Endpoint Protection

Hi all,
I have a serious problem with a customer.
Him want install the firewall component of Symantec SEP v.12 (managed through console SEPM) on a client (windows 7) which has already real-time protection of Trend Micro OfficeScan v.10.
I would don't advise this strategy but I need of official technical documentation (e.g. white papers, kb, etc.) that I'll use to support the suggestions.
Can you tell me some link where find the documents (I have tried with google but I have not found nothing of official)?
Thank you so much.
Regards,

Giordano

The SEP knowledgebase is found here:

http://www.symantec.com/business/support/index?page=content&key=54619&channel=TECHNICAL_SOLUTION

Here is a good read with helpful information:

Should you run more than one antivirus program at the same time?

Now, this is a slightly different scenario. It sounds like you're going to use TrendMicro as the antivirus and SEP only for the firewall? Am I correct in assuming this?

Does TrendMicro not have a firewall component?

Since you're not technically running two antivirus products, there should not be a conflict in the scanning features. As long as you configure the SEP firewall correctly and it ONLY serves as the firewall while Trend handles the scanning aspect, you should not run into issues.

Personally, I would pick one or the other but not sure if Trend has a firewall.

Brian

You cannot withdraw the AV policy (by design) so there will be a conflict.

Can you make a special package only containing the firewall? This would be the only around this problem is to not include the AV component in the package.

Hello,

I completely agree with _Brian's comment above.

Running more then one antivirus program on the same computer is not recommended. You may experience a false positive detection in one of the antivirus programs in this situation.

Risks of using more than one antivirus program

Antivirus and antispyware programs are generally written with the expectation that they will interrupt actions taken by other programs, in the interest of security. If more than one such program is running, there are a number of ways in which they can interfere with each other.

To give a simple example, suppose that antivirus scanners A and B are installed on a computer. Program A copies a file to a temporary location for scanning. Program B notices the file activity, and copies the file from program A's temporary location to its own. Program A notices that file activity and makes another copy, and so an infinite loop forms. This could end with the computer running out of memory or hard drive space, hangs or crashes in the antivirus scanners, or other undesirable behaviors.

Check this Article:

Should you run more than one antivirus program at the same time?

http://www.symantec.com/docs/TECH104806

In your case, simply create a create a custom package with only NTP (and IPS if needed) as feature/s. Check these Articles:

Creating custom client installation packages in the Symantec Endpoint Protection Manager console version 12.1

http://www.symantec.com/docs/TECH165801

Symantec Endpoint Protection Recommended Best Practices for Securing an Enterprise Environment

http://www.symantec.com/docs/TECH166816

Hope that helps!!

Hi all,

I'm sorry for my delay in response.

Thank so much for your support, with your help I solved this problem.

Kind regards,

Giordano

Please don't forget to mark whichever post helped you the most as the solution. It will benefit future users who may the same question.

Thanks and take care,
Brian