Endpoint Protection

First post!!

I have installed SEPM on a server in one location. I want to roll out the clients to a few different geogaprahic locations. Because of this and the size of the client installation files (usually about 80 MB) I have a bit of a question/problem.

I only want to install the AV only for now. I dont want to install the network threat protection component until after a few weeks once I have covered all the sites and made sure everything is ok.
Now the way I am going to do this will be to export a few install packages, copy them over to the relevant file servers in each location and get users to run an unattended install from there in their own time.

Easy!

However my problem! When I have SEP installed on the clients I will want to install the Network threat protection part on a lot of the laptops. Now I know I can push this out but it will kill the bandwidth. The easiest way I think will be to change the type of install package for the group I want to update e.g. latops and run a update content command on the group. This will then install the firewall part on each client. But how does this work??
 
Does it copy a new setup file from the server to the client and then run this new install or as SEP in already installed on the client will the update content command just reinstall SEP on the client this time with network threat protection from an older setup file that was already on the client leaving the bandwidth alone.

Hope this makes sense!!

Thanks,
Ultan

Hi, you need to create a separate package for the laptops (eg, AV AS NTP).

Yea I know that you will need to create a seperate package. I can link this package to a group and then move my clients to this group, run the update content command and then this will install the AV AS NTP for me. I have tested this and it works. But my question is this.

Is this package copied over to the client over the network and then run or does a command go to the client and a type of reinstall command is issued where the NTP part is installed?

I see your point but I it's not copied and it is run. (not sure). On our environment what we did was to create a script to copy the package on the computer then run the setup locally, it has been successful so far.

Hi

One thing you could do is install all components but withdraw the policies for FW and IPS. This way you just have to assign a policy to those components to activate them when you're ready.

On the client side NTP will be visible and have status ON but since there's no policy, no filtering will be done.

BR,
Tuomas

Good idea tuomas,  Will need to test that one out.
It wont do a deny all or anything like that? Will it go to an default local policy or anything?

Do you know that answer to my question by the way?

Update content will not reinstall the client. It will get new definitions from the manager if available.

Regarding the withdraw policy approach...

Create a group for your laptops, withdraw the NTP policies, export a managed client package with all components and  policies associated with that group.

Now your client will get a complete install but no NTP policies. It will not go to a local policy or deny all if you follow these guidelines.

BR,
Tuomas

Hmmm ok. Seems strange that the update content command does that as when I change the client package around to include NTP I can see on the client side it doing an unattended install. When finished NTP is part of SEP.... so where does this come from?
I am just curious on how it works.

If you assign a new install package to a group it will get downloaded to the clients regardless of the update content command.

BR,
Tuomas

Dear Ultan

As per my annalysis of ur query i guess you want to deploy the product in ur network but at the same time u need not wnt ur network to be choacked.
 

Can u please state ur network architecture so that we can workk upon it.

For ur knowledge Update content is only for the definition  update and not for the re-installation



Ajit Jha
 

Hi ultan, just do what I suggest, copy the package first then run locally via script.

My understanding is the "Update Content" command will update policies and definitions.  It doesn't have anything to do with installation packages (I could be wrong and hopefully a Symantec employee will confirm/deny).

That's what it does.
I have packages assigned to some of the groups, but running update content pushes new policies, and if needed, defs.
But it won't install a package.
It's so that if you make a change, you can force it, or if there's a virus on a computer you can find it in the console, do an update content and scan. So it will get the latest defs and policies, then scan accordingly.
"content" can be defined as definitions and policies.

Cheers for your help!