Endpoint Protection

Okay. I am just at the moment to deploy SEP client to my BES (Blackberry Enterprise Server) and Exchange 2003 server. I have read a few posts here particularly on Exchange server. But I just want to be sure that I can push the client through SEPM to these two seperate servers without a problem. Both servers are VMs.  I can NOT afford a mistake on these two critical servers in my environment. Many thanks. 

You can deploy the client, but you will need to reboot at some point. Preferably the sooner the better. I have SEP on both our BES and Exchange 2k3 and I havent seen any problems.

Thanks umass_med. May I know how did you deploy it? Manually and locally or through SEPM? Thanks.

For those I exported a package from the SEPM to a share and ran the install files from that share. I didnt want to deploy to those boxes.

If you just deploy AV/AS, you wouldn't need a reboot. 
If you deploy NTP, you will before that service will be active.

Device control is not need on a server either, but it too requires a reboot
Proactive Threat Scans is not supported on servers, so dont bother.



SEP will automatically create exclusions for Exchange, as well as any DC roles.  You will have to manually create any needed for the BES.  

teiva-boy, thank you.  Any document that I can read up about the SEP exclusions for BES?

I have just SEP AV/AS only installed on my BES 4.1.6 MR5 and all is working well. I never made any exclusions for it and have no issues with it.

Excellent. Good to know and it seems good to go!

I have BES 4.1 and SEP 11 client is not installing. Program seems to be working during installation but all of a sudden in the middle of installation screen just gone and no error nor any thing that will say that the installation failed. Any idea it will be much appreciated... Thank you.

@mkindica, can you locate the SEP_INST.log file?  This is created during the SEP install.  Most likely in the %temp% folder on that server or under c:\windows\temp.  In the LOG file, do a search for return value 3  and paste the 10 lines above that into this thread.  That should tell us why your install is backing out.

@eagleh, here is a link to BES specific exclusions
http://www.blackberry.com/btsc/dynamickc.do?externalId=KB11573&sliceId=SAL_Public&command=show&forward=nonthreadedKC&kcId=KB11573

we too use just AV/AS on ALL of our servers, including BES and Exchange.  We deployed to these servers via SCCM, not the SEPM.  From SCCM, we deployed an exported package with only the AV/AS enabled.

@Blenahan - i can't find that file. I checked with temp folder and windows temp but no log file there. Please assist more. thank you so much by the way. 

do a search on the drive if you can for SEP_INST.log, it should be there.

the reason is maybe because i reinstall the symantec client security (this is the old antivirus of our BES) because i cannot leave BES without any anti virus.

What can i do more?

the SEP_INST.log should be there.  You can try this.  Export the install for this server Os from SEPM (NOT single executable).  Move the exported install folder wherever you are going to run it on the server from.  Create a shortcut to the setup.exe in it's same folder.  Edit the properties of the shortcut file, and in the target field, after "[DRIVE LETTER]:\...\setup.exe", paste this:  /v"/l*v c:\SEP_INST.txt /qn", so that your whole string would look like "[DRIVE LETTER]:\...\setup.exe" /v"/l*v c:\SEP_INST.txt /qn".  This basically forces the verbose logging to a specific location.

Also, some basic things to make sure of before the install is run is that there is at least 700 MB free OS space available.  Also, uninstall LiveUpdate from Add/Remove Programs before the SEP install.  Also, perform a restart of the server right before the install.  Of course only do these things proactively if you are still unable to generate a log file from the SEP install.