Endpoint Protection

Hi everybody,

We are planning on migrating two of our biggest customers from SEP11 to SEP12 RU1, and as know by many of you, in really big environments (something around 40K clients), SEP11 (even RU7) seems to have many troubles to keep all clients in Computer Mode. We have been for more than a year in direct contact with support, even escalated to develop team who helped us a lot by given us ways to remediate this problem such as creating scripts to warn us by e-mail every time a computer is automatically changed to user mode, or scripts to convert all user mode clients in database to computer mode, but it’s still took constantly attention from us.

So far , please correct me if I am wrong, I guess SEP11 was initially designed to be always used in USERMODE or at least to be by default used in USERMODE. And maybe SEP12 changed that conception.

And my question is, knowing we have this huge SQL database and daily we have clients turning automatically from computer to usermode, which should be the best upgrade path to resolve this particular issue. Should we try with a new clean SQL database for SEP12 or the upgrade is good enogh? I mean, is this problem related to the database, do we run risks to keep with the problem simply upgrading our consoles?  

What do you guys suggest?

Thanks and Regards

I do not think this was known issue as such as Sep work's good in user mode probably this might would have been envoirnment specific . Try upgrading few machines to 12.1 in your test lab with usermode and check .

Pete is correct there is an tool to convert however make sure to back up the db and certs before running it on the spem box .

So far , please correct me if I am wrong, I guess SEP11 was initially designed to be always used in USERMODE or at least to be by default used in USERMODE. And maybe SEP12 changed that conception.

it was computer mode by default with SEP 11 and same with sep 12

you can run the tool lto convert user mode to computer mode and then upgrade.

My problem is that, in a 100% ComputerMode enviroment,  whenever a client is somehow changed to UserMode (don´t know the reason why) and we convert it backup to computer mode it sometimes changes its original Client Folder and as a result it changes all its policies. Imagine how much trouble can that cause when a computer is changed automatically to a OU with USB block polices or SystemLockdown police for example...

Like I said, We´ve seen this same problem in more than 1 SEP enviroment, as far as i can correlate them it seem to happen when you have more than 10K clients.

What i am really looking for is some way to prevent it to change to usermode. Does anyone heard that this auto changes are not happening on SEP12?

I am sorry, since I am facing the same problem in two different customers and based on support analysis I assumed this is a common problem in big environment using ComputerMode.

Is there anybody managing more than 5000 SEP clients in Computer Mode who never faced this undesired auto changes to user mode? 

Thanx

Hello,

   As stated above, SEP 11.0 is primarily designed to use Computer Mode, with the option to use User mode if needed.

There have been a large number of cases where clients started switching to user mode unexpectedly in SEP 11.0 for various reasons, some of them have been fixed, some of them are by design.

It typically happens when a clients is either installed using a client package set to user mode by mistake or if a client is switched manually to user mode in the console, either way, if the user that is logged on that machine logs on to a different computer, it will switch it to user mode as well.

I am not aware of design changes for SEP 12 in that respect, however I have not yet encountered cases of this happening in SEP 12.

Again, this issue normally shows up if mistakes were made while creating install packages or managing clients in the console. They do not happen randomly (improvements were made in Ru6 in that respect as well if I remember correctly).

Hope this helps.

Thanks for the explanation Jeremy,

I am almost sure that there were not a single installation package set to be usermode but I will check that.

So let me see if I got this right. Let´s say there is one single system in my network which was deployed by mistake as user mode and this system is located in a very restrict group. And one day its user logs as “administrator”. Does that mean that every system logged as Administrator will automatically be turned into USERMODE and will be moved to that group?

In my daily check for usermode systems I use to see a lot of Administrators.

I will try to keep track of every system that auto turns to usermode to understand if is there any correlation between them and share with you guys.