Endpoint Protection

Hi Guys,

I'm totally baffled as to what is required or what is happening in our organisational setup. hope you can help.

We have Symantec AntiVirus Corporate Edition 10.x (10.1.7.7000) deployed to all our client PCs (XP) and these PCs are managed through Symantec System Centre console on two 'parent servers'
these servers are located in different physical offices.  hence each parent server manages a respective number of clients, based on office location. (This is an existing setup, before my time with this company).

What i'm confused about is where these clients are getting their updates from (virus definitions / version updates) - from the parent server or from Symantec over the internet.


This has come about because yesterday, from Symantec System Centre, i changed some settings from the parent servers to managed clients virus definitions by:
"Update virus definitions from the parent server" and
"schedule client for automatic updates using LiveUpdate"

see pic :
 


The issue arose when we noticed out internet link being maxed out for about 30 minutes.  what we pieced together was that from all the client AV logs, the LiveUpdate was initiated on all the PCs at once and was getting the definition update from the Symantec LiveUpdate server instead of the designated 'parent server'.
This obviously wasnt 'an issue' when there was no defined schedule.  ie each PC would get a new definition at random times based upon system startup.  hence there was no spike noticed in internet traffic; until now.


I've done a fair bit of reading through these KBs and manuals:

• Updating virus definitions for Symantec AntiVirus Corporate Edition 10.x and Symantec Client Security 3.x (http://service1.symantec.com/SUPPORT/ent-security.nsf/docid/2005040711404048)
• Installing and configuring LiveUpdate Administrator 2.x (http://service1.symantec.com/SUPPORT/ent-security.nsf/docid/2007101913262648)
• Symantec LiveUpdate Administrator User's Guide ftp://ftp.symantec.com/public/english_us_canada/liveupdate/lua_2.1/LiveUpdate_Administrator_Users_Guide.pdf

Where I read from the first document listed: "LiveUpdate can retrieve definitions files either from the Symantec server (which it does by default) or from an internal Web, FTP, or file server created with the LiveUpdate Administration Utility."  <- this has confused me.

Does this mean that even though i run Symantec System Centre, with 2 parent servers, each with their designated alotment of managed client PCs -and- with an option designating ""Update virus definitions from the parent server" ... that the clients will still update from the internet (Symantec LiveUpdate servers) instead of our internal 'parent servers' if LiveUpdate Administration Utility is not installed and configured in conjunction?

Also, i note in the document explaining Symantec LiveUpdate Administrator, it mentioned the client LiveUpdate source is kept in the file Settings.Hosts.LiveUpdate (which is generated from the Symantec LiveUpdate Administrator 2.1 utility and then saved to the client in the directory C:\Program Files\Symantec\LiveUpdate\).  i opened this file and confirmed that the LiveUpdate source was that server.

However when i looked in one of the existing client PCs (before importing this file), the file was called Setings.Default.LiveUpdate and it contained the Symantec website: HOSTS\0\ACCESS2=http://liveupdate.symantecliveupdate.com
 
are they they same?

Ultimately, the question is: can I set the clients to download from the parent server without configuring Symantec LiveUpdaet Administrator?

As per the screen shot you have selected "Schedule client for Automatic Update using Liveupdate and also Do not allow client to manually launch Liveupdate".

the question is: can I set the clients to download from the parent server without configuring Symantec LiveUpdaet Administrator?   The answer to this will be Yes.

You can go to the settings option of Update Virus definitions from the parent server.

Hi Sandip,

can you be a little more specific please?
within Symantec System Centre , if my parent server is SYDBKP01 (as shown in the pic) where do i go to access these settings to make the clients update from SYDBKP01 and not from the internet?


what i've done since the original post is to create a group and included in all the PCs , but set the group global properties > Configure LiveUpdate settings to use "Internal LiveUpdate Server" (instead of Symantec LiveUpdate Server) and use IP= (IP of SYDBKP01) and Type=HTTP

following this i forced a definition update to all those PCs from the SSC console.  this updated the HOSTS in file "C:\Documents and Settings\All Users\Application Data\Symantec\LiveUpdate\Settings.LiveUpdate"
from HOSTS\0\ACCESS=liveupdate.symantecliveupdate.com
to HOSTS\0\ACCESS= [internal IP of SYDBKP01]

is this correct?