Endpoint Protection

Hi All ..

I have successfully move SEMP 400 more clients to my  new server using simple script .
I use Psexec.exe to run scripts remote computers
steps are as bellow

1. Make “copy.bat” including all clients using bellow cmd . this will copy new Sylink.xml to client for temp to c:\ drive
Copy.bat :
“ xcopy SyLink.xml \\ IP adders of client \c$ “

2. Make second Script.bat This is the Script the doing all needed
Script.bat :

@echo off
:SYMANTEC
echo.
echo SEP-Client installed in %programfiles%\symantec\symantec endpoint protection
echo.
echo.
echo SEP-Client interface is stopping...
echo.

"%programfiles%\symantec\symantec endpoint protection\smc.exe" -stop

REM ## PING is used as delay since SMC.EXE takes some seconds to stop
REM ## but after running the command you have immediatly the prompt back

ping -n 20 127.0.0.1

echo.
echo Making a backup copy of previous Sylink.xml in Sylink.xm_
echo.

if exist "%programfiles%\symantec\symantec endpoint protection\SyLink.xm_" del /Q "%programfiles%\symantec\symantec endpoint protection\SyLink.xm_"
ren "%programfiles%\symantec\symantec endpoint protection\SyLink.xml" sylink.xm_bak
del /Q "%programfiles%\symantec\symantec endpoint protection\SyLink.xml"

echo.
echo Copying new SyLink.xml
echo.
copy C:\SyLink.xml "%programfiles%\symantec\symantec endpoint protection"

echo.
echo Starting SEP-Client interface...
"%programfiles%\symantec\symantec endpoint protection\smc.exe" -start

echo.
echo Deleting temp files
del /Q "c:\SyLink.xml"

Note : This Script can run only the Member of Domain Administrators or Local Administrators

Download scripts

Attachment(s)

Easyway_SyLink_Replace.zip   189 KB 1 version

wow, thanks man for sharing it here, i guess the proper location is in the blog area :-)

I miss to tell one thing 

3. you have create including you all clients IPs with clients.txt file and the use this cmd to run script .bat remotely 

"psexec @clints.txt-c Script.bat"

You can get psexec.exe from bellow link 

http://technet.microsoft.com/en-us/sysinternals/bb897553.aspx

i think this will help to all..

Cheers 

perfect, thanks . looked by many for this kind of script.

Great! thank you!

Nice; good work; you can upload in download sections; 

You may want to check out SylinkReplacer. It allows you to replace the sylink file in an IP range.  It will automaticly replace the sylink.xml file on all the Symantec clients found in the IP range that is entered.

SylinkReplacer:

https://www-secure.symantec.com/connect/downloads/sylinkreplacer-tool-connecting-sep-clients-sepm

Its a neat one..As others mentioned do upload the script in the downloads sections

This good for any one dont wish to take more risck environment guys

You can find the script and tool on attachment.

Cheers

Attachment(s)

Easyway_SyLink_Replace.zip   189 KB 1 version

Hello Chinthakad.

What if their is a Password for Stopping SMC??................

yes it can use jest add to this  -p ******

"%programfiles%\symantec\symantec endpoint protection\smc.exe" -stop -p "your password here "

i hope this will helpful to you !

Cheers

Dear Chinthaka,

Thank you for the lovely Script:

Could you please explain to me the details on how to do it:

I want to reinstall my SEPM server from scratch since it's corrupted (new installation), but I don't want to reinstall all my clients again:
First: From where can I get the Sylink.xml from the server before starting?

Could you please explain to me your script in details step by step:

What do you mean by make copy.bat?

@@@@@@@@unzip and  follow bellow setps B4 run script...@@@@

1.Make “copy.bat” with all clients Ip's .this will copy new Sylink.xml to client for temp to c:\ drive ???

2.maKe clinets.txt with ip list of your SEPM clients ???

3.Now run second Script.bat This is the Script the doing all you needed ???



Thank you very much for your help!!!

-- 
--
Cheers,

Charbel Nemnom

1.First export the Sylink.xml from the group you want your clients to report to initially from your old SEPM server.

1. Click the Clients tab in the SEPM and select the group you want. Right click on it and select Export Communication Settings.
2. Click browse, select a convenient location and name the file "Sylink.xml".
3. Click Export.

Note: if you have more than one group you should get file "Sylink.xml" each group separately

2.  Then follow the bellow steps

1. Get all IP address you need to move new server  ( by group by group )
2. Make copy.bat script followed by bellow format  “ xcopy SyLink.xml \\ 192.168.1.1\c$ “ ( for each client )
3.  Create including you all clients IPs with clients.txt file ( for group you are  going to replace Sylink.xml file)

3.   Now you ready to run scripts

1. First run copy.bat (this will copy your SyLink.xml file to Client c :\)
2. Then run script.bat
3. Last you can check & conform your new server will the clients get report to it.

Note:You should do the steps each group you have one by one 

Hello Chinthakad.

I'll try this and let u know..

Very good article man !

windows 7 client have the return error of network path not found... I need to somehow enable admin share... dont know how this will work.

Why not just this on a startup script?

"C:\Program Files\Symantec\Symantec Endpoint Protection\Smc.exe" -stop

XCOPY \\Stg-sep\Sylink\Sylink.xml "C:\Program Files\Symantec\Symantec Endpoint Protection" /yes

"C:\Program Files\Symantec\Symantec Endpoint Protection\Smc.exe" -start

where \\Stg-sep\Sylink is the one from exporting the communciation settings. That sylink.html has the correct info in it.

I have modified your script for my own use which may help others out as well so thought i would post it.

It will automaticly find if the client is installed in the program files (x86) folder, or in the \symantec antivirus\ folder, as well as automaticlly grabbing the sylink.xml file from a remote server and creates a log of it's activity.

The benifit of this method over many others is that IT IS INVISIBLE TO THE CLIENTS, that is, the end user will not notice that the server has changed. The only thing that they may notice is the shield will go away for a short period of time and then come back, that is all - no cmd screens flashing up showing pings etc.

Thanks to the original author for putting this together.

Needs administrator (or admin user) username/password to grab the file from the remote server.

Make a new batch file in the same directory as the original files (that you downloaded in the zip from the original author) and copy an paste the script below into it. No need to run copy.bat first.

Run using: psExec.exe @clients.txt -u DOMAIN\username -p password -c script.bat

@echo off :SYMANTEC echo. echo SEP-Client interface is stopping... echo.

if exist "%programfiles%\symantec\symantec endpoint protection\smc.exe" goto :NEW

if exist "%programfiles%\symantec antivirus\smc.exe" goto :OLD

if exist "%programfiles(x86)%\symantec\symantec endpoint protection\smc.exe" goto :64Bit

:64Bit  echo.  echo -----------------64bit INSTALL----------------- >> \\servername\andpath.log  echo %computername% >> \\servername\andpath.log  echo.  "%programfiles(x86)%\symantec\symantec endpoint protection\smc.exe" -stop    REM ## PING is used as delay since SMC.EXE takes some seconds to stop  REM ## but after running the command you have immediatly the prompt back

 ping -n 20 127.0.0.1

 echo.  echo Making a backup copy of previous Sylink.xml in Sylink.xm_  echo.

 del /Q "%programfiles(x86)%\symantec\symantec endpoint protection\SyLink.xm_"  del /Q "%programfiles(x86)%\symantec\symantec endpoint protection\sylink.xm_bak"  ren "%programfiles(x86)%\symantec\symantec endpoint protection\SyLink.xml" sylink.xm_bak  del /Q "%programfiles(x86)%\symantec\symantec endpoint protection\SyLink.xml"

 echo.  echo Copying new SyLink.xml to symantec endpoint protection  echo.  xcopy \\servername\andpath\sylink.xml "c:\program files (x86)\symantec\symantec endpoint protection\" /Y /R /H  echo Starting SEP-Client interface...  "%programfiles(x86)%\symantec\symantec endpoint protection\smc.exe" -start  echo.  echo ----------------DONE----------------- >> \\servername\andpath.log  echo.  goto :eof

:OLD  echo.  echo ----------------OLD INSTALL---------------- >> \\servername\andpath.log  echo %computername% >> \\servername\andpath.log  echo.  "%programfiles%\symantec antivirus\smc.exe" -stop

 REM ## PING is used as delay since SMC.EXE takes some seconds to stop  REM ## but after running the command you have immediatly the prompt back

 ping -n 20 127.0.0.1

 echo.  echo Making a backup copy of previous Sylink.xml in Sylink.xm_  echo.

 del /Q "%programfiles%\symantec antivirus\SyLink.xm_"  del /Q "%programfiles%\symantec antivirus\SyLink.xm_bak"  ren "%programfiles%\symantec antivirus\SyLink.xml" sylink.xm_bak  del /Q "%programfiles%\symantec antivirus\SyLink.xml"

 echo.  echo Copying new SyLink.xml to symantec antivirus  echo.  xcopy \\servername\andpath\sylink.xml "c:\program files\symantec antivirus\" /Y /R /H  echo Starting SEP-Client interface...  "%programfiles%\symantec antivirus\smc.exe" -start  echo.  echo ----------------DONE----------------- >> \\servername\andpath.log  echo.  goto :eof

:NEW  echo.  echo ----------------NEW INSTALL---------------- >> \\servername\andpath.log  echo %computername% >> \\servername\andpath.log  echo.  "%programfiles%\symantec\symantec endpoint protection\smc.exe" -stop    REM ## PING is used as delay since SMC.EXE takes some seconds to stop  REM ## but after running the command you have immediatly the prompt back

 ping -n 20 127.0.0.1

 echo.  echo Making a backup copy of previous Sylink.xml in Sylink.xm_  echo.

 del /Q "%programfiles%\symantec\symantec endpoint protection\SyLink.xm_"  del /Q "%programfiles%\symantec\symantec endpoint protection\sylink.xm_bak"  ren "%programfiles%\symantec\symantec endpoint protection\SyLink.xml" sylink.xm_bak  del /Q "%programfiles%\symantec\symantec endpoint protection\SyLink.xml"

 echo.  echo Copying new SyLink.xml to symantec endpoint protection  echo.  xcopy \\servername\andpath\sylink.xml "c:\program files\symantec\symantec endpoint protection\" /Y /R /H  echo Starting SEP-Client interface...  "%programfiles%\symantec\symantec endpoint protection\smc.exe" -start  echo.  echo ----------------DONE----------------- >> \\servername\andpath.log  echo.  goto :eof

sylink replacer +1

very flexible tool....

hi,

can you zip this script. because it's messed up when copy/paste

thanks