MR5 - how is everyone going with it?

[Migration User]

So how is everyone going with the new MR5 release of SEP 11?

Any issues youve come accross?  Easy upgrade?

Would be interested to hear.....

[pete]

UAT test ,,,so far so good..

GUP feature has been enhanced..thats what i can tell you at this time..

[Migration User]

Added Information:

This release contains a new build of the Symantec Endpoint Protection Manager (SEPM version 11.0.5) and the latest version of the Client binaries (version 11.0.5). This version of the SEPM and Client binaries can be installed as a new install or as an upgrade to an existing 11.x installation.

With this MR5 release, SEP 11.0 now also supports Windows Server 2008 R2 and Windows 7.

Thanks and Regards,

Twixxica_ica :)

[Migration User]

So far so good.   Upgrade went smooth on the SEPM servers only the second time thats happened in all the years I've been using Symantec so thats a plus.   I have started deploying the client out to test users and no complaints so far.    Tomorrow morning and through the weekend is when my full scan kicks off so that will be telling when that happens.   I am planning to make sure a few of the users who complain about the full scan when it is running get upgraded today and will know more on monday hopefully. I like the concept of some of the GUP enhanncements but have had no need to try them yet as bandwidth is typically not much of an issue.  I do plan on trying the multiple GUPs in one of my larger offices once I get fully deployed.

[Migration User]

Caused major problems on 4 computers so far.

They get 0xC000005 application cannot initialize errors, on every single application that tries to run.  They cannot even go into cmd.

Do not recommend.

[Migration User]

I upgraded our SEPM and a few clients. The upgrade process was painless and easy. It's almost scary how well it's gone so far... *knocking on wood*

[Migration User]

weve done a couple of test machines and all ok so far, upgraded over the top fine, think it needs a reboot after though.

let keep this thread going...

[Migration User]

Upgrade went very well.
Upgraded 10 Replication partners, and 35 sites which use a Group Update Provider.
I customied my SEP client package and scripted it out to clients, which upgraded quickly without issue.

With the new version I've added multiple GUPS for each site which will help things a lot.

[Migration User]

I posted a few days ago with a warning. It automatically rebooted all my servers immediately.  Make sure that when you push the client upgrades, that auto reboot is disabled!

[ch1221 2]

I only upgraded my SEPM servers and after a few hours started having reports from clients that they were being prompted for the uninstall password mostly when trying to connect to vpn.  I'm also seeing other errors from clients in the logs that they are unable to communicate with the server more than 10 times, errors installing teefer driver, and cannot switch locations due to a corrupt profile.  Again, I only upgraded my SEP servers and deployed the latest client package to them - not to any other client reporting these errors. 
DB validation passed.
I have a case open with support on this.

[Migration User]

Upgraded SEPM from MR4MP2 to RU5.  It went well.  Began test deployment of the client---so far 29 clients upgraded and no issues.  Note that if upgrade clients via the stand-alone MSP patch, the symantec service tends to not want to start.  An attempt to manually launch the SEP client prompts to start the service, and after that all is well.  This could cause issues and leave a client unprotected if you're not careful.

[Migration User]

We had the same problem on the 200 computers with specific application as DoniC mentioned,but on another 1000 computers which are not using this application everything looks fine. All computer are running the network threat protection,after running reinstallation package from console only with Antivirus and Antispyware feature and workstation restarting,application will run without errors. This was only one sollution which helps fast solve our problem.

DoniC mentioned error message(same as our):

"They get 0xC000005 application cannot initialize errors, on every single application that tries to run.  They cannot even go into cmd."

 

[Migration User]

I have been testing since RU5 was released. I had no installation issues –on a machine that was giving me endless problems when installing/removing SEP. There has been 2 instances where the SEPM service didn’t start automatically but when I started it manually all was fine again. So far I'm impressed!

[Migration User]

up to now ive never had any issues with upgrading the SEP manager but this time its gone pear shaped.
trying to log on and get error:-
you cannot log on to the console because the server is not synchronized etc......
I have tried the fix a couple of times where I run the server configuration wizard with no success

any ides

[Migration User]

I too have just experienced this problem!

[Migration User]

Upgraded four sites so far. No problems. Only workstations that had trouble upgrading were Vista, W2K8, and Win7 machines that had "Pending File Rename Operations". Had to go into registry to Session Manager Key and remove entries, then manual update.

[Migration User]

I am trying to upgrade my current MR4 MP2 install clients using GPOs with some nasty problems.

The upgrade goes fine other than I cannot seem to force a reboot after the upgrade no matter what I do.  This is bad becaue the service do not start after it upgrades. Every single PC we tested needs to be manually rebooted.  This leaves the PC unprotected until a manual reboot.  Anyone know how to force a reboot after upgrading using the .msi/.mst and GPOs?

The other problem I see is that in Add/remove programs intead of removing the old entry it just creates a new entry for the new MR5.  That is annoying.

[Migration User]

Was doing fine, 'till 10 minutes ago...
I migrated only SEPM to RU5, all the clients are still MR4. After that, LiveUpdate didn't run on the scheduled time (tonight). It run this morning (now it's 10:00 AM here), and all my servers went crazy due to the extra CPU processing

[Migration User]

So far so good!!! 

[Migration User]

I have to ask, why don't you use SEPM instead of GPO? The Manager is designed to install/uninstall the clients seamlessly.

[Ramji Iyyer]

So for so good !!!!!

Resolved  the below error

Make sure that the server is running and your session has not timed out.
If you can reach the server but cannot log on, make sure that you provided the correct parameters.
If you are experiencing network issues, contact your system administrator. ErrorCode: 0x80020000  [Site: Site name]  [Server: Server Name]
August 15, 2009 7:34:59 PM IST:  E:\SEPM\tomcat\temp\null (The system cannot find the file specified)  [Site: Site name]  [Server: Server Name]
August 15, 2009 7:34:59 PM IST:  Failed to connect to the server.

Using the GUP's bandwidth throttling we are evaluating to reduce the SEPM's.

Regards...
Ramji Iyyer

[Migration User]

So far so good for us.  We'll see how things go next week when we push out the update to over 3,000 student machines.

[Migration User]

Because Symantec has a poor track record with this kind of thing.  I originally tried to deploy it through SEPM but could never get it working.  GPOs were much easier.

We have a very simple setup with 2 groups in SEPM for server and workstations. 

We also have 1 SEPM server and 3 remote offices.  I am unable to deploy new clients across the WAN as it would take forever.  It is much easier to deploy SEP clients in the remote locations using GPOs from a local file share.

We have group update providers in each remote office.

[Migration User]

Totally understandable. It's too bad it didn't work for you, I always had an easy time upgrading all my clients. However, I only have one domain and one SEPM server, so my managed network is a lot less complex than yours.

[Migration User]

We have one domain and one sepm server.  Just 3 remote offices.  We have less than 30 servers and 200 clients.

I've been testing and retesting for the past two days.  If anyone know how to force a reboot after an update using GPOs PLEASE SHARE.



Also, can anyone see if a new entry in add remove programs is created or if the MR5 update replaces the previous one for them?

[Migration User]

You can use "shutdown /i" in your command prompt and manually enter the computers to restart.

[Migration User]

I need a seemless solution.  manually rebooting all of my pcs after a GPO deployment is not an option.

For some reason if you install MR5 over MR4 MP2 it upgrades perfectly aside from the fact that it leaves the SEP services off and it needs another manual reboot to get everything working.

If anyone knows how to deploy SEP via GPOs and force a reboot PLEASE let me know.

[Migration User]

I was curious if you two had made a case on this issue yet? If you had I would appreciate it if you could PM me your case numbers. I was hoping to follow up on this issue.

Thanks,
Grant

[Matt Pierce]

 Well This sucks.  We did an upgrade from MR4MP2 to RU5.  The update failed to load the installer.  When we rebooted we got errors that the SEPM service failed to start some 30 times.  We uninstalled SepM and rebooted.  Installed RU5 over the old database.  When we try to import the Site Cert we get an error on the Key we have on record from our install notes.   Damn I should have snapshooted the VM.  If tape restore fails I'm in for an unpleasant time.

[PierceKeith]

Wish me luck just upgraded and doing live update.

[Migration User]

Test users and servers are working great.   Moving into a pilot office Tuesday morning.  I will keep everyone posted.

[PierceKeith]

Ok so far so good, just updated my laptop and ready to do some more.

[Migration User]

No, I had to remove it - needed to get the workstation back into production - no time to wait for a case unfortunately.
I can get hold of a spare Dell D630 and "break" it so that we can open a case - you want me to do this. Happy to work with you.

For those reading - I have been able to launch "command" as opposed to cmd, then browse the registry for the uninstall string for RU5 and recover the workstation that way by executing the uninstall string from another command prompt.

[Migration User]

some fixed reviews here.  Good responses all, lets keep this going :)

Looks like a full backup of the DB and a VM Snap before upgrading is in order.

Also like mentioned above on my test couple of workstations i also have the two entries in Add/Remove programs for both RU5 and the older MR4 MP2 setup..... hmmmm

[Migration User]

How did you update the test workstations?
 
I used the Symantec provided single exe - SEP32_75To333_clientMSPMSI.exe and don't see the multiple entries.

[Migration User]

You can't use the .exe when depoying the .MSI via GPOs.  

I created the package the same way you did however I unchecked the box that says to create a single file .exe and just grabbed the entire folder, created a transform to choose components during install and used GPOs to deploy.

My 2 major issues remain still.

1.  A new entry is created in ADD/REMOVE programs instead of it replacing the old one.  Eventually this gets messy.

2.  The workstations do NOT reboot after an upgrade to MR5 from MR4 MP2 and it leaves the SEP services turned off and the pc in a vulnerable state.  A manual reboot is necessary.

[PierceKeith]

First group of 10 users done. No one noticed it. No complaints yet.

My link on my desktop to remote SEPM no longer works. At least RPD works until I fugure it out.

[PierceKeith]

Open a Web browser and type the following address in the address box:
http://host name:9090

I had to clear the JAVA cache as well to make it work.

"C:\Documents and Settings\USER\Application Data\Sun\Java\Deployment\cache\6.0\46\"

I just deleted all the numbered folders. I can remote to SEPM now woot.

[Migration User]

We have run into this problem as well, it ended up being the Dell Embassy Trust Suite.  If you don't use the finger-print scanner, smart card authentication or any other TPM dependent services, removing it doesn't cause any problems.  We went through the same uninstall process then removed Embassy Trust Suite, reinstalled SEP and it works fine.  That is dependent on the successful removal of Embassy Trust Suite, it is really buggy and might not remove successfully every time. 

[PierceKeith]

So far so good, nothing getting screwed up yet. Just updated 3 servers, BES, WEB+FTP, SQL.

Have about 20 clients done. Seems pretty smooth so far. Even upgraded over Hardware VPN with good results from Canada and the UK.

[Migration User]

That should be the absolute first thing that anyone does before attempting an upgrade.
Follow the DR document on here, backup the policies manually if you have lots of them, backup the servers, snapshot VM's then proceed to upgrade.

Even when you completely kill everything you can get a SEPM back in an hour or two from scratch if you are prepared.
The worst case scenario isn't even all that bad considering you just need to drop a sylink.xml on every machine.
I did that on 20,000 machines for one client that had made a mess of things :)

I also do a test upgrade on a second/backup database to work out if it will be a smooth run or not.

z

[PierceKeith]

One user had an issue with SMC GUI not closing. then the PC reinstalled MR4. Weird.

[Migration User]

Could you create a task? Have it run only once at end of that day.  Command?  shutdown -r -t 05

[Migration User]

Hope it all worked out for you.

Even if you have to do a complete re-install from scratch without the domain id or digital certs etc. it is very easy to get the clients back on the new servers.
You just stop write a script that connects remotely to sytems stops the smc service, copies the new sylink.xml file and then starts smc again.

I recently did this for a client with 17,000 orphaned SEP clients!!
Used 5 workstations and had 4-5 instances of the script running to get it completed in a couple of days.

Not all is lost if you have to completely rebuild although being able to restore is much quicker as the clients just all appear on their next hearbeat.

cheers

Z

[wroot]

Didn't want to start a new thread, so will jump here. First i wont to comment a few messages here.

We also had 0x0000005 initialization error with one application launched from the share. It is a known problem and is caused by Application and Device control policy. We had to disable it so far.

Speaking about the requirement of restart after the upgrade. Wonder, do we really need to restart machines if upgrade is done via Install Packages. SEP client icon appears and it seems to be working, it also reports its status and SEPM doesnt show, that clients should be restarted.

I had no problems upgrading clients to 11.0.4202.075 via Install Packages. Upgraded ~200 clients in a few days. I think it is more convinient than GPO and you can keep track of installations by generating report and filtering by program version. 80% of clients were upgraded in a few hours after i have set packages.

----------

Ok. Now my problem. Now i've launched 11.0.5202.333 packages via Install Packages. I'm seeing problems with upgrading HP 6710b laptops with Vista SP2 32bit Business. Usually it slowdowns a bit computer while upgrading. If user tries to restart a computer it gets stuck on Logging off.. screen. So we have to force shutdown. This happens even when installation should be over and user tries to shut down a computer at the end of the day.