Endpoint Protection

We are testing the SEP11 product once again and have seen some performance issues improved with the latest revision. One issue we noticed now is that Live Update runs during startup in the morning and is adding almost 40 seconds to the startup.

I've tried everything I can think of to get around this. Has anyone else experienced this with Live Update? I need to prevent it from running at startup. It would be nice to be able to just set a parameter to not run LU until 15 minutes after boot.

Have you installed Live Update Administrator?

No I haven't used LU Administrator. I don't see anything from the description of this utility that would help me delay the live update from happening during system startup.

Can you explain this utility in greater detail and how I can use it to accomplish this?

Thanks!

I'm with thatdude.

And what would LU Admin have to do with it? The client will STILL try to run LU when it starts........... and the overhead of LU lately is pretty stout.

Hi sorry for the late reply, is this only affecting some of the clients or all of the clients?

Do you have scheduled reboots of your workstations? There could be a scheduled liveupdate during those times. Please provide more info. Thanks..

By default LiveUpdate service found on the Services.msc are manually launched or scheduled.

Please go to -> Control Panel -> Administrative Tools --> Services --> Live Update, Please confirm the Startup type and Status, it should be "Manual"

LU taking a lot of resources is a known issue now from what I hear - and is being looked at.
The fact that it runs during startup means that it missed a scheduled run and is trying to run "at next opportunity to make up".
Check the schedule, reschedule if possible to avoid it running when turned off or during startup. 
The kicker, though, is that Lu is used to get updates of defs from the SEM servers, so if you have it like we do - run LU every couple of hours, then chances are, it's going to launch at startup. The fix will depend on Symantec, IMO, to reduce the overhead LU uses.
The LU service won't be changed unless someone went in and manually changed it.

We experience the same issue here, so I know what you are seeing/feeling.

This is an issue for all of our laptops since they dont stay on in the office. As ShadowsPapa stated this is caused by our clients missing the update, shutting down, and coming back in the morning. I thought I could solve this by unchecking the option for the Retry Interval but we didnt see any differences.

We currently schedule LU to download updates once a day. I'm going to submit a case and see if we can get something fixed.

In the meantime were looking at delaying the services during startup or using a firewall rule based on time (7am - 9am) to block live update. Most of the systems will startup for the day during this time.

For laptops you can add option to LU policy to update from symantec LU server. So if they cannot connect to SEPM they will try to get updates from internet.
My guess that if there will be less updates when laptop returns to WAN LU would be not that resource consuming.

You can try what Lissome suggested, or you can create a policy for laptop to be manually updated.

LOL - if we had to rely on our USERS to do anything, the computers would be running Windows 286 and have CPAV on them with January, 1992 definitions.
We LOCK that down so users can not change or update anything. When they play, they break things. When asked to do something, they will not do it.

While I basically agree with Lissome's premise, the fact is:
>>My guess that if there will be less updates when laptop returns to WAN LU would be not that resource consuming.<<
That statement isn't true. I have checked using desktops continually connected, or only down for a day, and LU can take incredible resources, running CPU up into the 80s and lasting for 10 or more minutes.

I would object to not letting users 'update' anything...if an enduser wants to update their definitions...why not let them?

As for just about everything else....LOCK IT DOWN!

:)

Sorry but with almost 40,000 clients around the world there's no way we consider manual updates as the primary option.

I originally had LU configured to use the management server and symantec liveupdate servers. This caused multiple LU to occur at the same time making the problem even worse. According the documentation its not recommended to have both of these options enabled in the same LU policy.

How about setting up GUP's per dept?

For notebooks we use location "Outside" in Clients group with condition "not resolve internal.corp.adrdress DNS name". Default location use LU policy to update only from SEPM. "Outside" location use LU policy to update from LU.
So when notebook in WAN it successfully resolve internal.corp.address into IP-address and use SEPM. When it goes outside it cannot resolve internal.corp.address and use LU.

This is a serious issue.

Definition updates are over 70 MB on every update
C:\program files\common files\Symantec Shared\VirusDefs

There is little ability to stop the updates from happening at login.  Why so few options for managed clients getting updates, and more granular controls for liveupdate? 


This can significantly increase login times.  This encourages users not to shutdown their PC, which causes a huge waste of electricity.