Symantec Management Platform (Notification Server)

All,

I need to deploy Cisco VPN version 5.0.07 to several machines.  These machines will either have Cisco VPN version 3.x,, 4.x, or an earlier 5.x.  I am setting up software associations where 5.0.07 supersedes these earlier versions.  The earlier versions must be uninstalled prior to installing version 5.0.07.  I would like to configure one policy to handle this upgrade, which would mean that when applied to a machine, this policy would remove any older existing VPN client, if present, and install the current version 5.0.07 or just install version 5.0.07 if no other VPN client is found.  What is the best way to accomplish this with one policy?

Regards,
Cubbie
-----------------------------------
"I'll hang up and listen"

This depends on how you can target.  If you could define who needs VPN (e.g. Filter 'VPN Computers'), then you could define a filter as well for computers without VPN installed (i.e. Filter 'Computers without Cisco VPN Installed').  Your target for the 5.0.07 install would be exclude all computers not in 'VPN Computers', exclude all computers not in 'Computers without Cisco VPN Installed.'  This leaves you with computers that should have VPN but do not have it, and installs 5.0.07.

You would create separate uninstall policies for all computers with earlier versions installed.  They will pick up the policy, uninstall VPN, report back a new software inventory, and then be included in your Computers without Cisco VPN Installed filter, thus receiving Cisco VPN.

A more instantaneous approach would be to use a wrapper script.  The wrapper would uninstall the previous versions based on, say, msi product code using msiexec.exe /x.

You could also add the uninstall script as a task that runs prior to the 5.0.07 install or as a pre-requisite "resource."

Because the uninstall of any older version that precedes and the install of 5.0.07 needs to happen in a timeframe shorter than could be accomplished with a separate uninstall policy, inventory, and install policy, I've decided to go with the wrapper script as you've suggested.  The script tests for the guid's for the different older versions and uninstalls them, if present.  That works great.  BUT . . . a new problem presents itself.  I'll probably start a new thread, but I'll post it here in case anyone following this thread has seen it.

I've put this wrapper script in the same policy as the 5.0.07 install.  The script to uninstall older version runs fine followed by a reboot task.  Following the reboot, the 5.0.07 install should kick off, but never does.  I've given it as much as 2 hours.  Even though I don't think it's a potential cause, I've verified that the 'Disable communication at startup and after blockouts for up to' setting is unchecked.  Oddly enough, if I put the exact same task sequence in a job, including of course the reboot, and it ran flawlessly: uninstalled the old Cisco VPN client, rebooted, installed the VPN client 5.0.07.  Unfortunately, I need this to run in a policy, not a job.

Any thoughts?

Regards,
Cubbie
-----------------------------------
"I'll hang up and listen"

You have a single script that reboots partway through?  If you reboot, that's the end of the script.  You'll need a second script to be in line to run after the restart happens.

No sir.  After the script, the next task in the sequence is to restart the computer.  Next after the restart is the VPN Client 5.0.07 install.  The install task never starts following the restart.

Is this a timing issue?  

The restart command is sent but of course this does not get actioned immediately as there are various shutdown delays in the operating system during which time processes remain active. So what could be happening is that the VPN Client Install task is started just before the machine reboots.  Simple way to check this would be to add in a task between reboot and VPN Client Install which does nothing more than perform a 5 minute "wait". That should exceed any shutdown interval and perhaps your next task would then resume after the machine reboots.