Endpoint Protection

we are looking for a way to upgrade from RU5 on W7 x64 to RU6 MP2. One of the Symantec supported routes is RU5 to RU6, Reboot, RU6 to RU6 MP2, if using the full install MSI. That is a deployment nightmare with 100's of clients and reboots and not what management will accept.

There are also patches available, whihc apparently require no reboot:

SEP64_333_RTMTo562_clientMSPMSI.exe (11.0 RU5 to 11.0 RU6a Client-only patch (64Bit))

SEP64_562To754_clientMSPMSI.exe (RU6A to RU6 MP2)

The problem is, how to create an install package to upgrade from RU5 to RU6 MP2 using the two patches in one seamless chained install wrapper?

Any other tried and trusted suggestions?

You won't be able to include both installs in the same wrapper because a reboot is needed after the first install....unless you program in a reboot.

Otherwise, you may as well wait til RU7 to come out as that should support an upgrade directly from previous versions.

Migration from RU5 to RU6 MP2 is not supported however I have seen before that it goes fine in most of the cases. However why to take risk in production environment.

Refer the article below specially the migration path.

Migration documents for Symantec Endpoint Protection 11

http://www.symantec.com/business/support/index?page=content&id=TECH94405&locale=en_US

Migration paths
Symantec Endpoint Protection 11.0.6200 (RU6 MP2) can migrate seamlessly over the following:

Symantec Endpoint Protection 11.0.6000.550 (RU6), 11.0.6005.562 (RU6a) and 11.0.6100.645 (RU6MP1).

Upgrading clients by using AutoUpgrade
http://service1.symantec.com/SUPPORT/ent-security.nsf/docid/2009101503293948

"Upgrade group with package" wizard in SEPM is called as AutoUpgrade

In this we have a settings called Upgrade settings

Upgrade Schedule lets you control the time of the client computer upgrade.

- From, To:

Specifies a range of time over which to install packages. If the From and To times match, the upgrades start immediately.

- Distribute upgrades over:

Specifies the number of days or hours over which the packages can be distributed.

This settings can be done to upgrade the SEP clients over the weekends by specifying the time and days.

Brian 81 says: "You won't be able to include both installs in the same wrapper because a reboot is needed after the first install".

Serengeti response: We have been told that no reboot is required when applying the patches I refer to (not the full MSI installs) . . . are you referring to the patches or the MSI install? Have you tested both? Thanks

It's only the SEPM that needs to do the step install to RU6a then to RU6 MP2 once you upgraded the manager you can take clients directly ro RU6 MP2.

We have done this on our environment and even run it past symantec. We've had no issues.

Yeah Its true, we also done the same at our customer site were they are in MR4_MP2 and decided to upgrade to latest patch.

First we Upgraded our SEPM till RU6a and after three hours once we confimed that the clients are communication properly with no issue, we upgraded to latest which is RU6MP2.

For clients we added RU6a patch in autoupgrade and once completed we have created task for RU6MP2.

Here we completed our upgradation after done the above.

we do not use the SEPM to push out updates but use an install package from central application repositories. The maze of install options clouds the issue for customers, who cannot change their deployment standards to fit with a particluar scenario that works in a certain case.

If you went this way with the upgrade and then ever had to log a support call I believe you'd be in a none supported state due to not following the recommendations in the upgrade guide.

Regards

Steve

Hello,

The Best way to upgrade all the Clients to the Latest version without a restart would be Installing clients with Active Directory Group Policy Object

Check the Symantec Knowledgebase Article:

http://www.symantec.com/business/support/index?page=content&id=TECH90902&actp=search&viewlocale=en_US&searchid=1299601630051