Endpoint Protection

Hi,

I'm having an issue with Location Anywhere with SEPM 12.1

I've setup an 'Out of Office' location in 'Manage Locations' on the client policy so the condition is when the client doesn't see the management server, it supposed to pick up the definitions from the Symantec LU server. This is picked up from the parent structure and drilled down to all other objects.

When the client is out of the office, the notification message does come on ("The location has changed from Internal to Out of Office"). However, it doesn't pick up the LU server and can't see the connection being online (green round ball over the yellow sheild). When viewing the connection status, it shows it's not connecting and displays the 'Wininet Error 9' message.

Does anyone know why it's not picking the LU server and bringing this error message when the client is out of the office?

Thanks.

Mo

Run a repair on the client

HI,

I've seen that article, where do I copy the Syslink.xml file from? From the management server and copy this to the client directory?

I'll try the repair client as well.

Thanks.

Mo

See this thread

http://www.symantec.com/connect/forums/error-wininet-error-9

Edit

https://www-secure.symantec.com/connect/forums/error-wininet-error-9-100-soln

does the LiveUpdate button active when location is changed?

when you manual click Liveupdate, what's the message you get ?

I don't think the button is active, the location changes fine based on the condition and brings up the message informing the user the location has changed.

It attempts to contact the management server rather than the LiveUpdate server - I think anyway. I've created two policies, one for internal and one for out of office. The internal policy contacts the management server and the out of office policy setup to contact the default Symantec LiveUpdate Server.

Somewhere it isn't either picking up this particular setting (retrieve updates from LU) or maybe the client needs a repair so it can see the updated configurations from the management server and both of these policies?

I've also applied both policies to the objects in the management console. Default for Internal and Out of Office to the external objects.

Also, what's the exact SEPM/SEP versions?

Both versions are 12.1.2

Hi,

I tried the repair on the client and then restarted and same outcome. When I try to attempt to go on the 'Connection Status', it definitely shows it recognises the out of office location as setup on the management console. It just seems it wants to pick up the management server rather than the LU server.

2 policies have been created on the management console. 1 policy for internal and contacts the management server for definitions (default setup), and 1 policy for out of office and this policy is setup to contact the default Symantec LU server and I've assigned this policy to the 'Out of Office' locations.

Any other ideas?

Thanks.

Maybe the client policy is corrupted, can you try moving this client to a new group where you create two new similar locations and assign two new LU policies as well - one per location - is the problem occuring during this test as well?

Once the client has moved to a new group and 2 new policies have been created, does the SEP client on machine has to be uninstalled and reinstalled?

Or leaving this fine and just creating a new group and new polices to test?

Thanks.

does the SEP client on machine has to be uninstalled and reinstalled?

SEP client not removed.SEP client will received new policy

It does not need reinstallation. Just leave the client - it will receive the new policies once you assign them.

From the sounds of it all, it is working as intended.

As far as the SEP Client goes, if it cannot contact your SEPM then you lose the green dot.  The green dot on the system tray icon is only present when the client is in current contact with the SEPM.  Obviously it would make sense for the green dot to disappear if in an "Out of Office" location.

Secondly, the Connection Status (viewed from Help -> Troubleshooting on the client) only denotes the SEP Client's connection to the SEPM.  This does not indicate the status of the connection to Symantec LiveUpdate.  Therefore, this is expected to say "not connected" when in an "Out of Office" location.

Now, assuming your "Out of Office" location is correctly configured with a LiveUpdate Settings policy that tells the clients to "update via LivUpdate" and use the "Default Symantec LiveUpdate" servers, then you're not really going to see much in the way of confirmation that this is working on the client without also changing the "Advanced" section of that policy to "Allow users to run LiveUpdate" (so that you can kick off a LiveUpdate session while in the "Out of Office" location) or looking at the LiveUpdate logs themselves.

http://www.symantec.com/docs/TECH168602

On a side note, I normally recommend using the "DNS Lookup" condition over the "Management Server Connection" condition when creating locations for if a client is off the network.  The reason for this is that it is more consistent and reliable.  I find it's generally quite rare for DNS to completely fail, whereas any sort of network blip can cause the "Management Server Connection" condition to fail.

Ok that explains to me a bit more from Internal and Out of Office connection (no round green ball and will not display connection online and the LU server in connection status).

I will amend the condition to DNS Lookup to our internal DNS server on the 'Out of Office' policy.

Once I change this, I can check the next day for example logging into the laptop outside the office whether latest definitions are being pushed out to the client via LU.

Would this be the next thing to test?

Thanks.

Yup, once the machine is in the "Out of Office" lcoation, then next thing to test is whether or not it is updating via Symantec LiveUpdate.

As I mentioned, the best ways for checking this are either viewing the log.lue file or by initiating a LiveUpdate attempt.

Hi,

I tried this from outside the office and doesn't update definotions from the LU server (see attached). 

It still wants to attempt to contact the management console even though it's offline and recognises the location 'Out of Office'.

It seems it's still not bringing down the LU settings on the Out of Office policy. Anything else?

Thanks.

Attachment(s)

SEP OOF Screen Dump.docx   642 KB 1 version

Have you had a look at the log.lue file I mentioned earlier?

The below article tells you where this is located:

http://www.symantec.com/docs/TECH168602

The screen you posted has nothign to do with the SEP Client updating while out of the office.  When offsite, a SEP client would normally be configured to use the LiveUpdate Engine, which is an entirely different update mechanism.

I see from the screenie that you have not enabled the "Allow users to run liveupdate" in the LU Policy assigned to the out of office location.  As beofre, I still recommend you enable this to allow easier testing.

#EDIT#

The below article gives you a bit more info on the "Allow users to launch Liveupdate" option:

http://www.symantec.com/docs/TECH178257

This also describes the "Options for Skipping LiveUpdate" under the Schedule section.  These are enabled by default, but should both be disabled when configuring a LU Policy for an "out of office" location.  Other than that, leave the normal schedule on the default "every 4 hours".