Endpoint Protection

We have about 300 clients we need to manage with SEP 11.  We will have servers deployed in various regions around the globe, and want to minimize WAN traffic when deploying Symantec and getting new policies.  Whats the best way to keep client upgrades local instead of pushing over the wan?  Right now we just build custom install packages and manually deploy the client.  But if we wanted to use the deployment features of the Management Console, what would the best way be to set this up so that we aren't saturating our WAN links. 

The only thing I can think about is putting your client in small group and doing a group at a time.

hello Joe Church
we have 550 client like you. we have big wide area and we dont want big Wan traffic. i installed another clients to sep like this.
I create a Install package. than i send it another locations ( after work time) and i send there Push Deployment tool too. (with copy and paste)
i choice one computer for each location. for example:  I am in A city now and use pc1. and i send install package and Push deployment tool to B city computer name is pc350.
i install every clien from pc350 in B city. this why there is no WAN traffic but i want to tell you something.
İf your wan havent got a bi connection like 1024 or 2048 Hdsl etc. you will feel  slowing in network. because Live update.  thats why you should install GUP server or LUA (my prefer) for another locations.
I am sorry my bad English :(
Have a nice day 

There is no option from inside the management console however you can use this.
 
Copy the Client remote.exe that is located in CD2 of the download and the Install package to the server (or any one of the client ) of each sites and deploy from there.

To deploy clients using the ClientRemote.exe tool:

Note: To use the ClientRemote.exe tool, you must first export an installation package.

Open the ...\CD2\TOOLS\PUSHDEPLOYMENTWIZARD folder and double-click the ClientRemote.exe file. The Push Deployment Wizard launches.
Click Next at the Welcome... screen, and then click the Browse button.
Browse to and select the Installation package that you exported, and then click OK. Click Next to advance the wizard.
In the Select one or more computers... screen, either drill down into the Microsoft Windows Network to add your workstations to the Computers
to deploy to pane, or click the Add or Import Computer button and select the computers based upon IP Address or Host name. You may also
use a text file list populated with either Host names or IP Addresses.
Once your workstations are added to the Computers to deploy to pane, click Finish. A progress indicator appears as the Symantec Endpoint
Protection software is deployed.

We aren't quite done with our deployment yet, but so far we've just stuck with manually deploying one at a time by manually installing the client package.  We have our groups setup by geographic region and there are too many clients in each group to just apply the policy to be deployed to all clients in a group.  Its been our experience that Symantec will deploy (multithreaded) installs to all clients at the same time and it eats up our WAN links like crazy...we can't do that!  

I thin using the  ClientRemote.exe tool (in CD2) is the best option for you.