Endpoint Protection

Newly switched to Symantec Protection Suite version 11.0.5 form mcafee

all is going well so far in testing phase but have some questions regarding GUP's

I have edited the Live Update policy and have added a server as a GUP (1 rule server name)

The GUP value changed from false to true and the logs indicate it knows it is a GUP but my clients on that subnet seem to be
still be communicating with the management server and not the GUP. How can I tell for sure? When I update policy on the client I am currently only told the latest updates have been applied but
it does not tell me which server (management console or GUP it is talking to) Once there is something new I will see that in the log but want to know if there is another way to verify.

Also-

Where (folder path) on the GUP are updates stored? Can this location be changed? (to the D drive instead of system drive for example)

What is the GUP and master server Sync schedule?

I must be missing some of the basic concepts despite what I have been reading so far. Any help would be appreciated. If I need to provide more detail please le tme know.

Thank you

 Clients will still contact SEPM for Policy updates..however they will only contact GUP for definitions.

Default location: C:\Program Files\Symantec\Symantec Endpoint Protection\SharedUpdates

If you install SEP client on D drive this will go to D drive.

You can find many other things about from this link

http://service1.symantec.com/SUPPORT/ent-security.nsf/docid/2008040113243148

By default clients will not connect to server for updates if GUP is not available as it is set as never..however if you configure that.

When SEPM downloads the definitions it updates the GUP and then clients take the updates from GUP..that cannot be scheduled.

actually the updating process with GUP is slightly different...

1. clients will still send a http request to the SEPM for Updates
2. If the SEPM has new updates, he will create a delta (if not done before) and will tell the client where to find this delta (on the GUP)
3. The Client now asks the GUP for the new file, and after the GUP received the file from the SEPM, the client can receive it from the GUP

You can see that the GUP is distributing the files, by simply checking the folder, Vikram gave above.

For more information on how to log and troubleshoot GUP activity, please visit the following kb article:

http://service1.symantec.com/support/ent-security.nsf/854fa02b4f5013678825731a007d06af/7f020ee38fbb30238825741e00701b8c?OpenDocument

best regards

Dominik

Thanks guys for the fast and informative answers and links, that helps a lot