Manager console, uncheck
Download Symantec Endpoint Protection product updates using a
LiveUpdate server."

Hello All ,

Please look for Admin guide page 604 / 605 with following search options in which Product Update Settings is described with a chart .

Antivirus and Antispyware policy settings available
for Windows and MAC

Thank you

To add more to this please find the information below . (Page 142 ) Install Guide

To update Symantec client software with a LiveUpdate Settings Policy

1 In the Symantec Endpoint Protection Manager console, click Policies.

2 Under View Policies, click on and highlight LiveUpdate.

3 In the right pane, on the LiveUpdate Settings tab, click a LiveUpdate Policy.

4 In the lower-left pane, under Tasks, click Edit the Policy.

5 Under LiveUpdate Policy, click Advanced Settings.

6 In the Advanced Settings pane, under Product Update Settings, do one of the
following:

■ To automatically update client software, check Download Symantec
Endpoint Protection product updates using a LiveUpdate server.

■ To manually update client software with the Upgrade Groups with Package
feature with the Symantec Endpoint Protection Manager console, uncheck
Download Symantec Endpoint Protection product updates using a
LiveUpdate server.
7 Click OK, and then apply the policy to a group or a location in a group.

Ok so I would like to push this out initially to a test group of PCs, namely the IS department. Doing this to verify it does not cause any issues with any company software we run, had issues with this in the past when we used McAfee, so better safe than sorry.

If I do it the way Mudit describes I would then need to create a second LiveUpdate policy and apply it to the IS group in the SEPM, which I do not see as being a problem.  This would have actually been a better way to do our previous upgrade as we did everything by using the Deployment and Migration wizard at the advice of Support.

Will this method still work if we are using a LiveUpdate Administrator?  Right now we have a LUA that pushes out the Def files to FTP sites on several servers throughout the company.  The clients then are pointed to a DNS entry, which causes them to connect to one of the severs, round robin type DNS.  

I would assume doing this I need to flag the LUA to pull down client version upgrades correct?

Yes it will work with LUA as well.

Here is an article that you can use for Automatically Upgrading Client instead of Deployment Wizard

Title: 'Upgrading clients by using AutoUpgrade'
Web URL: http://www.symantec.com/business/support/index?page=content&id=TECH96789&locale=en_US

Using that setting, it only would download and patches, and engine updates. That is what is means by product over there, in  liveupdate settings  policy. You cannot upgrade a client version, using that setting...

To upgrade a client you have to either push the  install  package from sepm, or add the  upgraded  package to group

We tried this method to deploy 11.6a and it worked but with a caveat.  We only install AV/AS and we told it to do that.  Tried both by telling it to maintain the features and by creating a package with only the AV/AS in it.  

The caveat is that when it was pushed out it would install everything and then go back and uninstall what was not needed.  This was causing an issue in that when the NAP was installed it caused a network drop.  

I spoke with Support on this and their fix for it was to use the Migration and Deployment Wizard.

Also this will only work if the MP2 package is imported into the server, which right now it is not because it fails when I try to import it.

Hello Everyone,

Learn_learn is right. by using the settings, it only download patches and engine updates. Try  to push the install package from sepm and upgraded package group, thanks sepm. Thanks Learn_learn i really have learned something. Have a good year ahead to you all.

I am getting EXACTLY the same problem as jpj1980  . I am unable to import the SEP 11.0.6200 WINDOWS packages although i could import the MAC package. I have rebooted the SEPM & the SQL server, cleared out the temp folder on the import machines, deleted all the old packages & still it wont add the packages manually. I have tried 3 different downloads incase the download is corrupt which still didnt work. I have however managed to RE-ADD the OLD SEP client install packages fine without any problem. I have also tried importing the package on our 2 different SEPM's and tried to add the package locally from my work desktop still without any sucess.

It points to a BLATANT problem with the 11.0.6200 package for Windows. I would suspect there is some kind of version conflict or parameter that it doesnt like when trying to add the package to the SEPM console. I have used the package (setup.exe) to install a SEP client on a local machine without any problems. I cant see any issues in event log either!!

Any ideas??

After 34 minutes of waiting, a helpful SEP Techinichan advised me of an Alternate way of importing the package not through the EXE. This can be done by the INF File. I wasnt aware of this option but can confirm it works. Please see article http://www.symantec.com/business/support/index?page=content&id=TECH122824  

manager version is 11.0.63

clients are not updating the to the latest version

so tried export the package

kept getting the same message

any suggestions?