Endpoint Protection

Good morning,

We are planning to go from RU4 to RU4 MP1b, and have couple of quick questions.  I know we can follow http://www.symantec.com/business/support/index?page=content&id=HOWTO80759 for the procedure.

1. Will there be any issue when MP1b is applied to SEPM and the clients are still running RU4 without MP1b?

2. Will client upgrade force reboots on client machine?  (I understand reboot is needed to finish the upgrade, but will reboot be forced?).

Thanks in advance for any help,

1. No. The SEPm can manage all versions of 12.1

2. As long as you don't have it on your package to reboot, you should be fine.

Will there be any issue when MP1b is applied to SEPM and the clients are still running RU4 without MP1b?

There is no issue, you can able to manage it easily.

Edit

Will client upgrade force reboots on client machine?  (I understand reboot is needed to finish the upgrade, but will reboot be forced?).

It depend on you, you can create the packahe where mention the schedule reboot

https://www-secure.symantec.com/connect/articles/how-do-i-create-and-configure-custom-symantec-endpoint-protection-installation-package-vers

Hi,

Thank you for posting in Symantec community.

I would be glad to answer your query.

1. Will there be any issue when MP1b is applied to SEPM and the clients are still running RU4 without MP1b?

--> This upgrade applies to clients only not for SEPM. It's important to upgrade clients to patch the vulnerability. You can simply import MP1b clients packages into the existing SEPM and deploy it.

I would recommend to go through this article: http://www.symantec.com/docs/TECH223338

--> Reboot is necessary to complete the upgrade, to take over the old version of SEP. You can create the package as per your requirement. 

#MP1b

Thank you all for the quick replies.  Just to confirm, so SEPM does not need to be upgraded and can stay at 12.1.4013.4013 (RU4)?

No, SEPM 12.1.4013 has the Heartbleed/SSL vulnerability. Best practice would be to use the SEPM 12.1 RU4 MP1b installer from FileConnect. This will update SEPM to 12.1.4104 and add the 2 new PC packages (12.1.4112) to Admin>Install Packages.

http://www.symantec.com/docs/TECH216176

MJD

I missed this part that SEPM is at 12.1 RU4 (12.1.4013.4013)  As we were talking only about client vulnerability. 

To cover SEPM vulnerability about SSL you need to upgrade SEPM. To cover SEP client ADC vulnerability you need to upgrade SEP clients.

I would recommend you to upgrade the SEPM and SEP Clients both to cover both the vulnerabilities.

Thanks for the info MichaelD50.  So the RU4 MP1b is an cumulative update that includes MP1 and MP1a?

Thanks again,

That's right, RU4 MP1b is an cumulative update that includes MP1 and MP1a.

When you will upgrade the SEPM to 12.1 RU4 MP1b it will show the SEPM version: 12.1.41014.4130 (RU4MP1a) but it will add MP1b client packages into it.

Here is the screenshot:

If your SEPM is running the current version (RU4 MP1a), then you can simply import the RU4Mp1b packages to be deployed to the clients. I currently have a major upgrade underway, upgrading clients from RU3 to RU4Mp1b (over 7000 clients). I current have around 4000 of the 7000 clients already upgraded. I have seen very few issues with the upgrade. You can choose your deployment method, reboot options, etc. A reboot is required to complete the upgrade. We have seen a few machines blow up after the upgrade, but this is usually due to a pre-existing issue with SEP on the machine, or a pre-exisiting issue with the OS.

If I am already running RU4 MP1a and upgrade to RU4 MP1b will I have to take additional action to update the clients or will they auto-upgrade?

The clients will not auto-upgrade without configuring the groups. For example, we have machines split up into different groups based on location. In order for the clients to auto-upgrade, you must add the install package to the group. Click on your group, then on the right side of the screen, you will see (4) categories, "Clients", "Policies", "Details", "Install Packages". Click on the "Install Packages". If it is empty, you are free to add the package. If there are installation packages already listed, you will need to right click them and remove. Assuming there is no install package assigned, right click the empty area and click "add". At this point the following screen will appear:

You will need to pick the Symantec Endpoint Protection version 12.1.4112.4156 for Win32bit, choose the installation settings, choose the upgrade schedule(number of days you will allow for the upgrade), and then click "OK". There are other options for the deployment such as notification, etc. Repeat for the Win64bit version. Now all clients in this group will automatically be upgraded to the version you have assigned for this group.

Hi eeleeh,

Is there any update?

OR

If issue has resolved please mark your thread as 'SOLVED' with the answer that best helps you.

Awesome thanks. Appreciate the help!