Migrating from legacy SAV to SEP RU6 MP2

[Migration User]

Hi guys,

I'm planning a migration from SAV to SEP and I'd like to use directly RU6 MP2.

Now I know this can cause issues, so I'm not going to do an upgrade in place. The plan is to use SepPrep tool to remove SAV and trigger the installation of SEP RU6 MP2. We want to use SCCM to do that.

I've tested manually on a few machines with a SepPrep custom package and it seems to be a valid process, it has worked out just fine.

The question is:

Does the competitive uninstaller do a thorough clean up so that I should not experience issue by going straight to MP2?

Do I need to worry about that in the long run?

Symantec support said, on a related note, that a normal uninstall like the one in Add/Remove or executing remotely the unistall reg string, does not ensure a successful install of MP2.

On a dozen machines, we so far did it with cleanwipe to remove SAV, reboot twice as per cleanwipe prompts and then install RU6 MP2. But we have 1,000+ ahead, so we can't possibly think of it as a viable option.

So, any objections to SepPrep tool?

 

Thanks!

[Mithun Sanghavi]

Hello

Symantec Knowledgebase for Migration.

1) How To Migrate From Symantec Antivirus System Center Console To Symantec Endpoint Protection Manager

http://service1.symantec.com/support/ent-security.nsf/854fa02b4f5013678825731a007d06af/eda2ac3faa9a31b0882574f90001484e?OpenDocument

2) Obtaining an upgrade or update for Symantec Endpoint Protection 11.x or Symantec Network Access Control 11.x
http://service1.symantec.com/SUPPORT/ent-security.nsf/docid/2007121216494948?Open&docid=2007121216360648&nsf=ent-security.nsf&view=docid

3) 'Installing and configuring Symantec Endpoint Protection 11 for the first time'
http://service1.symantec.com/SUPPORT/ent-security.nsf/docid/2007082915561148?Open&src=w

4) Creating custom Client Installation packages in the Symantec Endpoint Protection Manager Console
http://service1.symantec.com/support/ent-security.nsf/854fa02b4f5013678825731a007d06af/c741ec26fa674b1e8825738a0076abf3?OpenDocument

5) How to Deploy Symantec Endpoint Protection to your client computers using the Migration and Deployment Wizard.
http://service1.symantec.com/SUPPORT/ent-security.nsf/docid/2007111409432848

[Migration User]

Which is the version of SAV in the systems?

[Migration User]

We have SAV 10.1.9, SCS 3.1 and some SAV 10.2 on vistas and win2k8.

[Migration User]

i think you canm go for direct upgrde.It shold be fine.In some rare systems you may face issues.For those systems you may need to manually remove SAV.Also do you have a uninatllation password in place?if yes remove it prior to migration...

[Rafeeq]

Does the competitive uninstaller do a thorough clean up so that I should not experience issue by going straight to MP2?

its needed when you have any non symantec AV. if you have version 9 and above SAV you dont have to use that.

sep will uninstall sav and gets installed without any problems (95% of the time)

Do I need to worry about that in the long run?

plan the upgrade site / site do not try to install 1000 clients in one go, server roles might be diff like cluster, oracle, take care of those.

 

Symantec support said, on a related note, that a normal uninstall like the one in Add/Remove or executing remotely the unistall reg string, does not ensure a successful install of MP2.

its all the same if you uninstall from add/ or reg string they do the same job..I always use reg string.

 

On a dozen machines, we so far did it with cleanwipe to remove SAV, reboot twice as per cleanwipe prompts and then install RU6 MP2. But we have 1,000+ ahead, so we can't possibly think of it as a viable option

cleanwipe should only be used when you have trouble with the uninstall its know to cause some issues on servers but most of them are fixed now, i would only go with it only when its needed not on all the boxes.

[Migration User]

As per Symantec, RU6 MP2 will migrate seamlessly over RU6 or RU6a, as it contains the patch and needs a base version.

I can't hide that I tested this version directly on top of all kind of legacy clients, SAV and SEP, I guess we all did. And it worked.

But you know, if you run into issues in the long run, you'll ask yourself why you did not follow the recommendation. Support will say that too.

As I said, I did ask support on the phone, and they recommended  a thorough removal as cleanwipe does if I want to install RU6 MP2 on anything else than base version. But cleanwipe, that's supposed to run manually on thousands of systems, c'mon...

Now you get my confusion as we get mixed responses. Please stay on this thread, I'm sure we'll get different opinions.

Thanks.

[Chetan Savade]

Hi,

I am not sure but article says new release may launch.

So if you could wait (& If it released) then directly upgrade to new release (if recommended) it may be helpful for you.

http://www.symantec.com/connect/forums/sep-ru6-mp3-released-yet#comment-5261921

[Mithun Sanghavi]

Hello,

Have you tried, Installing clients with Active Directory Group Policy Object

http://www.symantec.com/business/support/index?page=content&id=TECH90902&actp=search&viewlocale=en_US&searchid=1299854505676

 

Please check the Symantec Knowledgebase articles above, which explains the entire process and they are quite Self Explainatory.

Hope that works for you.

[Migration User]

Upgrading directly to RU6MP2 shold not be an issue,but if you are affried to do so for a more safer side you can upgrade to RU6a first.Refer this article.

Migrating to Symantec Endpoint Protection 11.0 RU6

http://www.symantec.com/business/support/index?page=content&id=TECH131653&locale=en_US

From this article

Migration paths
Symantec Endpoint Protection 11.0.6 (RU6) can migrate seamlessly over the following:

• • Symantec Endpoint Protection 11.0.780.1109/11.0.776.942 (RTM), 11.0.1000.1375 (MR1), 11.0.1006 (MR1 MP1), 11.0.2000.1567 (MR2), 11.0.2010.25 (MR2 MP1), 11.0.2020.56 (MR2 MP2), 11.0.3001.2224 (MR3), 11.0.4000.2295 (MR4), 11.0.4010.19 (MR4 MP1), 11.0.4014.26 (MR4 MP1a), 11.0.4202.75 (MR4 MP2), and 11.0.5002.333 (RU5)
  • Symantec AntiVirus client and server 9.x and later
  • Symantec Client Security client and server 2.x and later

[Chetan Savade]

Hi,

When user doesn't follow recommended path we have seen few cases related to database corruption.

RU6 MP2 will migrate seamlessly over RU6 or RU6a, as it contains the patch and needs a base version.

Any other upgrade path is not recommended nor supported by Symantec.

[Rafeeq]

this one is for the upgrad for sep 11 to later version.

why are u worried about that, you are migrating from SAV to the latest SEP there is no earlier versions of SEP in between.

we never ran cleanwipe on any servers and we migrated it successfully

install sepm

create package

push it to clients

once all clients are migrated 

then unisntall ssc and primary server, thats it.

[Migration User]

Well, I know RU6 and earlier can upgrade SAV or old SEP clients. I just want to skip the so many upgrade sessions and packages and go straight to the latest one. The safe way. The question for all of us again - If I do a normal uninstall - and here I include manually from add/remove or execute reg string remotely with a nice quiet switch (I know both serve same purpose) or use a tool like SepPrep that uninstalls competitors mainly but including symantec products - - would that be enough to install properly RU6 MP2 client? Why relating again to SepPrep? Simply because this removes SAV and also verifies other incompatible software, like SSC for instance, are removed and then nicely triggers installation of SEP.

[Mithun Sanghavi]

Hello,

SEPprep is a unsupported tool that is designed to uninstall any competitive product automatically. This tool can also launch another application before or after removing all competitive products.  Therefore you can configure this tool to first remove all competitive products (including Norton products) and then launch the SEP installer automatically and silently.  SEPprep works on all supported Windows SEP client operating systems (both 32-bit and 64-bit). There are two different binaries: one for 32-bit systems and one for 64-bit systems.

RemoveSymantec

The RemoveSymantec option controls whether SEPprep should remove any Symantec product it finds. This option will not remove all Symantec products, instead it will only remove the Symantec products listed in the [ProductNames] section of the SEPprep.ini file. If this option is disabled it will skip any product it finds that has the word “Symantec” in it. Enabling this can be useful if you want to remove products such as older versions of SAV or SCS. However, be careful, as this will remove the SEP client also.
This option can be set to Y or N. This is disabled by default."


This information was taken from the link in the References section. There is a full breakdown of how the tool works, what each param does and how to use it.

[Migration User]

Thanks, Mithun. I think I know all this. I have it, and tested it. What about the question if this is enough? the normal uninstall (any of the ways posted above) and the install RU6MP2 I sense you are against sep prep. Then what do you suggest for a migration of 1,000+ machines? We just can't go do it by hand right? Thanks

[Migration User]

You  can use  Symantec's  competivie uninstaller and  see

[Mithun Sanghavi]

Hello,

I am not against anything.

As a Symantec Technician, I personally would let you know the pro's and con's

1) BIGGEST POINT: When using the tool, god forbidden incase if anything goes wrong; there is NO SUPPORT FOR THIS.

2) Symantec Endpoint Protection Manager provides you lot of ways for you to upgrade. Like:

a) Created Custom Packages from Symantec Endpoint Protection Manager and deploying the same with the Help of Migration and Deployment Wizard. (KB article provided above already)

b) You can deploy Packages by "Find Unmanaged Computers" from the Symantec Endpoint Protection Manager as well.

How to install clients using "Find Unmanaged Computers" in the Symantec Endpoint Protection Manager

http://www.symantec.com/business/support/index?page=content&id=TECH103107&actp=search&viewlocale=en_US&searchid=1299858746275

 

Incase, still you don't want to do that and you want to go ahead migrate every machine at 1 go, you can chose to use the Installing clients with Active Directory Group Policy Object

http://www.symantec.com/business/support/index?page=content&id=TECH90902&actp=search&viewlocale=en_US&searchid=1299854505676

[Migration User]

Thanks, Mithun. I got your point. But with this customer, we don't use SEPM for migration, we leverage SMS. I'm not concerned about clients per se, I know this will work for them. Again I have to mention support, I've been told that clients which have not been migrated as per supported path, might get SEP DB corrupted. Any truth in that?

[Migration User]

That they are telling about SEP migration path.Now you are do not having a SEPM DB then how it can get corrupt?In case of migrating from one version of SEP to another version of SEP it is possible that during migration cooruption to the DB may happen because migation is happening for the existing DB...

[Migration User]

I'm afraid I don't get the previous post. Perhaps that DB may get corrupted when SEP server does a non-supported migration...which would make sense.

Now it would be better off for me to know how others migrated from sav10 / sep mr4 to RU6MP1 or MP2.

So, thanks for all responses.

[Mithun Sanghavi]

Hello,

Its simple Migration and Not a complicated Migration.

Your Confidence is correct. Incase, you are confident that the steps you have tested works, then go for it.

As a Symantec Endpoint Protection Support personally over 4+ experience.

I have suggested the below Steps for Migration from SAV 10 To SEP 11 (Normally, Customers would like to Install SEPM on the same Server computer where the Symantec System Center is Installed)

 

1) Install Symantec Endpoint Protection Manager,

2) Create new SEP 11 packages for new Deploy on all the other machines.

3) Deploy the packages to all SAV 10 client machines, which will migrate all the clients to SEP (this could be done either with the help of "Migration and Deployment Wizard" OR "Find Unmanaged Computers"

Till the time the migration is over, the clients which haven't migrated from SAV 10 will communicate to Symantec System Center 10.

4) Once all the machines have been migrated from SAV 10 to SEP 11

(Except on the same server machine where the Symantec System Center 10 is installed, as SEP will not get installed till Symantec System Center 10, SCS 3.1 is uninstalled.),

5) Uninstall Symantec System Center 10, SCS 3.1 on the server

6) Install SEP on the same machine where the Symantec System Center 10 was uninstalled.

 

These are the steps to SUCCESS.

[Migration User]

Mithun, I cannot but appreciate your responses.

Still, we don't use SEPM for migrations. We'll use SMS. To be exact, SCCM.

We have SEPM. Currently running over 6000+ clients. We have a task to migrate remaining servers, a little over 1,000, from legacy SAV environment, which is running in parralel. We are not planning to use existing SAV server as SEP manager.

The issue is not what tool to use, but which SEP11 version to use on top of SAV10.

The whole thing started from the fact that I had been told by support to use Cleanwipe to remove SAV on each machine. Quite drastical, as it is very aggressive, restarts twice, and cannot be used remotely.

And I wanted to know if a normal job to unistall sav would be enough for later installing this MP2. I think I'll do it this way. Let me know if you find anything in the KB to counter that.

That's all.

 

[Mithun Sanghavi]

Hello,

Thank you very much for your Resposne.

Yes, you can say its the Limitation of Cleanwipe that it cannot be runned Remotely.

The Best version is SEP 11.0.6200 (RU6 MP2) (at present).

However, if you could wait for a little longer for SEP 11.0.7000 (RU7) would be wonderful. It would be the most latest version.

Again, In your case, we have Less Choices and expectations are Higher.. You got my point.. :)

Again, if I am not mistaken, if you may have used SMS for install of SAV, you can use the same tool to uninstall it as well.

 

Again about SEP and SMS, check the Articles here.

Third-party installation options

http://www.symantec.com/business/support/index?page=content&id=HOWTO26777&actp=search&viewlocale=en_US&searchid=1299869424457

About installing clients with Microsoft SMS 2003

http://www.symantec.com/business/support/index?page=content&id=HOWTO26774&actp=search&viewlocale=en_US&searchid=1299869424457

 

Hope that might be of some help

 

Have a Great Weekend..

Incase, if the issue is resolved, Mark the Thread as "Solved"

[Mithun Sanghavi]

Hello All,

Symantec Endpoint Protection RU6 MP3 is Released.

 

Please Check the same and download it from https://fileconnect.symantec.com

[Migration User]

Rafeeq seemed to have been the first to comment there should be no issue with standard SAV uninstall followed by reboot and RU6MP2 install.

 

Thanks everyone for your responses.