We deployed SEP in our company and as the responsible architect I have to say that it looked much better on paper then it came out in real life. Symantec Endpoint Protection

The problem with the RTM version was that a lot of things that worked in the beta, stopped working.

Database size

Also the database size seems to fluctuate quite drastically. In an environment with about 1400 clients the database size went from 7GB to 2GB and back up to 4GB before leveling out at 2.7GB. All this was over the course of several months which means trffic on our lines was quite heavy.

Be prepared for some great db sizes until you have figured out the tweaks necessary and they have taken effect. If you see that your database is growing like crazy (if you are using SQL Server 2000 this might be a possibility) then I suggest you try and clean out the old definitions and shrink the db. The following SQL statements will accomplish this and you can paste this straight into query analyzer, just make sure you use the SEP database.

delete from BINARY_FILE where DELETED=1

dbcc SHRINKFILE (sem5_content,5000)

dbcc SHRINKFILE (sem5_content,4000)

dbcc SHRINKFILE (sem5_content,3000)

dbcc SHRINKFILE (sem5_content,2000)

dbcc SHRINKFILE (sem5_content)

GUPs

Next thing was that Group Update Providers (GUP), which are machines that cache and provide definition updates to a small group of computers (100 or less) need to be in the same group then where they provide the service for in the SEPM console hirarchy. This makes it hard to distinguish them in the list of all the other computers. The manual, for the RTM version, states however that the GUP can be in any other group. Well if you choose to do so the GUP will not function as a GUP but you don’t have an easy way of verifying that as you will have to wait for clients to update and even then ifyou choose not to use location based implementations, the clients will just go to the management server directly for updates; which defeats the purpose of the GUP.

Please note that GUPs only server 2 clients maximum at the same time and unless you have your client settings configured differently, all clients will pull updates at the same time.

SEPM Servers

The SEPM Server hardware specifications in the official documentation are a “little bit” understated. We have all our SEPM Servers running on Quad Core Xeons with 2.5+ GB Ram and some of them still give warnings about not having enough memory or excessive CPU usage.

Also, please make sure you use SEPM Servers as much as you can if you do not have interoffice connections that are quite hefty (10mbit or higher). We tried GUPs with a 2mbit link and it saturated it because of the 2 client maximum that the GUP has. We installed a SEPM server locally and now the link is nearly not used because the SEP replication to the main server is happening at night.

Replication in SEPM is still done (WHY!!??) over file shares, which is quite slow , so expect any first time replication to take some time!

I will cover more subjects here and in more detail also the placement and design of a smooth working SEP installation as soon as I get the necessary screenshots and information together.

This entry was posted on Monday, June 16th, 2008 at 5:33 am.
Categories: Security, Symantec.

No Comments, Comment or Ping

Reply to “Symantec Endpoint Protection gotcha’s”