Endpoint Protection

We use LUA server for definition distribution and update. We set policy as below screen. But found some clients still connect to Symantec Liveupdate server at first installation. Can help to find the cause?

This is by design, however, you can stop it from running per this KB article:

MSI command line reference for Symantec Endpoint Protection 11.0

In the setaid.ini file set RUNLIVEUPDATE=0 (1 = run LiveUpdate after install, 0 = do not run LiveUpdate after install, default = 1 run LiveUpdate after install)

Should work for 12.1 as well

What we are using is one click setup.exe file, version 12.1

This is not a good suggestion.

Any other solution ?

while exporting the package select uncheck single exe.

you will get list of msi files

edit the msi so that it will not run LU as per the document. you can use this package for deployment.

Hope you have created a client install package with Basic content.

So by default as per product designed the clients will reachout to the internet to update the initial definitions once it is downloaded from the next time it will reach the LUA to update the definitions as per your configurations.

My suggestion is Create a package with All Content and deploy it on workstations so clients will not reach the internet for liveupdate session. it will contact ur LUA.

How to export Symantec Endpoint Protection (SEP) client install packages without any definitions or package with Basic Content.

http://www.symantec.com/docs/TECH178698

All Content:  This option will have content version at the time of the deployment.

Basic Content:  This option provides small client deployment packages, the definition (content) are downloaded via LiveUpdate after client installation.

Any update on this..............

Thank for your suggestion.We install Basic content on SEP client.