Video Screencast Help

SEP Support for Windows Small Business Server 2008

Created: 23 Jan 2009 • Updated: 21 May 2010 | 17 comments
Triplight's picture
This issue has been solved. See solution.

Hey All,


SEP MR4 system requirements state that the Manager & Manager Console console install on SBS 2008, but do not mention compatibility for the SEP client itself. SEP client compatibility is mentioned for other Server 2008 flavours, just not SBS. 


Does installing the Manager software on SBS 2008 also secure the station, or is a client install also required?  If so, do client installs of SEP work on SBS 2008?  I doubt there is much architectural difference between different Server 2008 packages...?   


Basically I want to know if I can install SEP with SBS 2008 as the server, and secure the server and all client stations (Vista/XP) with this solution. 




Comments 17 CommentsJump to latest comment

Citlali's picture

I don't see any reason why not.  The client is supported on every version of Windows 2008 as far as I know. 

Michael J Pfister's picture

Hi Guys


I have deployed the console on my SBS 2008 successfully, the client on the other hand is broken.


situation:  console installed successfully and configured, created deployment package for the server itself.

- Deployed client to server, REAL-TIME PROTECTION FAILED TO START.  there is a link to a support article which states that symentc is apware of the problem..............


i have tried to deploy the package with various options enabled/disabled and out of the 10 or so times i installed it only on one occation did it load and start successfully.  i then rebuild server and generated the same package based onthe chooses selected  when it worked and failed.


i am now using microsoft onecare for server protection and waiting for a client which is provent to work in SBS 2008.


i have the client and console running in 2008 servers (standalone) successfully just SBS.

Triplight's picture



Thanks for the report.  Seems like the system requirements page is all too accurate.  I'm going to forge ahead with the SEP SBS install and use OneCare to as a client meanwhile, per your example.  I assume I can introduce the SEP client at any time. Hey Symantec... MR5 please...

ObieOne's picture

So we cannot install the SEPP Client on SBS 2008?

I just migrated our own environment to SBS 2008.
I was looking for info on installing SEPP and SMSFE on the new server, but assume it is not ready yet, due to the many posts on the forum.

We have MR4 MP1 running (11.0.4014.26)
I am just looking for client installation, we have the manager running on a seperate Server 2003 box.


Paul Murgatroyd's picture

There is no reason why the SEP clien't wont install on SBS 2008 - I have it running fine in my test lab.  Our installer should even remove OneCare for you.

Paul Murgatroyd
Principal Product Manager, Symantec Endpoint Protection
Endpoint twitter feed:

ObieOne's picture


Any special considoration compared to SBS 2003?
Otherwise I will install it this evening.


Dale Sydnor's picture

I also have 11.0.4014.26 and installing the client on the SBS Server itself results in Error 22 - "Real Time Protection Failed to Start".  I even tried activating the "real" administrator account and pushing the install from SEPM while logged in as "Administrator", that did not work either.  A repair from "Control Panel - Programs and Features" did not change the situation.

Other clients, 2 Vista (one 32bit and one 64bit) and a 32bit XP all pushed successfully.

JeffatICS's picture

How did you get SEP 64bit to work or better yet what problems did you ecounter while getting it to work?

I could not get SEPM to fully install without first disabling UAC

My client is complaining:

File System Auto-Protect is malfunctioning.

File System Auto-Protect is not functioning correctly. Your protection
definitions may be damaged or your product installation may be corrupt.

ITGuyInBFE's picture

I've installed SEP 11.0.4014.26 on 2 separate SBS 2008 networks now.  I'm not sure if all these steps are strictly necessary, but they worked for me.

1.  Turn off the native Windows SBS firewall
2.  Disable client firewalls via the SBS group policy manager.  Give the workstations time for the group policy changes to propogate to the workstations, or Start, Run, GPUPDATE from each workstation.
3. Install SEPM on the SBS 08 server.
4. Using SEPM, install the SEP client onto the server using the 'All features of Symantec Endpoint Protection' option (this includes the SEP firewall).
5. Using SEPM, install the SEP client onto the workstations using the 'All features of Symantec Endpoint Protection' option (this includes the SEP firewall).
6.  At this point, all the clients should be communicating to SEPM correctly, since the required firewall exceptions are already built into the SEPM firewall policies.
7.  One final issue, mostly cosmetic, is that the Windows SBS Console 'Network Essentials Summary' will show a critical issue under the Security section, because the Windows SBS firewall is turned off.  To correct this, edit the SBS Windows firewall settings, under 'advanced', 'Network Connection Settings', 'Select the check box for each connection you want Windows Firewall to help protect', and uncheck 'Local Area Connection'.  Now turn the Windows SBS firewall back on, which will clear the Windows SBS Console critical firewall error.

crazylegs's picture

Does anyone know if there is a best practice guide up yet for installing and configuring SEP 11.x MR4 MP2 on an SBS 2008 Server and Windows XP / Vista client workstations?

I seem to find conflicting information on the topic....

Earlier SBS 2003 best practices and SBS 2000 (yeah I know), talk about creating a specialo deployment package for the server using ONLY anti-virus and anti-spyware.  Here it is mentioned to install the default package with the symantec firewall on the server.  Earlier guides and other recommendations also say NOT to install the firewall and Threat protection to XP clients due to the loss of network resources issues many have already experienced.  I understand that issue is supposed to have been resolved in MR4 MP2.  I also do not see any information regarding exclusions for the server here?  I am in the process of setting up an SBS 2008 Server that will replace an existing SBS 2000 Server with XP workstations already running SEP MR4.  Any information on regarding "best practices" for SERVER installation/configuration AND WORKSTATION installation and configuration for an SBS 2008 network would be greatly appreciated.


ObieOne's picture

We came a long way with SEPP and I do not want to go that way again by experimenting again.
So I just used the SBS 2003 Best Practices Guide and left the Windows Firewall alone.

The policies used in the initial guide have changed over time by the way.
For instance: Exchange db location is now taken from the registry and does not need to be exluded. But I exluded it anyway, just to make sure.
Also File System Auto Protect was not supported on any Server 2003, so I guess it will not be supported on 2008 as well.

As I said, just follow the 2003 guide, It's better to make sure with this product.


AllenM's picture

Interesting postings here. After reading all the posts and replies it looks like SEPM with work if installed on the SBS 2008 Server following and using ITGuyInBFE's instructions. I've got a different scenario.
I just migrated from an SBS 2003 Premium environment to a SBS 2008 Standard environment. I've SEPM v11.0.4202.75 installed on a Windows 2008 Standard member server. From here deploying clents to XP SP3 workstations as well as a W2K3 server works fine. Even deploying the ^$-bit client to the SEPM hosting server works fine. My rpoblems are deploying the SEP 64-bit client to the new SBS 2008 server. This has created a real bad scene for me where my server was not accessable and nobody could log onto the network of course. What happens is after running the Migration and Deployment wizard is completes successfully. However it never shows as being installed on the SBS 2008 server and casuing DNS entries to be removed thus creating no access from client workstations.
So my question is does SEPM have to be installed on the SBS 2008 server in order for the SEP client to work on it or has anybody successfully deployed the client via a different W2K8 server or any other server for that matter.

Vikram Kumar-SAV to SEP's picture

 The issues with Server 2008 32/64 bit is almost resolved in Mr4Mp2 (11.0.4202.xx).
You do not have to install SEPM on server 2008 for sep client to work.
However  It is recommend that you install only Antivirus and Antispyware on Server 2008 64 ( PTP is not supported on server/64 bits systems so no use)
NTP ( Firewall cause more problems than solution many times .) is also not recommened without teting it first on your environment.

Vikram Kumar

Symantec Consultant

The most helpful part of entire Symantec connect is the Search use it.

ObieOne's picture

I noticed when deploying the x64 client to our SBS2008 from our member server the install would not finish.
It hangs somewhere in the background, which I could see due to 4 or 5 msiexec processes.
I stopped these after an hour and rebooted the server.
Then created an Install package, put it on a network share and installed that from the server itself.
Only AV is deployed here. No NTP, PTP or what ever, just plain AV.
Works like a rock as long you make sure the centrelised exceptions are ok.

Good luck.

AllenM's picture

Exactly what I was looking for. The proper procedure and someone who has successfully deployed it.