Hi Dan,
"Thumbs up" to the advice above. There is also a “Installing clients with Microsoft SMS 2003” section of the Symantec™ Endpoint Protection Implementation Guide has additional details that has additional details about deployments via SMS 2003 and SCCM 2007. In my experience, following the steps there should be successful.
Workstations, and VM's. I have exported my exectuable's, created single .exe's and checked the boxes to have the installations put the workstions into the Workstations group and to get the associated policies, and the same for the VM group. If I manually run the executable on a machine, the machine get's put into the correct group and gets the correct policy. If I have SCCM push the installation, every machine no matter what executable is used, the machines end up in the DEFAULT group. Is there a reason for this?
Are there duplicate clients appearing in the SEPM, or are all the clients just in the wrong group? If it is that all clients are in the wrong group, then the most likely situation is that the setup.exe created for the default group has been rolled out to all clients, not just the machines intended for that group.
Another possibility.... Those setup.exe files created have a sylink.xml inside of them which has details about which client group to apply to the installed client. If you have time, open both setup.exe's with winrar, 7z etc and extract the two sylink.xml's. Do they specify the desired groups or are they both for the default group?
Please do keep this thread up-to-date with your progress!