Endpoint Protection

Hi All,

We have our SEPM server upgraded to 12.1 RU1 where as most of the clients are in 11.x RU6 MP2. Recently it's been observed that most of the clients downloading updates from Symantec Site in spite of local GUPs and LUAs are configured for that group. It's also been observed that the settings.liveupdate does not have the entry for local LUA configured.

We are having the LU policy as mentioned below.

1. GUP configured for the group

2. Internal Live Update servers

a) Local LU Servers

b) Central LU Server

We are also using a second location policy on which we have earlier mentioned to get the updates from Symantec Site if the machine is not able to communicate with the management server. later on we have changed the same to use the policies for the default location.

To Summarise this we have no where mentioned to get the updates from Symantec Site by any means to avoid internet download. However the same is not reflected in the Settings.LiveUpdate file of client machines.

Can anybody please help me to reduce the no of machines downloading from symantec site.

Regards,

Sabyasachi

has the policy been taken by client?

are all the clients have the same settings in settings.liveupdate?

Yes, the clients are having the latest policy as shown in User Interface of SEP but the settings.liveupdate contains the entry for symantec site on different hosts.

No not all the clients are having the same setting but most of them are having this abonormality.

Regards,

Sabyasachi

if the clients are communicating, then it should take the settings.

If there are only few clients can you manually copy the settings ?

Hi Pete,

It's not the issue about the policy update but the concern is regarding the configuration setting file is not updated as per policy. Regarding your suggestion to manually update the setting it's a challenge to modify the settings on more than 1500 machines.

Moreover is there any chance to modify the setting where only GUP is present without the local LUA? How to avoid this situation of downloading the updates from Symantec in case of GUP is available only. Can we expect the machines to be connected to internet for downloading the updates as we don't have any http settings available for GUP based location.

Do you have any idea to overcome this situation?

Regards,

Sabyasachi

you need to remove the LU settings from SEPM console, however this will remove the option of getting the updates from internal Liveupdate.

Is it possible to create a new group and apply a new policy with same settings and move clients to new group and check if the configuration is changed and working as expected.

Hi Pete,

Still no luck. Created a group and apply a new policy as similar to earlier one but issue is still the same.

Regards,

Sabyasachi

Can you try by upgarding few clients to SEP 12.1?

Well..Are you sure it is downloading definitions or is it using Insight Scan even that connects to internet..can you check if the connctions happen during scan time...

Also on any client that is connecting to internet can you check if th client was online during that time or was location changed..you can find this on the client machines Client management Logs.