Based on what I have found on line the SEP client is not cluster aware. I have found a very limited  article TECH100479, but it doesn’t answer any of my questions related to how SEP should be configured to avoid  issues during fail over. It is recommended that real time scanning not be installed, but I believe the concern is with filter drivers.

Given that we have a file share cluster, with many volumes and mount points, how should SEP be configured to  avoid file lock issues during fail over.  Microsoft KB240309 has one turning off the symevent driver, but this would probably just break Symantec. Is there a comprehensive white paper that reviews  file locking, real time scanning, exclusions. Basically a comprehensive guide to setup Symantec polices so that users file shares are protected without conflicts with cluster resources.