Video Screencast Help

Changing "Client Features" After Install

Created: 16 Jan 2008 • Updated: 22 May 2010 | 13 comments

I have SEP 11.0.1 installed on several 32bit XP system.  At the time, I installed all possibly components of SEP.  We are a healthcare institution and don't have a lot of money for nice hardware.  So we're experiencing issues with machines taking a VERY long time (2+ minutes) to log users in to the point where they can start up programs.  I think I'd like to try and reduce the memory footprint of SEP by only having the AV/AS piece installed.  I have figured out how to add a customizable "Client Features" as an option for the "Install Packages" tab under CLIENTS.  When I edit the install package on that tab and choose my AV & AS feature, the client never updates itself with these new parameters.  Even if I run a command on the client to update content, I think it only updates it's AV defs.  So if I deploy to a large group, and decide I want to change the installed features, how do I deploy the new features?  I thought it was supposed to do it on it's own.  I know that when I put the new 11.0.1 package as an option in the "Install Packages" it pushed out the new client no problem (mostly).  Thanks for your help!


Message Edited by Joltman on 01-16-2008 07:35 AM

Comments 13 CommentsJump to latest comment

danwilli's picture
You may simply re-deploy the client software with the new install package (with your new feature set).  The client will install over the top of the old client software, taking the new settings.
Alternatively, you can do this on a per machine basis, by using the "Change" button in "Add/Remove Programs".  You will be taken to a featureset screen, be prompted to select the features you do or do not want, and then it will apply the new settings to that one machine.
Joltman's picture

OK.  How do I "redeploy"?  When I was moving clients from 10.2 to 11, I was using the "Find Unmanaged Computers" option under the Clients tab.  I don't want to go to every computer I've deployed so far and manually choose their features.  Thanks!


Joltman's picture

OK.  I found the ClientRemote.exe file.  It's kinda weird that it's not in the Program Files under Start Menu.  Kinda janky that it's not included in the Management tool to begin with.  So what I ended up doing was exporting a single install file for each of my groups that will grab the install features that I choose.  I then push that out to clients using the ClientRemote.  I wish there was an easier way where I could simply check a box in a policy to turn on and off the components ( Proactive Threat Protection, Network Threat Protection) in the managment console, but I guess if I have to do this, I have to do this.

danwilli's picture
You may use the tool provided START>"All Programs">"Symantec Endpoint Protection Manager">"Migration and deployment Wizard".
You can then push to an IP/Hostname, a range of IPs, or a txt list of IPs.
danwilli's picture
Network threat protection alone, can be enabled or disabled directly through the enpoint manager as well:
Goto 'Clients', select you group, right click a client(s), and from the context menu, select 'Run a command on clients' and you will see options to enable/disable Network Threat Protection.
Matt Pierce's picture

Here is how things are supposed to work as I understand the documentation.

New version of software is imported into Client Install Packages in the SEPM console
Admin\Install Packages
    Client Install Packages
       Add Client Install Package.

Create Client Install Settings

Admin\Install Packages
    Client Install Settings
       Add Client Install Settings

I've typically chossen Remove all previous logs and policies.  We are trying to reconfigure clients with a different set of modules.

Create a Client Install Feature Set.
Admin\Install Packages
    Client Install Feature Set
       Add Client Install Feature Set.

I've typically used the default  Antivirus, Antispyware, Proactive Threat protecton.

Next I assign the Install Package to a managed group.

Select Clients\Install Packages.

Add Client Install Package or Edit an existing package.

Again, we uncheck the maintain existing client features when updating, choose our prefered feature set.  

Now according to the documentation all our happily managed 11.0.780.1109 clients should pull down the new 11.0.1000.1375 clients reinstall and reconfigure as defined.   Sadley that is not happening.  In our Liveupdate policy we have "Download Syamntec endpoint Protection product updates..."  checked.

Server Settings
    Used the default managment server..   checked
    Use a LiveUpdate server... checked
    Use the Grooup Update Provider as the default Live Update Server   Checked.

Still no updates.  I'd hate to do another deployment of my clients, but its looking like thats the way it will happen.

danwilli's picture
@joltman, to redeploy, you would use Start>All Programs>SEPM>Migration and deployment wizard
Joltman's picture

Everyone, thanks for your replies!


I see the Migration and Deployment Wizard.  Unfortunately, it's not in the documentation.  The Install Guide is telling me to go to Program Files then Symantec, then EndPoint Security, then the tomcat directory, then bin and run Client Remote.exe.  This would have been nice to have in the documentation, which I've stated in other threads, is less than desirable.

Update:  Since SEP won't re-install the current version of software when you change the install policy, I had to do this manually.  This is a major flaw in the product if you ask me.


JoeG's picture
Actually, it's been working fine for me to re-deploy using the SEP manager.  So far it's updated about 175 of my 200 clients across the country.
Joltman's picture


Did you start out with 11.0.785 or did you start with 11.0.1000?  I started with 785 and upgraded to 1000.  I added 1000 as an "Install Package" under the CLIENTS tab.  But I was still installing all features.  After the update pushed out, we were having issues with peoples machines being slow.  So I moved 2 clients to the Temporary group, and had the 1000 build in place and then changed the Client Features to AV & AS only.  The clients never updated.  Did you have a different outcome?


JoeG's picture
I started out with 11.0.785.  Most of my clients have updated by using the Install Package tab, but like you all features have been pushed out too.  On the features I don't want to use I just changed the policies to basically have no effect on the clients.  I didn't want the firewall on the client but again it's being pushed out so I changed the policy and unchecked/unblocked the shared policy.  That is a bug over the previous version.  I've also got a conflict on some of my servers with BackupExec 11d with SP2 and all of the hotfixes (HF).  On some of the servers it causes beremote.exe to crash.  I uninstalled SEP to verify and the backup ran fine, another bug.  One would think that there would be some cross application testing of applications from the same company.  One last complaint, I can't seem to find a detailed report that shows me in detail which client has which version of the client installed.  Does that exist somewhere?
Thanks - Joe

Message Edited by JoeG on 01-21-2008 07:42 AM

reza akhlaghy's picture
>One last complaint, I can't seem to find a detailed report that shows me in detail which client has which >version of the client installed.  Does that exist somewhere?
Goto Monitor, then Logs and display "Computer Status Log", then click export (!)
you can see version for each client. There's currenly no way of seeing that important
information other than export...
JoeG's picture
I've seen that option, but all I get is a window with the information.  Do I have to select all and then copy & paste?  If that's the case, then that's really a pathetic way to see the info.  Am I missing something?