Endpoint Protection

Hello Everyone:

I've been handed the task of monitoring our organizations SEP deployment and have a pretty good understanding of how things work, but I know there is a lot more I need to learn.

My enviornment is comprised of over 50 DC, File and Print servers along with a few thousand client workstations. The GUP's current in place are running flawlessly and are being monitored by SEPM Monitor, which works great.

My issue is that we have removed one of the locations where we had a running GUP supplying definitions to the clients at that site. The site no longer has any machines and the GUP has been removed. I now need to know how to remove the GUP policy from SEPM for this location as it's being reported on as a failed GUP in SEPM Monitor. 

The GUP, workstations and subnet (network) have all been removed a this site and as such I need to remove the policy for LiveUpdate from within SEPM. I have performed a vast number of Google searches on how to perform this action, but keep coming up short on the exact steps. As this is a production enviornment, I don't want to make a change in errror and cause issues in the environment.

I'm running SEPM on Windows Server 2008 and all GUP's are also Windows Server 2008. All the workstations are Windows 7. I'm running SEPM tied into AD with a LiveUpdate policy setup for each site with one GUP serving each location.

When I attempt to delete the policy under the LiveUpdate Settings tab, I get the error: "The policy is in use. Replace the policy in assigned locations before deleting it!"  I'm not sure what this means exactly and would appreciate any advice or direction that can be provided.

 

Thanks ahead of time for your assistance.

 

Have a great day!

Just withdraw (on the clients page) the LU policy for the group which the GUP resides and you can then delete the policy from the Policies screen. It's a two-step process :)

Brian,

Thanks for your reply, but when I try to withdraw the policy under clients>site>polices>Gup Policy (shared)>tasks>withdraw, I get the following information error: Live Update policies cannot be withdrawn. Every Group and location must have a LiveUpdate Settings Policy>

The entry under Location Specific Policies has the GUP listed as "shared". Do I need to use one of the other options listed under tasks:

1. Replace Policy?

2. Convert to Non-shared Policy?

 

I'm sure it's me simply not understanding the full flow of policy's in how they are assigned etc, but this is what I'm presented with following the two-step process.

Thanks!

 

Ahh yes, sorry about that. You need to replace the GUP policy with your regular LiveUpdate one. It needs to have some LU policy. Once you replace it, then you can delete the GUP policy in the Policies section.

As a side note: the policies that cannot be withdrawn are Antivirus and LiveUpdate.

Ok, I was able to replace the policy on this GUP under clients>policies>location specific policies>tasks>replace policy. It is now using the "LiveUpdate Settings policy (shared).

Now, back in polices>LiveUpdate Settings (tab)> GUP, right click>delete, I still get the error: "The Policy is in Use. Replace the policy in assigned locations before deleting it"

Do I need to covert the policy to a "non-shared" policy first under the clients>policies>location specific policies>tasks?

My main goal here is to simply remove it from the SEPM Monitor application so it's not flagged as being out of compliance. Is there something in the SEPM monitor config that would allow this?

Also, for some reason I'm thinking the (shared) status is preventing this, which is what makes me wonder if I need to make non-shared. If so, should I make the LiveUpdate policy non-shared or should I put the old GUP policy back in place before doing this?

 

Thanks Again!

It sounds like its shared between multiple groups. Open up that policy and select the "Used By" tab (at the top under Overview)

You can use the Tree View or switch to List View. This will show you what other groups it's assigned to and you can replace it with another LU policy.

Thanks again Brian for keeping attentive to me and my issue.

 

Used by shows the entire AD OU that this GUP was designated with. This AD OU only contains the objects that were at that site. This OU has not been removed from AD yet. At some point this will be cleaned up as well, but this takes time and change control.

Could this be causing the issue?

Thanks!

You should still be able to replace the policy with another for this OU within SEPM. Don't need to worry about the AD side.

If you have still problem deleting. edit the policy Remove GUP server IP even you have the policy your GUP will be disabled.

I'm done working on this for now and will setup my test environment, of which I only have 1 GUP there, but will try to add others and go from there.

On that note and the more I look at it the more I think I simply need to remove this group from the clients tab completely, thereby removing the need for an individual policy applied, either LiveUpdate or the defined GUP policy originally in place.

I will post back with the results of this testing next week and again, I appreciate all the responses and assistance. I'm sure I iwll figure it out but as we continue to remove locations with GUP's I need to get this figured out as soon as I can.

 

Thanks again and have a great weekend.

 

 

Hey All:

 

I wanted to report back to those that assisted me with this issue to let  you know that I finally figured out what was preventing me from removing the policy and have corrected that part of it.

 

The issue was that the policy for each site was attached to two seperate OU structures in AD, something I had identified previously. So I was able to convert the policy for each site to use the default LU policy and then had no issue removing the old policy. Now it will be a matter of waiting until tomorrow to see if SEPM Monitor reports on those GUP's as faulty.

 

One thing I would like to do in finishing this up is to remove the entries under clients, but under a certain level, I do not have the option of deleting. So, I'm thinking, but haven't tried yet, that the last tree where I can delete will provide me with a list of children that I can remove, but I''m not going to do that on the production system without knowing for sure.. My luck would be that I hit delete and it simply removes the entire tree.. something I don't want to happen.

 

Thanks All!