Endpoint Protection

Hi,

I understand that once the clients are all in the same group in the SEPM console & the console has been upgraded to SEP11.6MP1 the new client version can then be asscociated with the group - but how does the SEPM mange the deployment of the new client?

Does it try and update all 5,000+ clients at once, do say 10 at a time until they are all upgraded?

Does it wait until the client isn't busy?

Does it work in a similar way to SCCM and randomise the upgrade?

Cheers,

Mike

When you assign a package to upgrade it only pushes a small upgrade file not the full package..

However by default it does start at once..but I believe it does randomization of upgradation..

If the clients are busy it won't upgrade then but..in the next heartbeat client will check for the upgrade..

However you can set time schedule for upgradation..

Vikram,

Thank you for that document, however, this leaves me with two questiosn;

• What is the size of the small upgrade file (roughly) - so we can ascertain the potential starin on our network?
• What criteria stipulates a client is busy.

The size of the file defers from Version to Version..I might be wrong however it would be somewhere 10-15mbs ..do test it once..as I am really not sure about Ru6Mp1.

Client is busy would mean client is not responding to SEPM's request

See recommendationshttp://www.symantec.com/business/support/index?page=content&id=TECH94405

Migration paths
Symantec Endpoint Protection 11.0.6 (RU6) can migrate seamlessly over the following:

• • Symantec Endpoint Protection 11.0.780.1109/11.0.776.942 (RTM), 11.0.1000.1375 (MR1), 11.0.1006 (MR1 MP1), 11.0.2000.1567 (MR2), 11.0.2010.25 (MR2 MP1), 11.0.2020.56 (MR2 MP2), 11.0.3001.2224 (MR3), 11.0.4000.2295 (MR4), 11.0.4010.19 (MR4 MP1), 11.0.4014.26 (MR4 MP1a), 11.0.4202.75 (MR4 MP2), and 11.0.5002.333 (RU5)
  • Symantec AntiVirus client and server 9.x and later
  • Symantec Client Security client and server 2.x and later

Migration paths
Symantec Endpoint Protection 11.0.6100 (RU6 MP1) can migrate seamlessly over the following:

• • Symantec Endpoint Protection 11.0.6000.550 (RU6), and 11.0.6005.562 (RU6a).

To migrate client software
• 1. Log on to the newly migrated Symantec Endpoint Protection Manager Console.
  2. Click Admin > Install Packages.
  3. In the lower-left pane, under Tasks, click Upgrade Groups with Package.
  4. In the Welcome to the Upgrade Groups Wizard panel, click Next.
  5. In the Select Client Install Package panel, all existing client packages are listed in the drop down box. Select one of the following:
     • Symantec Endpoint Protection <appropriate version><appropriate version=""></appropriate>.
     • Symantec Network Access Control <appropriate version=""></appropriate><appropriate version>.
  6. Click Next.
  7. In the Specify Groups panel, check one or more groups that contain the client computers to be migrated, then click Next.
  8. In the Package Upgrade Settings panel, check Download client from the management server.
  9. Click Upgrade Settings.
  10. In the Add Client Install Package dialog box, on the General tab, specify whether or not to keep existing client features or specify new ones, then configure a schedule for when to migrate the client computers. Under the Notification tab, specify a message to display to users during the migration.
  11. For details about settings on these tabs, click Help.
  12. Click OK.
  13. In the Upgrade Groups Wizard dialog box, click Next.
  14. In the Upgrade Groups Wizard Complete panel, click Finish.

Note: Client computers that take a long time to automatically upgrade to Release Update 6 Maintenance Patch 1 may need to be restarted. This occurs on client computers that run Windows Vista or Windows Server 2008.  We recommend migrating clients to RU6 or RU6a before completing the upgrade to MP1

10-15mb(ish) is okay IF it staggers the deployment, is there no white paper on this?

Allowing the SEPM to decide if 5000+ machines are busy or not by an unknown criteria doesn't fill me with a great deal of confidence. We are currently deploying RU6a by SCCM and was hoping not to have to use this for all future updates.

I understand it can be schdeduled out of hours - however, as it is generally company policy to shut down a desktop when it is not being used and laptops removed from site so not applicable - are there any further options?

When adding the client install package to the group, there  are some settings to look out for that will help with managing the way that SEPM pushs out the upgrade.

1. Upgrade Schedule

Here you can set a time frame of when you want the upgrade to occur.

SEPM>Clients>Group (name of group)>Install Packages>Highlight install package>Right click, choose "Edit".

2. Distribute upgrade over X days.

Choose the amount of days, you would like the upgrade to be distributed by.

Does it use BITS to manage this or is it a normal file copy?

No, SEPM does not use BITS to my knowledge.