Endpoint Protection

Symantec Endpoint Protection includes an unsupported utility that allows administrators to automate SEP client moves within the different SEPM groups. This is a very useful utility for larger implementations.

Description:

MoveClient.vbs is a Visual Basic script which, when properly configured, will move one or more clients from a SEPM group to another group of your choice based on the hostname, username, IP address or operating system of the client.  It also has the ability to switch client mode from user mode to computer mode or visa versa.

Once you setup MoveClient.vbs script (follow the instructions included with the utility) you can manually run it at any time but what about automating this task?

There are multiple ways to automate the MoveClient.vbs script but one of the easiest solutions is taking advantage of Windows Task Scheduler.

In this example Windows 2008 Server 64bit edition is used:

1. Create a directory on the server running the moveclient utility. Include the moveclient.vbs and groups file(s).
2. Open Windows Task Scheduler from Control Panel > Administrative Tools
3. Expand the Task Schedular Library menu and Microsoft menu on the left.
4. Expand the Windows Menu and on the right side click New Folder.
5. Name the new folder something like Symantec.
6. Click on the new folder you created on the left side menu.
7. On the right-side menu select Create Basic Task
8. Complete the Task Wizard by giving it a name and click next.
9. Select when you want the task to start and click next. Configure the date/time information and click next.
10. Select Start a program on the action you want to perform and click next.
11. On the start a program screen enter the name of your script under the Program/script: section (i.e. this is the name of your moveclient.vbs script)
12. Leave add arguments blank.
13. Enter the path to your moveclient.vbs script in the Start in: section and click next.
14. Click Finish.
15. Open the task you just created and make sure you are on the General Tab.
16. Configure your security options but the following is recommended:
      a. Click Change User or Group and make sure you use an account you want to run this script. I recommend a service account.
      b. Select Run whether user is logged on or not.
      c. Check the Do not store password option.
17. Click Ok. You will be prompted to enter the username and password you decided to use to run the task.

At this point you have just configured the moveclient utility to automatically run at your specified interval. Repeat these steps if you want to run other instances of the moveclient utility automatically as well.

As an example if you incorporate multiple SEP domains and only want to use the moveclient utility on a subset of users/computers/groups within each SEP domain then you can repeat the steps above to seperatly launch unique instances of the moveclient utility.