Endpoint Protection

Hi all,

I need to look at the various options for telling the clients when to update their defintions files. 

We have a single SAV 10.1 server with many thousands of clients in many sites.  At times when the clients are updating (daily) they are killing some branch offices (no QOS anbd some low bandwidth sites).  So far I can only see when to check for defs in an interval of minutes.  I gather this is based upon when the client was fisrt installed to dectate the check in time?

My question, can I configure a client/server group for certain sites to say 'update at xx:xx using automtic updates for managed client?  Or am I looking at reg hacks or another component?

I have been reading about LiveUpdate Administrator - We have this installed and configured for 64-bit defs, but I see in the conosle there are more options around defintion time (08:00, within an hour..etc) - anotehr question is this setting whento get the def file to the parent server or when clients will get the updates?


In the cosole I think I may be getting confused with def update times that relate the actual SAV server and not WHEN the clients receive updates.  Am sure this is a popualr topic for conversation - you're insight wuld be much appreciated! 

We are soon to go to SEP, which hopefully using GUP's will save our network, but need a soltuon in the meanwhile :)

Thank You

You have one primary server and clients attached to it, no secondary servers in the list
The schedule whatever we configure is for the primary server alone. when it should take updates
It can take from interent or from Liveupdate administrator

right click on server - all tasks - antivirus -virus definitions manager

you get two options

for one is how parent server should get defs
second one is how clients should get defs

When it comes to clients, it can check with parent server every 60mins default i guess ( can be configurable)
or else it can use internet to get the latest updates ( you can schedule it to any time you like) 

The best option would be to create a new client group.

put the clients ( xx site clients ) inside that group.

Make them to check with primary server at an convenient internal so that they wont get at the same time others take.

Let me know if you have any further questions.

:)

 

Thank Yoo, you have explained it well - so LU you can specify time excactly.  Using Automatic update you can set an interval - my question is, when is this itnerval controlled from? When AV client first installed?  interval past the hour??  When is the start vairbale?

i.e if I set a group to check every 120 mins and one 60 mins> from what time does this check from - I mean they are going to overlap anyway.

We would rather use auto updates from single parent server than LU, so want to uinderstand this interval a little more - all our clients seems to update all over the place.  Can you also add randomize as not to hit a whole site at the same time?

Thanks for the quci response by the way!

I had the same issue..

I used the procedure mentioned in the article which i have gien below..

U can configure server threads to update cllients based on network or subnets so it wont update more that one pc in a subnet.

Update Client based on Network or subnet with Symantec AntiVirus

http://service1.symantec.com/support/ent-security.nsf/854fa02b4f5013678825731a007d06af/17ea35e0c69f22da88256c860061cfdd?OpenDocument

http://service1.symantec.com/SUPPORT/ent-security.nsf/pfdocs/2001040511373248?Open

This reduced major problem in our setup.
Hope this will solve ur problem.
 

Really a good question in deed

From the doc , I see that


http://service1.symantec.com/SUPPORT/ent-security.nsf/docid/2005033015282148?OpenDocument&Click=


Symantec System Center does not hold any real time data for the environment. It is only a cached copy of the information from each parent server. When a change is made in Symantec System Center, a change request is sent to the correct Symantec AntiVirus server. The Symantec AntiVirus server processes the change and then sends it to the Symantec AntiVirus clients by using the Grc.dat file. The communications process that is used is the same, regardless of where you installed Symantec System Center and Symantec AntiVirus server. If they are both installed on the same computer, the same network communications still occur

Setting  "Check for updates every" to 1 minute.
This change makes the clients check in with the parent server every 1 minute for a definition update.

is the one which tell client when to communicate..

As you mentioned the communication time will be based on the time they were installed. like a Q i guess..

I liked the suggestion from SHP, give it a shot..

Thanks guys - not ideal, but will definatly help our poor netwrok by spreading it out!

Think it is address (or at least more flexiable around things like GUP's) in SEP.

Let me know how I get on - also though about a LUA server at each site, but way too manual and timeconsuming to configure.

You are both gentlemen!

Thank You.

Rafeeq - does this invole editing reg (regile logon script may be ok) on each client machine or the reg on the AV server?

Did it take you long to configure?

Just wanted to mention about how client communicates,

As you mentioned ,you have a live udpate administrator

it is possible to create a host file and put them on clients

is it possble so that we can have few clients taking updates from LUA?

as mentioned in this doc?

How to configure a LiveUpdate host without using Symantec System Center

http://service1.symantec.com/SUPPORT/ent-security.nsf/docid/2002091816510548?Open&docid=2002103012571948&nsf=ent-security.nsf&view=docid

This is the one if was referring to

http://service1.symantec.com/SUPPORT/ent-security.nsf/docid/2002102111204148?Open&docid=2006042616115348&nsf=ent-security.nsf&view=docid

Prefer to use Automatic Updates and the main console where possible.

Was querying the first links you posted that instrcut me to edit registry values.

We dont need another thing to support that also needs manual intervention,  Would like to set on groups node so automtically managed.

Think is the biggest flaw in the product!!  No control over when clients update! :-)  Thought would be one of the main things to think about.  Still not fully fixed in current release of SEP either - anyway.  Thank You again.-

In sep , there is a communication mode, telling clients when to communicate,
can specify interval

I read long before that for virus updates you dont have any schedule, once manager has the defs it will push it out to the clients, ( i need to check this :) ) 


the link How to manage updates of computers by network or subnet with Symantec AntiVirus Corporate Edition

was posted by SHP , yes you need to edit registry

Have a good day !

Thanks guys, have added to Ideas section for SEP...

https://www-secure.symantec.com/connect/idea/sep-add-policy-settings-client-update-time