Endpoint Protection

Hi All,

We have about 700 clients connecting to one SEPM server and they are in the same LAN.  For virus definition (as well as other content) updates, we use the option "Use the default management server (recommended)"and do not use LiveUpdate for the clients.  However, we have found that the update schedule of the clients varied greatly. 

For instance, the SEPM server retrieved the update-to-date virus defintion at 08:00am, when the clients were started at 09:00am, only some of them retrieved virus definition updates from the management server immediately.  For other clients, some of them retrieved the updates at 01:00pm and some of them at 05:00pm.  The update time is consistent, that means clients retrieving updates at 01:00pm will always retrieve them at around the same time, no matter the server is busy or not.  Also, we have checked that the server is not busy all the time.

So, may I ask what's the update interval and schedule when using the options "Use the default management server (recommended)"?  Also, are there any ways to speed up the virus definition update?

Thanks a lot!

Dennis

there is no schedule, it depeneds on when clients connect to the manager only then they take the updates
we dont have any schedule for it. 

What is the heartbeat interval you set.In each heart beat client will connect to server and check for any new updates.Reduce this value and try.This setting you can find in SEPM  Clients---->The group which the client resides----->policies---->communication settings.. 

Thank you for the replies.  The heartbeat interval was set to 1 hour.  I have changed it to 15 minutes but the delay still exists.  For instance, below is the log file of one of the clients:

12/03/2010 13:31:12 Information New virus definition file loaded. Version: 120311u. 

12/03/2010 9:06:13 Information Symantec Endpoint Protection services startup was successful. 

12/03/2010 9:06:11 Information Connected to Symantec Endpoint Protection Manager (xxx.xxx.xxx.xxx) 

The client started and connected to SEPM at 09:06.  However, virus definition update did not take place until 13:31.   The delay is consistent, that means this client gets the updates at about the same time everyday.

Thanks a lot.
 

Whether any network based control is present between the clients and server.For example one particular part of the network will be blocked from av sever for a particular period? 

I have checked that there is no blocking between the clients and servers.

Thanks a lot.

 Check when does your SEPM downloads the definition..Does it download once a days or every 4 hours.

SEPM- Admin- Servers- ;local site-properties- liveupdate

The liveupdate setting is "continuously".  As a solution to the problem, I have designated one computer in each subnet as the GUP and now the virus defintion update occurs much faster.

I have phoned the Symantec support hotline and is waiting for their reply.

Thank you very much for all of your assistance.

If you selected continuously it will download updates multiple times in a day.Because symantec will release the updates 2-3 times in a day.I think that is why you are seeing different timings.The decision to keep GUPs in each subnet is  good .It will give  a better performance of update distribution.For testing You can select "daily" and schedule a time and see whether you are getting the same time updates in all PCs..