Endpoint Protection

Hi,

I have Symantec Endpoint Protection 11 running on Windows Server 2008 x86 and an assortment of Vista/XP/Server 03/Server 08 clients. The clients can get updates manually if I enable manual updating in the Management Console (getting it directly from the website, not from the Management Console), but they do not receive updates from the server, they go straight to the website.

The only component I use is anti-virus/anti-spyware. The strange thing is that one of the clients (Windows Server 2008 x86) has the pro-active threat protection component installed (but disabled), and THAT component is updating.

I've tried reinstalling LiveUpdate and manually downloading the updates from the website but neither of these have worked. I haven't yet reinstalled the Management Console but to be honest I'd rather avoid that if possible (recreating the policies, re-joining the clients etc.)

Any help you could offer would be greatly appreciated.

First of all is the SEPM updating and what definitions you have on SEPM.
How are the client directly connecting to internet?
Have you specified Liveupdate policy to Get and definitions from Manager Server and Use Symantec Liveupdate server?
Are the policies getting updated?

PTP is off on the server and 64 bit OS by design.

Yes, any changes I make to policies are being updated on the clients.
The clients connect to liveupdate.symantec.com through the network's ISA 2006 server when I ask them to manually update (by actually opening LiveUpdate in Control Panel).
And yes, I've specified both Management server and LiveUpdate server with different variations of both.

PTP is not supported on Server platforms, but u wll get the updates for it

By default, SEPM update the clients and the server pulls the updates from Symantec. Did you make any changes to the rules? Like when will they update, where they will get the definitions, what it would do if the schedule is missed and if the clients can cancel the update. See also page 114 of the administration guide.

Yes I have modified those rules. They are trying to update at the right time but nothing happens.

I don't think You can make changes in clients for the policy updates. Yu can manually update policy.

Yeah, there's nothing wrong with polcies replicating to the clients once changed on the Management Console. It's just new virus definitions that aren't working.

Please download the SEP Support Tool, just search it on the Symantec Website. This might suggest current problems with the clients.

Paul, please post a link of that support tool here. Thanks.

As you requested, Here it is

http://www.symantec.com/techsupp/home_homeoffice/products/sep/Sep_SupportTool.exe

The tool didn't really help all that much. The errors listed were basically all system requirement ones.

Hi zorbo, Can the clients ping or access your liveupdate server? Do you have policies for them? Are the polices properly assigned to target workstations.

And what do you mean from your last post "The errors listed were basically all system requirement ones." Does this mean you didn't meet the requirements?

Yes, the clients can ping the LiveUpdate server and yes, they have policies which are being successfully replicated.

The clients all meet the system requirements but the server barely does.

hi zorbs, what specific requirement the server fail?

Please check/post client liveupdate logs if possible.

@zorbo88 "...The clients all meet the systmem requirements but the server barely does."

I think the system requirements posted by most softwares are for the requirements for it to run. If it would run but take an hour to load up. Then it passed.
Check the recommended specifications instead.

You could alter the settings in the server. In the LU policies.
The "Use the default management server (Recommended)" is checked by default

Setup a LU server and use your current server in the Add...

So either they connect to the management server or the LU server which is the same.

I tried doing this - the interesting thing here is that it made the client that is installed on the server with the management console update, but none of the workstations. This leads me to believe that it might be some sort of network infrastructure issue.

Hi zorbo, did you install NTP on SEPM server?

@zorbo88. Just curious, what is the current status of the firewall?

Network Threat Protection is not in use. The only component that I use is the antivirus/antispyware. And the Windows Firewall is turned off.

How about IE Enhanced Config? Is it enabled?

No, it's not. Should it be?

No zorbo, but for security reasons it should be and you should add trusted sites in. Can you post liveupdate logs so atleast we will have a basis as so what is preventing the update.

The logs from the clients? The only log files I have available to me are the Antivirus/antispyware and Client Management.

Yes, client AS/AP system log, and Client mgmt system logs.