Endpoint Protection

First, a little background on this.  We have SEPM 11 installed on one server and SEPM 12 installed on a new server.  We are needing to migrate all of our clients from the SEPM 11 server to the SEPM 12 server.  We also need to upgrade from SEP 11 to SEP 12 on all of the workstations.  I have found a way to do all of this, but it takes a lot of interaction on my part.  I'm looking for a more automated process.

I have tried running a script on the clients to uninstall SEP 11 as well as Live Update.  It runs through and uninstalls the programs properly.  When I try to push out SEP 12 to these machines via the SEPM console or group policy, though, it always gives me "Error 2343. Specified path is empty."  Here is the script I run to uninstall SEP 11 (11.0.7200.1147 in this particular case) and Live Update:

MsiExec.exe /norestart /q/x{DE889CC8-F305-4C4C-BAE0-EF626E45CB9D} REMOVE=ALL
"C:\Program Files\Symantec\LiveUpdate\LSETUP.EXE" -u -q

If I go back to these machines after running this script and run the new CleanWipe program, they will then install SEP 12 either pushed from the SEPM console or via group policy.  This works, but is way too much interaction on my part.  We have almost 8000 workstations and I really don't want to have to do this to all of them.

Is there any way I can possibly automate this process some more?  I have read that the new version of CleanWipe cannot be ran silently.  If this has to be run to get all items off then that is going to prohibit the automated process quite a bit.  Is there more I can add to my script to remove the items that are still being left behind or causing the 2343 error?

I have went through the above mentioned process on a couple of labs we have in one of our buildings.  The entire process per lab (labs with 25 machines) took almost 30 minutes.  As you can imagine, with 8000 workstations, that is going to take an impossibly long time to get everybody migrated to the new platform. Any assistance would be greatly appreciated.

Why are you using Cleanwipe? You can simply replace the sylink file on the SEP 11.x clients with a new sylink from the 12.1 server. Assuming you're on the latest version of SEPM (12.1.2), just use the built in feature to push a new sylink to the clients.

Restoring client-server communications with Communication Update Package Deployment

 After you get them reporting to the 12.1 server, you can than upgrade them to 12.1

Hello,

Any particular reason to use a Script to uninstall and Install the Latest Version of SEP 12.1, when you could easily migrate without following a script?

Error 2343. Specified path is empty, comes when Symantec Endpoint Protection is not properly uninstalled.

Secondly, Follow this Article when deploying via GPO - 

When Installing Symantec Endpoint Protection 11 by Active Directory Group Policy Object, Which Method of Deployment is Supported?

http://www.symantec.com/docs/TECH91330

About installing clients with Active Directory Group Policy Object

http://www.symantec.com/docs/HOWTO26773

Creating a GPO software distribution

http://www.symantec.com/docs/HOWTO55429

Symantec Endpoint Protection 12.1.2 (RU2) can upgrade seamlessly over the following:

• Symantec Endpoint Protection 12.1.1101.401 (RU1 MP1)
• Symantec Endpoint Protection 12.1.1000.157 (RU1)
• Symantec Endpoint Protection 12.1.671.4971 (RTM)
• Symantec Endpoint Protection 11.x (can be upgraded to enterprise version only)
• Symantec Endpoint Protection Small Business Edition 12.0

Here are few Articles which you may refer while Upgrading to SEP 12.1 RU2

Best practices for upgrading to Symantec Endpoint Protection 12.1.2

http://www.symantec.com/docs/TECH163700

Upgrading or migrating to Symantec Endpoint Protection 12.1.2 (RU2)

http://www.symantec.com/docs/TECH197426

Hope that helps!!

Brian81,

So after I get them talking to the new SEPM 12, I assume I just setup an upgrade package on the container they are in so it will autmatically upgrade from SEP 11 to SEP 12 on the client?

Mithun Sanghavi,

I have a GPO already built and working.  It just will not work as long as SEP 11 is installed on the client.  That is why I have been trying to find a way to get SEP 11 off of the clients so I can install SEP 12 on them.  The GPO itself is working fine on a machine that has just been reimaged and has not SEP installed on it.

Yes, you can do that or use another method of your choosing. No need to uninstall/reinstall like you were doing.

That answers my question.  Thanks for your assistance.  Only 2 days wasted on the uninstall/install route...

You can assign the upgrade package to the whole groups of clients - they will upgrae automatically:

https://www-secure.symantec.com/connect/videos/upgrade-clients-sep-121-using-auto-upgrade-feature

http://www.symantec.com/docs/HOWTO17911