Endpoint Protection

 View Only

  • 1.  SEP Manager vs SCCM issues

    Posted Jul 13, 2015 05:57 PM

    We are having an issue where some of the software we are pushing out with SCCM is being blocked by SEP on client machines. The behavior isn't consistent; sometimes nothing at all happens (the software simply doesn't install, but no messages in SEP), sometimes SEP seems to think part of the installation file is a PUA and puts it in quarantine (they are 100% legitimate MSI installers), sometimes the SCCM installer gets hung up during the installation. Whatever the symptom, uninstalling SEP on the client results in the software installing instantly with no issues.

    We have other software in our SCCM library that installs with no issues, so it isn't right across the board.

    I'm completely new to SEP Manager (we use 12.1.5) and am wondering where the best place to start with this issue would be? Can I simply tell SEP to ignore anything downloaded into the local CCMCACHE folder, for example?

    Thanks!



  • 2.  RE: SEP Manager vs SCCM issues

    Posted Jul 13, 2015 06:45 PM

    Do you see these entries in the risk log? If so you can added them to the exception policy right from the risk log.

    Creating exceptions from log events in Symantec Endpoint Protection Manager



  • 3.  RE: SEP Manager vs SCCM issues

    Broadcom Employee
    Posted Jul 16, 2015 01:04 PM

    Hi,

    Thank you for posting in Symantec community.

    I would be glad to answer your query.

    Symantec recommends that SCCM/SMS packages launch Setup.exe rather than the MSI directly. This method enables installer logging. Use the custom package creation feature in SCCM/SMS to create custom packages instead of the package wizard feature.

    Follow the steps given in this article: Installing Windows clients with Microsoft SCCM/SMS