New in the Rewards Catalog: Vouchers for "Symantec Technical Specialist" and "Symantec Certified Specialist" exams.

View
Track

zer0

Profile

zer0
Member for: 3 years 14 weeks
Contact: Send this user an email

Member for: 3 years 14 weeks

Blog: View recent blog entries

Contribution Stats

18

Solutions

16

Forum Threads

490

Comments

0

Blog Entries

5

Ideas

0

Articles

0

Videos

0

Downloads

0

Events

1

Group Joined

zer0's Activity

Show:

discussion comment 08 Dec 2010

zer0 commented on: SEPM & ISA server 2004

Maybe if you only want to allow SEP to SEPM traffic. You seem to of forgotten all of the other SEP ports 443 - for optional secured https 1433 - for sql datase comms 1812 - for snac enforcer 9090 and 8443 - for remote admin console

discussion comment 08 Dec 2010

zer0 commented on: SSIM - virtual appliance

Thanks for that...I just wanted something official to make sure it had reached RTM stage and was fully supported in production environments.

New forum discussion 07 Dec 2010

zer0 posted: Correlation rule question - multiple logins

I need a solution Someone else asked about this here - https://www-secure.symantec.com/connect/forums/cor... I was just wondering if anyone had managed to write a query that could report multiple logins? thanks in adv

New forum discussion 07 Dec 2010

zer0 posted: SSIM - virtual appliance

I need a solution Just wondering if the virtual appliance version of SSIM has been officially released?? 1

discussion comment 07 Dec 2010

zer0 commented on: SEPM Upgrade from RU6MP1 to RU6MP2 Finished. Initial impression

I never use the location awareness feature that has the requirement that the SEPM's are available for exactly the reason you have described. I usually use a dns lookup that only resolves when on the internal network as it is much more ...

discussion comment 07 Dec 2010

zer0 commented on: How to create right-click SEP context menu items??

The last time I heard anything the next major realease has parity for 32 and 64 bit features. Not to say the dev teams priorities might change between now and the release date though

discussion comment 07 Dec 2010

zer0 commented on: SEP - GUP Behavior

The policies are unique to that location and have to be stored etc. There is a reason Symantec only recommend 7 locations. Trust me :) I do have a client at the moment where they have 35+ locations but they only have 5-6000 SEP clients and it ...

discussion comment 07 Dec 2010

zer0 commented on: Configuring SEP v11

Also check out this pre-written policy for protecting SEP - http://www.symantec.com/business/support/index?page=content&id=TECH132337&locale=en_US And make sure you have password protection enabled for stopping or removing SEP

discussion comment 07 Dec 2010

zer0 commented on: Debug on 10.1.6.6000 server

Why do you need to do a debug? Maybe we can help without needing any sort of debug logs. The default log level is pretty high once you start digging through all the seperate logs. This might help - ...

discussion comment 07 Dec 2010

zer0 commented on: Database connection to SQL 2008 R2

Run "netstat -an" on the SQL server and see if it is truly listening on the SQL port (1433 by default) Try telnetting from the SEPM to the SQL server on the SQL port Make sure you are not using dynamic ports

discussion comment 01 Dec 2010

zer0 commented on: This location will be checked every 'x' seconds setting

I try to stick to 3 different locations: In the Office VPN connected Out of the Office If my remote sites are single subnet sites then I use the multiple GUP list feature and don't really need many groups. If my remote sites have ...

discussion comment 30 Nov 2010

zer0 commented on: We need block SEP process

Just create the appropriate policies in the "Unregistered" group that basically make sure the SEP client does not get content updates or do any scans etc. It is very easy to lock SEP down completely from the end user and is something ...

discussion comment 30 Nov 2010

zer0 commented on: SEP - GUP Behavior

It is not recommended to use more than 7 locations for the following reasons: SEPM has to keep track of up to 7 policies for each locations as they are unique. This quickly gets into really high numbers if you are AD syncing your groups, even ...

discussion comment 30 Nov 2010

zer0 commented on: SEP - GUP Behavior

A SEP client can get updates from a GUP regardless of whether it is located in its own group or not. In older versions of SEP it did matter but that was back in MR1/2/3 etc. If you have a site with multiple routed subnets the easiest way to ...

discussion comment 11 Nov 2010

zer0 commented on: SEP on heavily used Fileservers

LOCK ALL SETTINGS!!! Administrator defined scan It is recommended that a monthly scan should be configured to occur in a maintenance window when the server is not under a heavy load File type scanning can be limited to high risk extensions ...

discussion comment 11 Nov 2010

zer0 commented on: Uninstall SEP through SEPM

The most responsible way is to let them know how to reconfigure their SEP clients so that they are either managed internally, or are unmanaged but still getting updates from the internet. you really shouldn't cut them off without ensuring ...

discussion comment 11 Nov 2010

zer0 commented on: real quick GUP and Client question

Try out the GUP monitor, which will give you visibility of all GUP's, their content revisions and any SEP clients that are out of date. https://www-secure.symantec.com/connect/downloads/sep-content-distribution-monitor

discussion comment 11 Nov 2010

zer0 commented on: Export Group Hierarchy from SEPM console

You can just copy the prod database and restore to your testing SQL and SEPM. That way, not only will you get the groups and all associated policies, but you get every single setting. You then just need to change a few of the settings to suit ...

discussion comment 09 Nov 2010

zer0 commented on: SEP Report or Monitoring question

Symantec provides a basic (decent) level of reporting in the product. If you ever used SAV or another vendor you would agree!! They also make another product called Symantec Security Information Manager that is a very good event ...

discussion comment 09 Nov 2010

zer0 commented on: AV scanning CIFS shares

You could potentially do what you are saying with SEP but I would stick with Scan Engine if I was you. It is the best solution for NAS and on demand type scanning. How did you have the sav for nas scan engine setup? Did you try tuning the ...