Endpoint Protection

Hi All,

I was trying to see if there is a way to get a list of the clients reporting to a GUP. I checked the schema and there does not appear to be a table or view that links this information. So the only way I think this might be able to be done is to get the GUP list and parse the subnet info and compare to the client subnet info. Has anyone does this already? Writing SQL is not a forte for me, so I am hoping someone has done it and could share the SQL.

Thanks

Martin

Client won't technically check-in with a GUP but only get content from it. Not a very easy way but if you go to the Monitors page and set the Log Type to System and Log content to Client Activity and select the Advanced Settigs for the Event Source put Sylink you will get some good info here and where clients get their downloads.

Actually clients NEVER reports to GUP. They are always connected to the SEPM & SEPM will re-direct them to their local GUP.

You can get the GUP list through the SEPM console, this article can help you:

How to search for the clients that act as Group Update Providers ?

http://www.symantec.com/docs/TECH96094

In case you want to check defintions distribution there Conent Distribution Monitor tool might help.

The SEP Content Distribution Monitor tool helps monitor GUP health and status as well as general content deployment. This tool is a lightweight, stand-alone tool designed to be run directly on the Symantec Endpoint Protection Manager (SEPM) server, and should return a graphical display of the content distribution status

http://www.symantec.com/docs/TECH156558

To verify if clients are receiving defintions from GUP can run the Sylink monitor tool.

How to confirm if SEP Clients are receiving LiveUpdate content from Group Update Providers (GUPs)

http://www.symantec.com/docs/TECH97190

Is there any update?

OR

If your query has been resolved mark this thread as a Solved with the best answer that helps you.

No real solution other than that it does not appear that this can be done. 

The closest is maybe the Symantec Content Distribution Manager where you can see the number of systems not running the latest virus/spyware on the particular network. If there was a way to determine that from the database, it might be close enough.

There isn't a straightforward list that can easily be pulled showing clients that report to a specific GUP. Everything is set in the policy so only assumptions can be made that Client X pulled froom GUP XYZ based on how you have your policy set up.