Endpoint Protection

Reboot after upgrade to complete it.

Thanks Brain..

I have a similar question

Do we need reboot before or after client server and systems SEP upgrade?

Yes.

Thanks Brain..

I have one more similar question

How about upgrading client servers and systems, do we need reboot before or after upgrade?

No reboot needed. Ensure you have a backup first in case it needs to be restored.

Hi Chetan,

After upgrading to SEPM v14, does server requires restart?

Please share the link if any document created for rollback to previous versions, if something goes wrong while upgrading

Hi Chetan,

We have upgraded our SEPM from 12.1.1401 to 14.1 RU1 MP1, post that over 100 clients are going out of network and we had to stop , start smc.exe service and sometimes we had to uninstall the SEP client. PLease let me know what could be the issues.

NOTE : We had just upgraded the SEPM Console only. we have not pushed the new 14.1 packages yet.

we have 12.1.6 MP7, MP8, MP9 Client versions

Thanks,

Chetan

Hi Chetan,

 i have design and installed Symantec 14 in my environment while still got v12.1 running by the side.

What should be my next step please can you help .

Should it be 

Upgrade clients using AutoUpgrade?

Then use the Sylink.xml file to establish the communication between new SEPM and the existing SEP clients with the help of Sylink replacer tool ?

Thanks 

Hi 

Can you please tell me how did it go with your upgrade sepm14 ? 

I looking to deploy the same way in my environment 

Thanks 

Hi Chetan,

I try to upgrade SEP 14.01 from 12.1.6 MP9 on windows 2012 server, but I have this error "upgrade from the installed version of symantec endpoint protection maneger not supported impossible to continue with the installation", file license it's ok....what's problem???

Thk

best regards

Hi Chetan,

Plan upgrade from SEPM12 to SEPM14.

5000 users, 60% for country1, 40% for country2.

Current setup as below:-  

2 x HA SEPM12 - replication enabled
Each SEPM12 manages dedicated sets of workstation (Country1 and Country2(including servers)).
1 x SEPM 12 - purely managing Servers for country1.
GUPs are installed in branches.

All 3 SEPM12 are located in country1.

The plan is to consolidate 3 SEPM12 into 1 x SEPM14 each in country1 & country2.

SEPM14 will be installed in new servers with MS SQL2016. New hostname, new IP addresses.

1. Since there is replication, can we import config from one of the SEPM12 HA machines and load into newly-installed SEPM14 for each country. Then SEP12 is able to communicate with the new SEPM14?

2. Here comes the tricky part, any tweak needed to ensure the SEP12 (standalone) for servers to be able to communicate with new SEPM14?

3. What's the correct approach to upgrade GUP and SEP12 to SEP14?

Looking forward to your reply. Thanks.

Regards,
Lim

hello chetan sir,

Traffic has been blocked from this application:host process for window service(svchost.exe).

please suggest me graphical solution for  pop up message on client end and why it comes .

Hi Matt,

Upgrade from v 12.1.4023 to 14.0.3752 is supported upgrade path. SEPM 14.0 can manage SEP 12 clients though it's not a best practice to follow. 

Yes

http://www.symantec.com/docs/HOWTO125386

http://www.symantec.com/docs/HOWTO81070

Greetings,  Can a server running SEP Manager v 12.1.4023 be upgraded to SEPM V 14.0.3752 and still manage the clients with version 12.1.4103?  Updates will still occur as usual, etc?

Great Article.

Thank you for your time.

Matt

Issue is that client already in AV  and only read policy update on  client , but clients all communication port blocked with network, what the reason behind this... we don't know . please give solution about that type problem.

yesterday, happen this type of issue on a client, in which all port blocked. i think its happeing through AV, because after AV uninstall, Client comes into network.

If USB ports are blocked through the policy, only admin can unblock it through the policy.

Refer these guides: 

https://support.symantec.com/en_US/article.TECH175220.html

https://support.symantec.com/en_US/article.TECH173724.html

hello chetan sir,

thanku for your reply,

what i do when any clients communication ports(usb ports) blocked through sep?

plz suggest me any solution....

Hi Saurabh,

Clients will not upgrade automatically unless you select auto upgrade feature. 

Refer this guide, it's same for SEP 14.0 as well: https://www.symantec.com/connect/articles/upgrade-clients-sep-121-auto-upgrade-feature 

hello chetan sir,

thanks for this post,

I want to know that when we have upgrade from SEPM from 12.1.6 to 14.1, can automatically all clients copied into new 14.1 console?

No, there isn't any major differences. 

Any major differences for a dedicated SQL server and 2 SEPM servers? 

What was the SEPM upgrade path? You performed SEPM upgrade locally or through remote connection?

Run upgrade.bat file present under C:\Program files (x86)\Symnatec\Symantec Endpoint Protection Manager\bin

Nice writeup, Followed it, and everything went smoothly. However, upon launch of the management server application, I am met with the "old" screen from 12.1, and attempting to login I am met with an error telling me to download the correct version of the remote console from the management server.

This occurs from both the local application links, and the session that is opened after the installation process has completed.

We have just this single management server, not sure what and where could have gone wrong.

issue resolve 

Thanks brian

https://www.symantec.com/connect/forums/sepm-121-and-sepm-14-together-same-location

Total how many SEP clients are in the network?

Hi Chetan

Thanks for your reply , mate i have 250 clients.

But the issue i have is only 30 odd clients were added to version 12.

Now when i have to do an upgrade it looks like i can come across issues in regards to 12.1 clients communicating to version 14 server.

I just dont understand how will it be possible.

i have come across things like manually replacing the syslink file, or via syslink replacer which is pretty much manual as well.

i did try to to make it via group policy through scripting but had no luck.

Please can you guide me through.

Thanks

I want to upgrade SEPM servers and than SEP clients as well but i want to keep SEPM 12.1 because all clients will migrate in more than 2 months so if client has 12.1 version it will communication 12.1 SEPM and get definition and if a client has 14 than it will get definication from SEPM 14 once i upgrade all clients to version 14 than i will remove 12.1 SEPM

and regarding windows XP and 2003 i will upgrade but later and i know SEPM 14 does't support XP and 2003 and these machines will get update from SEPM 12.1

i need your best advise.

Hi Muhammad,

Could you provide following information, with that info it will become easy to guide you in the correct direction. 

1. You want to upgrade SEPM or SEP client only? or both?
2. Do you have any plan to upgrade Window xp and Server 2003 machines?

Hi Nas Sheikh,

Q. it´s possible to install a new server and do a clean install of SEPM 14 and during a time coexist SEPM12 and 14 for the same Site/Domain?

--> Yes, If new SEPM has new IP and hostname it should not cause any issue. 

Q. My Plan is SEP 12 server to be keep running and once SEP14 is fully up and running decommission SEPM 12 servers.

--> That sounds good plan, there are couple of ways to migrate clients from old SEPM to new SEPM.

Total how many SEP clients are there in the network? also are there any remote clients?

Dear Chetan Savade and ℬrίαη

i want to upgrade version 14 but i want to keep version 12.1 servers to get update for windows xp and 2003 server. i have more than 50 remote sites and each site i have one GUP and the link speed is only 1 Mbps if i upgrae from 12.1 to version 14,  than version 14 SEPM doesn't support  12.1 definition and clients with 12.1 will not update the latest definition and on remote site i can not upgrade my all clients on a single day because i dont have any SCCM or desktop manager so i have to use autoupgrade through SEPM server

can you suggest me who to do that ?

Hi Chetan, it´s possible to install a new server and do a clean install of SEPM 14 and during a time coexist SEPM12 and 14 for the same Site/Domain?

My Plan is SEP 12 server to be keep running and once SEP14 is fully up and running decommission SEPM 12 servers.

Also what will be the process to update the clients via v14.

Thanks a lot

You are welcome. 

Hi Cheatn,

Thanks for the reply. I have successfully upgraded SEPM 12.1.6 MP8 to SEPM 14 MP2.

Really appreciate your help.

Thank you!

Hi,

Thanks for the feedback.

Q. We got renewed licensed with SEPM 14 and We are running SEPM 12.1.6 MP8 with Embaded database. Can we upgrade directly from 12.1.6 MP8 to 14 MP2 (available for download at fileconnect) ?.

--> Yes, upgrade from 12.1.6 MP8 to SEP 14 MP2 is supported upgrade path. 

During SEPM upgrade do not change the communication default port, 8014. After SEPM upgrade follow this guide to change communication port:

Article: Change management server ports Endpoint Protection Manager

URL: https://support.symantec.com/en_US/article.TECH163215.html

Hi Chetan,

Thanks for sharing the upgrade process, It really helpfull. I have two queries for SEPM 14

We got renewed licensed with SEPM 14 and We are running SEPM 12.1.6 MP8 with Embaded database. Can we upgrade directly from 12.1.6 MP8 to 14 MP2 (available for download at fileconnect) ?.

I have seen post Management server upgrade wizard client communication port is 443, currently we are using default port 8014 for client communication, what would be the impact if change to 443? We have 1500+ clients.

Thank you!

Glad to know, issue has been resolved. 

Thanks for answer,problem has resolved.
 

Hi,

Thanks for sharing details.

It looks there are known issues with SEPM 14 MP2 upgrade, refer these articles:

http://www.symantec.com/docs/TECH246724

http://www.symantec.com/docs/TECH246619

http://www.symantec.com/docs/TECH246619

http://www.symantec.com/docs/TECH170764

Try to repair the Symantec Endpoint Protection Manager ---  through control panel - program and features?

 use 20 clients

 OS Windows server 2012r2

 install  version Symantec_Endpoint_Protection_14.0.0_MP2_SEPM_RU

Yes, feel free to share with me as well.

Meanwhile also share following information:-

1. SEPM upgrade path
2. Operating System detaiis,
3. Total number of clients

Hello.Thanks for the answer.

"Try to repair the Symantec Endpoint Protection Manager (SEPM). - "But SEPM  12 working.I have problem with program,when i update sepm.

SEPM version 12.1.6.

Waiing for live update finish -  after this place,going rollback.May i will use Symdiag for the view logs?

Try to repair the Symantec Endpoint Protection Manager (SEPM). 

Could you share the SEPM 12.1 version details? What was the upgrde path?

Hello.i try install sepm 14 over sepm 12.But  after some time  is a  rollback program.

by the way service SEPm disbled.

What can do ?

Hi,

I would suggest to go throught the following article:

How to move SEPM from one server to another server.

https://www.symantec.com/connect/articles/how-move-sepm-one-server-another-server?list_context_id=3377631&list_context_type=symantec_product 

If IP address and hostname remains same then Disaster recovery (DR) can be the best option to go with. 

Hi Chetan,

I am planning the same as Pamela and Augusto. 

Basically, I have a SEPM12 running on windows 2008 r2

My plan is to create a new vm on windows 2012 r2 and then fresh install SEPM14 in it. after that then decomm the old sepm12 server.

I have about 70-80 clients (including servers) 

and also, very sorry but I m very new to SEP so any steps by steps guidance would be appreciate. thanks 

Hi,

I have the same setup as of now.. win 2008 r2 with SEPM 12. 

I am thinking of doing a fresh installation of sepm14. 

What are the best practises to do that?

I m thinking of using different ip and hostname. However i am thinking of how to do the update on the end point. 

currently my company has about 70-80 sep client

Hi Pamela Alaei,

I can definitely assist you here.

Could you provide following information.

1) Total number of Clients.

2) Are there remote sites connected over the WAN?

3) Using SQL database?

Hi Chetan,

Would you please help me finding the best way to perform the following task, I found it a bit tricky and I dont want to make mistake.

1: I want to migrate SEPM 12.1 to a new server with new IP and Host name BUT to SEPM 14. Meaning that migrate and upgarde both at a same time.

I am a bit nervous to do that and would appreciate if you help me.

Regards,

Pamela Alaei

Thanks Brian, Appreciate your help.

No, you're fine.

If it was a fresh 14 install then you would need to make the change to XP clients. Or if you had already enabled HTTPS and were upgrading to 14 then you would need to make the change as well to XP clients.

Thanks Brian,

But the thing is My management server is using HTTP for communication.What i know so far Upgrades to version 14 from 12.1.6 retain the same protocol that is in use. So, In that case do i really need to manually enable TLS to communiacte with SEPM 14 ?

No. XP clients will not connect to a SEPM 14 unless additional changes are made to it. If you still have XP clients, you need to manually enabled TLS on them if you want them to talk to a 14 SEPM:

http://www.symantec.com/docs/TECH231025

Even though if the client is running XP ? Just wanted to make sure...

Excellent-what I needed to know.

Thanks,

Mike

Yes. SEPM 14 can manage 12.1.6 clients.

Thanks for the comprhensive guide on upgrading to version 14.

Question.  Our end user nodes are running v12.1.6...will they continue to function properly once the SEPM is upgraded to v14?  We will eventually update them but not right away.

Thanks,

Mike

Hi,

Thank you so much Chetan. I'll try it out and let you know.

I really appreciate your help...

Hello,

Use standalone deployment wizard to upgrade remote clients. 

This article can be useful: Push Deployment Wizard - Standalone deployment app for SEP install packages

http://www.symantec.com/docs/TECH195705

Hi Chetan,

Yes i have couple remote sites to upgrade clients.And also i don't wanna create any group only for winxp because i already have bunch of groups ( mixed win7 & xp ) and these groups has different poilicies.is there any way that i can upgrade xp clients without creating another group ?

Thanks...

HI Mohmudul,

Thanks for the feedback.

After successfull SEPM upgrade there are couple of ways to upgrade SEP clients. 

1) Auto- upgrade - It could be easiest way if all the clients are residing on the same LAN. 

Test the AutoUpgrade process before you attempt to upgrade a large number of clients in your production network. If you do not have a test network, you can create a test group within your production network. For this test, you add a few non-critical clients to the test group and then upgrade them by using AutoUpgrade.

Can refer this guide: http://www.symantec.com/docs/TECH96789

If there are remote sites, need different approach for those clients. 

Hi chetan,

This post is very helpful.Can you guide me the best way to upgrade clients after i upgrade the SEPM. I have around 307 clients and bunch of client pc's are running xp.

Hi,

Q. It´s possible to install a new server and do a clean install of SEPM 14 and during a time coexist SEPM12 and 14 for the same Site/Domain?

--> If hostanme and IP address is different SEPM 12.1 & SEPM 14 can co-exist in the same site/domain.

What's your migration plan to move SEPM 12.1 clients over SEPM 14.0?

Total how many Symantec Endpoint Protection (SEP) clients are connected to SEPM 12.1?

Hi Chetan, it´s possible to install a new server and do a clean install of SEPM 14 and during a time coexist SEPM12 and 14 for the same Site/Domain?

The situation is, my SEP 12 servers are running W2008R2 and I want to install SEP14 on W2012R2, and after that remove and shutdown SEPM 12 servers.

Thanks,