Endpoint Protection

Hi Everyone

I am looking to create a SEP package for deployment via SCCM.

Just created one with ALL CONTENT, and its around 500MB in size. This is huge!! We have remote sites that do not have local distribution points, and slow WAN links, and this might be a problem, even using BITS to download. The virusdef (vdefs.zip)  file alone was around 400MB.

Was considering using BASIC CONTENT to reduce the size.

Can someone tell me, if i use the basic content package, and the installed client starts downloading virus definitions via live update, will the definition it download be around 400MB?

Basically, what im trying to get at is, with remote sites that have no GUP, No SCCM DP, slow WAN links, what will be a better option for me to deploy the new version of the SEP package? Using ALL CONTENT or BASIC CONTENT?

Thanks,

DM

Basic content package is roughly 75MB or so in size while the Full content is somewhere over 350MB I believe.

If you do a basic content package, after the install the client will go out to LiveUpdate to download what it needs. So yes, it will still need to go out to download but you won't saturate your network when pushing the package to clients.

How to export Symantec Endpoint Protection (SEP) client install packages without any definitions or package with Basic Content.

Thanks for the quick reply Brian.

My full package is 500MB, with 400MB vdefs.zip file.

Would you know if its normal for vdefs.zip to be that large in size? Can this be reduced in size somehow?

If the client installed with basic content goes out to update the virus def, and it is downloading close to 400MB, then i have no choice but to use SCCM to deploy the FULL content package, as it uses BITS. The virus definition update will most likely use SMB. And one machine doing this update could congest the network on our slow WAN sites.

Thanks!

DM

Yea that's been a problem for some time now, the virus defs continue to grow in size. It cannot be reduced in size at this time.

I know Symantec has been working on this as it's been a sticking point so maybe something is coming in future releases. At this time it's not possible though.

Hi,

asnwering your question, yes, if the clients are installed with the basic content, they will then download 400 MB of definitions from the SEPM.

I'm afraid, you need to find a "local distributor" of an "all content" package; if it cannot be a server, it might be just a burned CD to be manully passed to all clients by the local IT guy/advanced employee...

Install client with Basic content. Create GUP, update gup with intelligent updater, it will not request only delt from sepm...Let all the remote clients update only from local GuP

If the remote site has a separate local Internet egress point (aside from the slow WAN link you've already mentioned), you might consider pushing out the BASIC package and having the client update over the 'net.

Another option, assuming you want to pursue the BASIC client packages, would be to look into the LUA.

This would allow you to push the defs out to each of the remote sites on a schedule (rather than allowing the clients to pull the defs whenever they heartbeat).  This will not solve the bandwidth issue, but will allow better management through scheduling and throttling capabilities.

Unfortunately, everything goes down the one WAN link, which can be small as 2meg link.

Hence, at this stage, i might stick with the FULL content, and push it out with SCCM using BITS, and possibly arrange this to happen after hours.

Alternatively, might burn the package to DVD and ship it over.

Thanks everyone.

DM