Endpoint Protection Small Business Edition

Hi there,

We are looking to do a mass deployment of SEP 12.1 (client currently has 11.05 installed).

From manual install, the process needs 1-2 reboots.

Because of this, some kind of at log on install will proabbly be the only option, but does anyone who has done this before using SCCM have any tips or msi command lines that could be used.

We will be creating the package as silient and unattended.  Tryimng to figure best route to accomodate the reboots.

Thanks

Installing clients with Microsoft SMS 2003

http://www.symantec.com/business/support/index?page=content&id=HOWTO55425

A few forum threads may also have info that helps:

https://www-secure.symantec.com/connect/forums/problem-installing-endpoint-protection-11-12-through-sms-andor-sccm

https://www-secure.symantec.com/connect/forums/sep-ru6-distribution-sccm

https://www-secure.symantec.com/connect/forums/1603-install-issue-sccm-solved-me

https://www-secure.symantec.com/connect/forums/sep-installation-sccm-task-sequence

https://www-secure.symantec.com/connect/forums/deploying-sep-121-using-sccm-2007-r3

Hello,

http://www.symantec.com/business/support/index?page=content&id=HOWTO55425

Note: This Article also applies to Microsoft System Center Configuration Manager (SCCM).

There is also a “Installing clients with Microsoft SMS 2003” section of the Symantec™ Endpoint Protection Implementation Guide has additional details that has additional details about deployments via SMS 2003 and SCCM 2007.  In my experience, following the steps there should be successful.

Workstations, and VM's. I have exported my exectuable's, created single .exe's and checked the boxes to have the installations put the workstions into the Workstations group and to get the associated policies, and the same for the VM group. If I manually run the executable on a machine, the machine get's put into the correct group and gets the correct policy. If I have SCCM push the installation, every machine no matter what executable is used, the machines end up in the DEFAULT group. Is there a reason for this?

Are there duplicate clients appearing in the SEPM, or are all the clients just in the wrong group?  If it is that all clients are in the wrong group, then the most likely situation is that the setup.exe created for the default group has been rolled out to all clients, not just the machines intended for that group. 

Another possibility.... Those setup.exe files created have a sylink.xml inside of them which has details about which client group to apply to the installed client.  If you have time, open both setup.exe's with winrar, 7z etc and extract the two sylink.xml's.  Do they specify the desired groups or are they both for the default group?

Reference: https://www-secure.symantec.com/connect/forums/deploying-sep-121-using-sccm-2007-r3

A few forum threads may also have info that helps:

https://www-secure.symantec.com/connect/forums/problem-installing-endpoint-protection-11-12-through-sms-andor-sccm

https://www-secure.symantec.com/connect/forums/sep-ru6-distribution-sccm

https://www-secure.symantec.com/connect/forums/1603-install-issue-sccm-solved-me

https://www-secure.symantec.com/connect/forums/sep-installation-sccm-task-sequence

Please do keep this thread up-to-date with your progress!

Thanks a lot guys!

Bed time reading for sure!

We currently have v 11.05 clients that were previously upgraded from SAV so are not installed in the default, clean install place (it reused elemetns of the 'Symantec Antivirus' folder.

I have tested both an upgrade and clean install, but think a clean install is probably best to avoid remnance of 3 versions!  Would you guys send a cleanwipe package first?

Davinci_uk,

Why you can remove SEP 11 Client ?

You can use SEP 12.1 Autoupgrade feature and upgrade SEP client.

Upgrade clients to SEP 12.1 by Auto upgrade feature

https://www-secure.symantec.com/connect/articles/upgrade-clients-sep-121-auto-upgrade-feature

http://www.symantec.com/connect/videos/upgrade-clients-sep-121-using-auto-upgrade-feature

The only problem I see wih autoupdater is clients will consum lots of bandwidth as each indivudually fulling the full package from the SEPM servers - I do not believe GUP's can pass on content like they do AV defs?

We use SCCM as a big environment and can see secoindary site servers and BDP's to limit network bandwidth.