Endpoint Protection

We are using the "Multiple Group Update Providers" list with the never update from the default management server option.

We don't want clients that should have a GUP, contacting SEPM for definition updates.

The issue is that we have a few sites/subnets that do not/can not host a GUP, so I need to specify a "Default" GUP if there is none defined in its subnet.

In order to keep the infrastructure required for SEPM to a minimum, I would like to specify the SEPM server as the default GUP.

Can I do this?

Think of it like this. The SEP installed in it is just another client. The SEPM is just the management part and have no method of protection.

Yes you can.. it has nothing to do with SEPM server, the SEP client on the SEPM server will act as a GUP.

@ Bhargrave

Yes, assigning the SEP client on your SEP Server as a GUP should work without a problem.

But I am unsure , how it would help you improvise SEP M infrastructure!

If you want the clients to fail back to a default definition provider , then you may enable option

"Maximum time that clients try to download updates from a Group Update Provider before trying the default management server:" in SEP Manager -> Live update policy and set the fail back time.

If you are running MR6 and above then you can have Multiple GUPS , SEP clients will search for GUPs in its subnet first , then jumps to other GUPS if the previous was unavailable.

If you Assign multiple GUPS in SEP Manager then SEP should download definitions fine

You may not have to configure the SEP client on SEPM to be GUP, since SEPM is the definition provider , it does not make sense to have SEP client on SEPM to be GUP.

We are using the "Multiple Group Update Providers" list with the never update from the default management server option.

We don't want clients that should have a GUP, contacting SEPM for definition updates.

The issue is that we have a few sites/subnets that do not/can not host a GUP, so I need to specify a "Default" GUP if there is none defined in its subnet.

In order to keep the infrastructure required for SEPM to a minimum, I would like to specify the SEPM server as the default GUP."

 

The clients that do not/can not host a GUP, would there be an option just to have them update directly Symantec on the internet?

It does not make sense to do so since the SEPM is already hosting content and would be a duplication of what the SEPM already does. You could just put those clients in their own group with their own LiveUpdate Settings policy that does not define a GUP, i.e. going only to default management server, or to internet (per above post).

sandra