Endpoint Protection

Here's my situation/issue:

The other day we had a psu burn out in a switch in our datacenter, this caused some servers to disconnect in various manners - some not immediately noticeable. 

The SEP 12.1 server, a 2008 R2 box, was one of the virtually 'offline' servers. On Monday it was brought to my attention that lots of clients were running without their tell-tale green dots on their SEP shield icons in the taskbar... logging into the console revealed most machines status' listed as 'offline'.

Commence rebooting the SEP 12 server.

All is well afterward and everything reconnects and eventually all goes back to normal, great right? Well not exactly. The manner in which things came 'back to normal' is something I'd like to avoid ever having to deal with again in the future - I hope their is a way to be able to do so.

After the server came back up, since it had been offline almost 2 days, it proceeded to blast virus definitions to all our global network, severely hurting some of our lower bandwidth sites. More then 2TB went out in less than 2 hours. Is there a way to prevent a situation such as this by having SEP update to a single location on a subnet and then pull updates from that LAN instead of all machines going out to the server over the WAN?? Kaseya has such a feature called LAN caching, is there a SEP 12 equivalent? Thank you all in advance for any assistance your able to provide me!

There is the Group Update Provider (GUP), however, have you considered setting up GUPs at local sites? Any SEP client can become a GUP and it will provide content updates to clients instead of them going out to LU or coming back across the WAN to the SEPM. The point is to save on bandwidth.

Have a look at the whitepaper I've attached

Also, see here:

Using Group Update Providers to distribute content to clients

Attachment(s)

SEP_GUP_Whitepaper_1.1_3.pdf   1.41 MB 1 version

That's what I needed, thanks for a speedy response!

Glad to help