Endpoint Protection

I didn't realize SEP 11 was reaching EOL on Jan 5th. I have a SEP 12 server up however I don't know if I can start migrating in the next two weeks. Initially I planned on pointing all my SEP 11 clients to the SEP 12 server and once they show up in SEPM 12, I will configure them to update them at their next reboot. If I understand correctly however, there is an engine update somewhere in the pipeline which will cause SEP 11 clients in SEP 12 to break/stop working entirely/blue screen the PC? If that is the case then I cannot just push remote communication package update to SEP 11 client installs and have them show up in SEP 12 because if the engine update gets pushed, my SEP 11 clients which haven't yet updated will break.

Is there a way around thisso called engine update? Is there someway I can block the engine update from my SEP 11 clients that will be managed in SEP 12 until they are updated to SEP 12?

I can do a remote push to update communication package and have them appear in SEP 12 this week. Then over the next few weeks I will froce desktops to reboot and get SEP 12.

Yes they went eol on Jan 5th. You can just replace the sylink manually. I dont believe you can do it from the 12.1 SEPM to 11.x. You can use the sylink replacer (remote tool) to get out a sylink file to them. There is nothing that causes a blue screen that I've seen. Not sure where you heard this or why symantec would do that. SEP 11.x clients can still receive untested defs from 12.1. So yes because they're untested you could potentially have issues but nothing intentional. But 12.1 has always managed 11.x clients without issue. You could get the 11.x clients connected to the 12.1 SEPM and move them to their own group and just edit the LU policy so it doesn't get updates from the SEPM.

What you take pushing out is a communication file called sylink... It will not update any engine it will make 11.x clients to show up in 13.x console

Thanks Brian! The engine update portion didn't make sense to me either. I read about it in a post on a Sysadmin forum which said moving SEP 11 clients to SEPM 12 could cause problems. I'm going to call Symantec support tomorrow and talk to them about it.

My plan is to use the communication update package deployment tool which does run the sylink drop tool and works to make SEP 11 clients talk to SEPM 12. Once they are all there and Symantec confirms SEP 12 updates will not cause an issues with SEP 11 clients, I will configure the install packages to do their job at next restart.

I like the idea of blocking LU. I will look into that if Symantec support tells me that there is something like an engine update coming that will break SEP 11 client installs.

I know that 12.1 has always been able to manage 11.x clients, never been a problem in the past. Perhaps it was something else that caused it.

Hi Rafeeq! I get that part. I understand the communication package update tool will basically tell the SEP 11 client installs to talk to SEPM 12 and let me manage them there. That's how I was planning on upgrading my clients from SEP 11 to SEP 12. I was planning on putting them in groups with install packages which would install them at restart. When I found out that SEPM 11 wouldn't push updates past Jan 5th I started to look into updating all clients ASAP.

However in my research on Friday I came across a post (signed by someone claiming to be a Symantec employee) which said that Symantec plans on pushing an engine update in the coming week (or 2 weeks) which could cause an SEP 11 clients being managed by a SEP 12 server to break and or cause the PC to bluescreen. This would pose a significant challenge becuase then I couldn't bring SEP 11 clients into SEP 12 and then trigger the client upgrade.

Well the post said that in the coming week or two, Symantec planned on pushing an engine update over LU. This engine update would cause any SEP 11 clients managed by the SEP 12 server to break or stop working. Hear anything like that?

Didn't hear that. Do you have a link to this post? Was it here on Connect or another forum? Just wouldn't make sense to me as to why they would do that.

Cannot find the link but I am calling Symantec support to get confirmation one way or another.

Again, I'd be shocked if this was for real.

Could you please provide the link to that post? I am running SEPM v12.1.5 and have a few v11 clients connected to it, so I'd like to have a read of that post to understand the impact, etc.

Thanks,

I can't find the page anymore but I called Symantec yesterday and they said nothing should break 11.0.5 clients managed by SEP 12.

That was my thought. Probably something unrelated, some versions of 11.x were quite buggy...

Another possible easy way is to upgrade the current SEPM 11 to 12 and then setup up replication link from the old SEPM to the new and then simply update the management list to repoint them at the new SEPM 12 manager. 

Once all machines have moved over you can then decommision the old SEPM.