Endpoint Protection Small Business Edition

I am trying to understand how the autoupgrade processs works. How does it choose what machines to do, and how does it decide to throttle itself. I have assigned a package to a group, set the schedule to run all the time in pull mode (from 0:00 to 23:59) and run for 7 or more days. Yet, it took effecively one working day to do one machine(I started the upgrade on two machines at the same time and only one finished during the day and the other is yet to get it).

Is there any other ways I can see or control how the autoupgrade process works? I want to upgrade all my clients but it will take an eternity for all my clients to autoupgrade at that rate.

any help is appreciated.

I believe it is a proprietary algorithm which decides on how it is done.

Other than setting a schedule I don't believe there is much more control over it.

Ideally, once a client checks in, it will receive the instruction and the process begins based on the algorithm.

If you set the upgrade for 7 days, it should complete within those 7 days. if you leave the schedule unchecked, it should begin on next heartbeat process.

so what could account for one machine getting the upgrade 8 hrs after it was sent, and another never getting  it? Both machines are in the same subnet and in the same building as the management server (ie no need to traverse the WAN)?

uncheck schedule and us ethe package for upgrade. it should start taking immediately with its heartbeat.

It never got it over the 7 days?

Has the machine been rebooted? Maybe SEP detected that the system needed a reboot before proceeding so the upgrade was not done.

Anything in the Windows event log?

You should enable sylink debugging on the affected machine and let it run thru a few heartbeat check-ins, than post the log here for review.

How to enable Sylink debugging for the Symantec Endpoint Protection 11.x and 12.1 client in the Windows Registry

Hello,

Upgrade Schedule - Lets you control the time of the client computer upgrade.

1.The upgrade has only been running for  a day or so-I only set it that long because one tech I spoke with indicated that the install could fail if I only set the install period to one day (or no schedule at all). 

2. The machine has not been rebooted except at the end of the day.

I am attaching a sample sylink file that I posted on another threat. 

on a related note, as I was typing this response, one of the machines that I tried to use the push deployment tool on threw this error

Attachment(s)

Sylink_9.txt   77 KB 1 version

Hello,

Try installing only Virus and Spyware Protection feature on the client machine 

OR

Try deploying SEP on the D drive. http://www.symantec.com/docs/HOWTO50288

Check these Articles:

Several errors after deploying a Managed SEP 12.1 Client

http://www.symantec.com/docs/TECH169910

Symantec Endpoint Protection fails to start with the following error:"Runtime Error! Program Files\Symantec\Symantec Endpoint Protection\Smc.exe.""The application has requested the Runtime to terminate it in an unusual way, please contact the application's support team for more information"

http://www.symantec.com/docs/TECH96069

Steps to prepare computers to install Symantec Endpoint Protection 12.1 client

http://www.symantec.com/docs/TECH163112

Hope that helps!!

 I dont quite get the last part of the equation

Number of Computers as MB / MB per second * Num = seconds

do you mean the number of computers divided by the transfer rate ?

so for some strange reason after I rebooted the installer seemed to have completed. I am running a full scan now-I think somehow whatever services that were stopped during the installation didnt restart.

Regarding the original issue-

My current install settings are to not force a reboot and not prompt the user at all. Could that be impacting deployment?

Even if a no force reboot was selected, the SEPM would still report the client needed a reboot after the install completed. So you would know the install happened.

that is what I suspected-

one final questiona and then I think I will follow-up on the ticket I have open.

If  I use the push deployment tools, what processes can I look for to see if something is happening or not-likewise, if I do the autoupgrade are there any processes that I can look out for to monitor high CPU/memory usage?

Thanks everyone in advance-

your answers have been extremely valuable.

You usually will see multiple instances of msiexec (I usually see 3) plus the setup.exe process.

If you use Process Explorer it will show you everything but since your doing this remotely, you may not be able to access the client when this is going on.

Hello,

I agree with Brian.

In the Process Explorer, you would see the 3 instances of msiexec.exe and setup.exe

Hi,

Helpful articles:

Which Communications Ports does Symantec Endpoint Protection use?

http://www.symantec.com/docs/TECH163787

Processes and Services used by Symantec Endpoint Protection

http://www.symantec.com/docs/TECH102748