Endpoint Protection

Scenario:  We have SEP 11 running great at one site (3000 clients).   We are migrating another site from a diff AV to SEP 11 (4000 clients).   What is the best practive so we have failover and you can see all clients at each site.

Depends on how your network is setup, what type of database you are using, and the communication link betweent the two sites... that's to name a few.

MPLS between sites and we are using the embedded database at the start and then in a few months we will move to SQL.

Here is my $0.02 for what it is worth....

I would first wait until you get to SQL.  You have more options and better performance with SQL over the embedded.  Especially  since you are going to be bringing in another 4,000 clients. 

Once you're on SQL, I would add a second management server to the current location (site with 3,000).  Have both servers reporting into the same database to keep everything neat.  If your DBA's are good with SQL and you have valid backups you should be fine (but you should test) as you have a weak spot in the event the database goes down. 

We currently have 4 SEPM servers running back to one database and 10k clients checking into our servers.  About 4,000 are on the other end of teh MPLS network.  The only other recommendation I would give in this scenario would be to make sure you have enough revisions being stored in the SEPM.  We're running 12 revs which gives us about 4 days worth of xdeltas.  Our network is largely made of up laptops that are on/off again.  We recently got hammered after a deployment because clients would be offline for a day and require the full.zip (40MB) when the started up in the morning.... 1,500 pulling 40MB at once puts the network team in kill mode.  :|