Hello,
As a best practice, it is recommended to restart the client machine, when a full feature set (AV/AS, PTP and NTP) is installed.
When migrating the SEP client, the drivers are migrated as well and that is the reason it is a restart is required.
In case a restart is not done, the firewall drivers and feature would not work correctly.
SEP 12.1 employs a side-by-side, replace on reboot installation strategy. Side-by-side means that new files are written to a new folder, referred to as a silo, isolated from the existing operational folder. Because the two versions are separated from each other, during a migration the older software is left running unchanged until the next reboot.
The primary benefit of side-by-side installation and replace on reboot is that the system continues to be protected by the existing software until the new version is in operation after the reboot.
This technique enables you to change the normal portion of the installation path during a migration, when applicable
If you are planning to upgrade or migrate to Symantec Endpoint Protection 12.1.4, please take a look at the latest how-to article created by our very own SEP content council team.
Best practices for upgrading to Symantec Endpoint Protection 12.1.x
http://www.symantec.com/business/support/index?page=content&id=TECH163700
Hope that helps!!