Check this document
Configuring
Symantec Endpoint Protection
client for deployment as part of a drive
image
http://74.125.153.132/search?q=cache:YHBGIGM3rtkJ:service1.symantec.com/support/ent-security.nsf/docid/2007110510364248%3FOpen%26seg%3Dent+diploy+client+using+image+symantec+ednoint&cd=2&hl=en&ct=clnk&gl=in
Configuring Symantec Endpoint Protection client for deployment as part of a drive image
Question/Issue:
You need to create a drive image with Symantec Endpoint Protection Client already installed.
Solution:
Releases prior to MR3 required that the HardwareID be deleted by following the instructions below,
(NOTE: Not following these directions may have adverse effects on client communication and registration.)
You will need to ensure that the Symantec Endpoint Protection (SEP) client does not communicate with the Symantec Endpoint Protection Manager (SEPM) prior to and while creating the image.
If the SEP client has checked in and registered with the SEPM, you will need to delete the following registry value prior to creating the image:
HKLM\SOFTWARE\Symantec\Symantec Endpoint Protection\SMC\SYLINK\SyLink\HardwareID.
NOTE: The registry key HKLM\SOFTWARE\Symantec\Symantec Endpoint Protection\SMC\SYLINK\SyLink\SySoftk may also need to be deleted if present.
Once the image is applied to a new system, the client will generate a unique id value, check in with its SEPM and register. During the registration process the SEPM will register all necessary client information into the database.
This value will regenerate the next time the client loads.
MR3 to MR4MP2 will dynamically generate a new HardwareID value based on the MAC address of the new machine to which the image is deployed.
RU5 has a new design.
With this new design, the Hardware Key is now stored in %programfiles%\Common Files\Symantec Shared\HWID\sephwid.xml. This allows for easier remediation in the following situations:
1) A client is generating new Hardware Keys on startup which could potentially conflict with another SEP client or for preparing a machine
a. Move, rename, or remove the Hardware Key config XML file found in the Symantec common area.
b. Remove the “HardwareID” registry value located in HKLM\Software\Symantec\Symantec Endpoint Protection\SMC\Sylink\Sylink\
c. Restart the client.. New Hardware Key information will be generated in this case.
2) Every time I install the client on a clean VM or Ghost image using the same hardware, the Hardware Key is different.
a. Since the new algorithm generates random IDs, any install on a clean machine will result in a new ID being generated. However, if the client is uninstalled and reinstalled, the ID should not change, since it is persisted in an XML file located in the Symantec Common area. i.e %programfiles%\Common Files\Symantec Shared.
In order to maintain the same ID when an image is restored, the customer should install SEP first before taking the image. Alternatively, the customer may also drop a saved sephwid.xml file and force that Hardware Key to be used by setting HKLM\Software\Symantec\Symantec Endpoint Protection\SMC\Sylink\Sylink\ForceHardwareKey in the registry to 1 (true).