Endpoint Protection

Hello,

Since recently there has been much confusion about Maintenance Packs for Symantec Endpoint Protection RU6, I would like to create this thread to make it clear a little bit.

EDIT 9 Dec 2010, 11pm GMT+1: I updated the thread stating which migration path is supported. Many thanks to Sandra G. !

Symantec Endpoint Protecion Manager:

Q: I have SEPM RU5 installed in my environment, can I upgrade it to RU6 MP1 or RU6 MP2 directly?

A: No, in release notes for RU6 MP1 it is written

Symantec Endpoint Protection RU6 MP1 (11.0.6100) provides fixes since the release of RU6 and RU6a. This maintenance patch cannot be installed over any versions of Symantec Endpoint Protection or Symantec Endpoint Protection Manager prior to RU6. It must be installed over RU6 or RU6a.

and for RU6 MP2:

This maintenance patch cannot be installed over any versions of Symantec Endpoint Protection or Symantec Endpoint Protection Manager prior to RU6. It must be installed over RU6, RU6a, or RU6-MP1.

Both MPs must be installed on RU6 or above. Hence, if you've got RU5, you will need to upgrade it first to RU6 or RU6a.

Please mind that this is the migration patch supported by Symantec. Direct migration from RU5 to RU6 MP1 or MP2 will probably work fine. But you do it on your own risk.

Q: But I have upgraded RU5 to RU6 MP1/MP2 directly and nothing happened.

A: See above. If nothing has happened in your environment, it does not mean that for others it is going to be the same. What if you notice that the DB is corrupted only after some time. It is always recommended to follow release notes.

Q: I have a clean machine, with no SEPM installed. Do I have to install RU6/RU6a to install RU6 MP1/RU6 MP1.

A: To my best knowledge no, you can install RU6 MP1 or RU6 MP2 on a machine without SEPM which means that there is no upgrade. I could not find any information that could lead me to a conclusion that it is not supported. Although itis not written in release notes that it is possible, it is not written that it is not either. Please correct me if I am wrong or if you have additional information.

Symantec Endpoint Protection Client:

Q: I have RU5 clients and I have just upgraded my console to RU6a and then to RU6 MP2. Can I upgrade my clients directly to RU6 MP2 or do I need to go through RU6a just like for SEPM?

A: Just like with SEPM, the correct migration patch is RU5 - RU6a - RU6 MP1/2. You can go ahead and upgrade your clients from RU5 directly to RU6 MP1 or RU6 MP2 as the likelihood that the migration will go wrong is much less than for SEPM but direct migration to RU6 MP1/2 is not supported.

this is great ,thanks for sharing.

Symantec Endpoint Protection Client:

Q: I have RU5 clients and I have just upgraded my console to RU6a and then to RU6 MP2. Can I upgrade my clients directly to RU6 MP2 or do I need to go through RU6a just like for SEPM?

A: You can go ahead and upgrade your clients from RU5 directly to RU6 MP1.

Are you sure about your last statement?

Like you wrote yourself:

"This maintenance patch cannot be installed over any versions of  Symantec Endpoint Protection or Symantec Endpoint Protection Manager prior to RU6"

Doesn't this mean that both client and SEPM must be RU6 or higher before upgrade?

Torb

This is something that should be cleared but I had such information. This is to be confirmed however; I will try to get more information and will update accordingly.

You can absolutely do a clean install with RU6 MP2 installation files.  That's why when it's released, it's a full DVD's worth of files and not a just a set of patches.

I think the support statement is pretty clear on migration path.  You may be able to bring your SEP client from RU5 to RU6 MP2 without apparent issue, but if things go sideways, it's not something Support will troubleshoot.

sandra

Yes, even migration of SEPM from RU5 to RU6 MP2 will probably work but will not be supported by TechSupport.

sandra.g - I think you've nailed it down.    The safest route for both the management server and clients is to go from RU5 to the RU6 or RU6a base and then to RU6 MP1/2.

It's twice as much work, but probably the most reliable and, as you point out, supported.

I updated my first comment here.