Endpoint Protection

Hi All,

We have one LUA 2.3.2, four SEPM 12.1.3 servers and 30,000 clients but disabled the "LiveUpdate" option in the client console.
Apart from scrpting for SepLiveUpdate.exe, how can we allow the user to access to LUA?

See here:

Best Practices for LiveUpdate Administrator (LUA) 2.x

Is LUA appropriate for the environment?

Symantec products download updates from the Internet using a LiveUpdate client by default. Configuring and administering an LUA infrastructure adds several layers of complexity to the process of updating Symantec products. Use the following guidelines to ensure the extra complexity and bandwidth usage generated by LUA provide a net benefit.

LUA is not recommended for the following scenarios:

• Updating any amount of clients through LUA instead of through a management server like Symantec Endpoint Protection Manager (SEPM)
• Updating environments with less than 1700 unmanaged clients sharing the same Internet connection
• Updating clients across WAN links

Symantec LiveUpdate Administrator 2.3 User's Guide  

Some good articles for LUA

Knowledgebase Articles for Liveupdate Administrator (LUA)

https://www-secure.symantec.com/connect/articles/knowledgebase-articles-liveupdate-administrator-lua

Hello,

Please check these article's may these will help you.

https://www-secure.symantec.com/connect/blogs/liveupdate-administrator-lua-version-232-now-available

http://www.symantec.com/business/support/index?page=content&id=TECH171578

http://www.symantec.com/business/support/index?page=content&id=TECH93409

Hi All,

Thank you very much for the reply.

We have LUA and it is configured in SEPM Liveupdate policy but clients are not communicting to the LUA server. Please find the attaches screenshot for the same.
 

So, my question is where else should I configure LUA or what else need to be done for the below requirement
"If GUP is not avalable or content is not avalable on GUP, then client should communicate with the LUA server automatically."

Please Unchecked "Use the Default Management server "

Is it Supported to Configure Unmanaged Symantec Endpoint Protection Clients to Update from LiveUpdate Administrator 2.x rather than the Symantec Endpoint Protection Manager?

http://www.symantec.com/business/support/index?page=content&id=TECH123388

Exporting Client Settings for Windows and Java LiveUpdate Clients from the LiveUpdate Administrator 2.x

http://www.symantec.com/business/support/index?page=content&id=TECH97460

Soooo it sounds as if you want to use the internal LUA as a failover update point in the event the GUPs are unavailable.

This is perfectly possible, just not in the way that you're thinking.  Just to break it down for you, in the LU Settings Policy you have:

Server settings: This tells the client where to update from (SEPM/GUP/LUA/3rd Party)

With the LiveUpdate option enabled, you then gain access to the Schedule and Advanced Tabs on the left pane.  These additional tabs only affect the LiveUpdate portion of the client (sepliveupdate,exe so to speak).  And these must be set to tell a client when to try to run a LiveUpdate attempt to your internal LUA (so are pretty important).

By default, the schedule is set to run every 4 hours, and so that client will not perform a LiveUpdate until they are both more than 2 days out of date and have not been in contact with the SEPM for more than 8 hours. I'd recommend having a play around with these "Options for Skipping LiveUpdate".

Just be aware that without these settings, then the clients will attempt a liveupdate on the schedule specified, regardless of whether or not they are in active communications with a working GUP&SEPM, potentially generating more traffic than is necessary (i.e. it will work how it did in SEP11).

Finally, the advanced tab allows you to choose if the users are able to initiate the liveudpate attempt manually amongst other options.  With the "Allow users to run LiveUpdate" option enabled, the users will be able to kick it off from the SEP Client Console, by clicking "LiveUdpate" on the left (it will no longer be greyed out).

Hi,

I have one more question?

Now, we have 40 GUP servers serving 35,000 systems in 140 locations.
Since we are not supposed to use GUP monitoring tool, if SEP client on the GUP is updated... we are confirming that GUP also updated.
Is there any benefit if we use LUA distribution centers instead of GUP technology? and what kind of reports I can generate from LUA to submit to our client?

There's no real reporting on the LUA, and as the logs pertain to the LUA's own internal processes rather than the clients, they will likely not be much use to a customer.

That said the LUA has the option for email notifications that are sent on successful and/or failed Download and Distribute jobs.  While uou'll still need to look at the SEP logs to determine if/when/how clients are updating, you'd at least have confirmation that the defs were successfully pushed out to the Distribution Centre).