Endpoint Protection

We want to temporarily turn off LiveUpdate for all our computers (mainly 11.x clients) from our SEPM 12.x server, to determine if SEPM is what's causing our outbound traffic to spike often during morning hours.

After we've tested the above, how do we reduce the LiveUpdate frequency for specific computer groups??

Most computers we have don't directly touch the Internet, only some of our servers do and those must have more frequent LiveUpdates.

Thank you, Tom

Remove the LU policy to stop it.

In the policy, click on the Schedule tab and you can edit as you see fit.

How would I put it back when I want to do so??

Thank you, Tom

LiveUpdate policy is only for those who touch internet.

you can go to policies

at the  bottom select withdraw policy...after your observations are over

you can add them again..I mean you can apply the policy

In the policies tab, click on LiveUpdate under View Policies and select Assign the Policy under Tasks

A new window will open up and add check marks to the groups you want to assign to. Click Assign when finished.

I think some confusion -- I mean disable LiveUpdate of computers from the SEPM server, not the Internet.

Thank you, Tom

How do I temporarily disable LU from a computer group, then??

Thank you, Tom

Remove the LU policy. If there is no LU policy for the clients, they can't get updates, whether from the SEPM or Internet.

It can't be.

In the LU policy settings, you have the option to use the default management server or a LU server or both

For my clients on the network, I uncheck use a LU server so they never go to the Internet and only use the SEPM for updates.

Just a specific group of clients...can this be done?? Thank you, Tom

Turn of policy inheritance for that group than it can be done just for that group.

From SEPM you can go to policies > LiveUpdate > LiveUpdate content tab and edit the Security Definitions there. You can uncheck all the boxes to disable LU for all those features. You will then need to assign that policy to ghe specific group you want. You may also decide to uninherit policies from a test group and copy your main LU policy, do the updates above and then assign that policy to the test group.

On the client-side, you should see where "All update types have been disabled by your administrator"...

You may also want to look into using a PCAP program (like Wireshark) to log what is happening in your network at specific times.

The settings for LU can't be withdrawn but the LU Content / Security Definition features can. I posted some screenshots below.

Seems for the specific group of computers for which I want to temporarily disable LU that I must have a non-shared LU policy with no update types checked. I will try this and cross my fingers it doesn't break things.

Thank you, Tom