Endpoint Protection

I see the post here yet it doesnt answer the question...

I also want to run the Live Update silently on first install.

The solutions in the thread don't address the initial install - when I remotely install using the SEP 12.1 exported, managed client .pkg via Apple Remote Desktop it installs silently fine.  I don't use the /usr/sbin/installer -pkg pathToPackage -target MountPoint in Terminal.

The client Mac .pkg installs fine with no intrusion on users, yet when the user logs in for the first time AFTER the initial install, Live Update runs and takes up their screen.  For our end users this is a problem as they won't understand even with training.

So can I make the first run of Live Update when a user logs in for the first time after SEP 12.1 install slient?  If so how?

Here is the schedule after the initial install:

Module         Name                     On  UI  Freq     Day   Time   Args
-------------- ------------------------ --- --- -------- ----- ------ ----
VirusScan      ecbee20c-c0a8-6f1c-015a- 1   0   Daily          20:00  -niceness 20 '///##SYMFOLDER##' '4'
LiveUpdate     MacLUPolicy@33E739C7C0A8 1   0   Hourly         04:00  "All Products" -quiet

Any help is greatly appreciated.

Hello,

I believe, you are talking about the Thread: https://www-secure.symantec.com/connect/forums/sep-mac-live-update-bouncing-dock

Usually, The LiveUpdate running post-install is by design so that the time which the clients go with out of date definitions is at a minimum. Unfortunately, the default is not silent--likely also by design so that the user knows that it is running.

If the Mac clients are managed, then their LiveUpdate schedules should be silent by default. If they are unmanaged--they should have a default, built-in schedule for all users that is also silent (there was an issue on some SEP11 builds with the default schedule not being set to silent, but that has been resolved.) You could check on an end-user's mac (sudo symsched -l (lowercase L) in a Terminal window) to see how it's scheduled. The above link provided above has more details on the commands.

I'm not talking about that thread.

I install SEP 12 Mac remotely using the SEP Manager exported Installer .pkg.

I posted the live update schedules in my initial post.  They say silent don't they?

Module         Name                     On  UI  Freq     Day   Time   Args
-------------- ------------------------ --- --- -------- ----- ------ ----
VirusScan      ecbee20c-c0a8-6f1c-015a- 1   0   Daily          20:00  -niceness 20 '///##SYMFOLDER##' '4'
LiveUpdate     MacLUPolicy@33E739C7C0A8 1   0   Hourly         04:00  "All Products" -quiet

Once installed when a user logs in after the initial install (so far), Live Update starts downloading.  Is there any way to make the initial install run live update silently on user login?

After the initial install and non-silent Live Update everything seems to run silent...

Thanks.

Hi Layne,

I don't think that can be silent from the very start, unfortunately.  Check out this thread (which you have already referenced) :

https://www-secure.symantec.com/connect/forums/silent-definition-update-sep-121-mac-osx

The LiveUpdate running post-install is by design so that the time which the clients go with out of date definitions is at a minimum. Unfortunately the default is not silent--likely also by design so that the user knows that it is running.

If the Mac clients are managed, then their LiveUpdate schedules should be silent by default. If they are unmanaged--they should have a default, built-in schedule for all users that is also silent (there was an issue on some SEP11 builds with the default schedule not being set to silent, but that has been resolved.) You could check on an end-user's mac (sudo symsched -l (lowercase L) in a Terminal window) to see how it's scheduled. The link pete_4u has provided above has more details on the commands.

This thread has info about what is possible:  https://www-secure.symantec.com/connect/forums/sep-mac-consistent-obtrusive

A little background info on Mac's LiveUpdate--

Scheduled LiveUpdate is written to crontab.  The ones set via the GUI Symantec Scheduler are written to the individual user's crontab and will only run for that user.  If your clients are being installed as unmanaged, they are getting a schedule written to the root user crontab, and that schedule is (unfortunately) not silent.

Please see the following:

"Unexpected, frequent LiveUpdate sessions launch on SEP for Macintosh client "
http://www.symantec.com/docs/TECH144410

This document has instructions for removing that hidden schedule, and how to set a new schedule for all users that is quiet.  Managed SEP for Mac Clients are given a silent schedule via SEPM policy.

I don't know if that will cover that first LU session, though.   Give it a shot and update the thread for the benefit of future Mac admins?

Thanks and best regards,

Mick

Thanks again for the help.

I think the answer to my question is that it's impossible to run the initial Live Update sliently.

I think everything else is working as expected.  I havent seen any annoyances other than the one I mentioned.

So if someone from Symnatec could write in a switch to hide the initial updates that would help the Mac admins I think.

Thanks again.

Many thanks for updating the thread, Layne!

You may wish to create a Connect Forum Idea (enhancement request) - I'd vote for it.

Here's anotehr good one you may wish to lend your weight to: https://www-secure.symantec.com/connect/ideas/enable-sep-mac-automatically-update-virus-definitions-without-user-login

Thanks!

I added to Connect forum here. And supported the one you posted.

Thanks!