Connecting Mac computers to Symantec EndPoint Management

Our department was working with some mac computers and a program called Lansweeper which allows us to do inventory of the computer's software and hardware. We discovered that the Symantec client on mac was blocking the scan. It thought it was a port scan. Before doing the following steps we needed to adjust the Intrusion Prevention Settings on the Sep Management Console.

Open up SEP Management Console

To create an exception for IPS signatures

1. If you go to Policies and then click on "Intrusion Prevention", you'll see the current default policy.
2. Double Click that name
3. On the left under "overview" you'll see an intrusion prevention text, click that.
4. Click on Excluded Hosts
   
5. Add the Host Name or IP of the Lansweeper Server and click ok and then ok a second time.

Export the package zip file(app)

1. In the console, on the Home page, in the Common Tasks menu, click Install protection client to computers.
2. In the Client Deployment Wizard, click New Package Deployment to configure a new installation package, and then click Next.
3. Click the Install Packages menu and select the Mac package from the available options. Click on Browse and pick your mac group if you have one. Then click Next.
4. Click Save Package for the installation method, and then click Next.
5. Click Browse… to specify the folder where you want to save the package, and then click Next.
6. On the final summary page, click Next to create the package.

Using the App to create a Package File

1. After the package creation completes, browse to the location you previously specified, and then copy the .zip file to the Mac on which your Apple Remote Desktop is installed. By default, the file name is Symantec Endpoint Protection.zip.
2. Right-click on the .zip file and click Open With > Archive Utility to decompress the .zip file.
3. Double-Click Symantec Endpoint Protection Installer to launch the application.
4. Click Continue in the warning message to acknowledge that a system restart is required after install.
5. In the menu, click Tools > Create remote deployment package. Accept the default package, and then click save.
6. When the package creation completes successfully, click OK. The file name is SEPRemote.pkg.

Deploying the Package File

1. Open Apple Remote Desktop
2. Select the target Macs from the list of all available computers, and then click Install to add the package. 
3. Click the plus (+) to locate and add SEPRemote.pkg, click Attempt restart, allow users to save documents and then click Install to begin deployment.

Symantec 12 Virus Definitions not updating

Problem: Symantec Antivirus on one of the servers I run was not updating it's antivirus definitions.

I would be able to install Symantec and then it would be updating antivirus definitions for 2 weeks and it would continue to update the Network Threat Protection definitions past those 2 weeks.

I thought something could have been corrupted or some miscommunication was occurring between the antivirus and the Symantec EndPoint Protection Server, so I did a clean wipe(removing all Symantec files). I then reinstalled thinking my issues were gone.

After about 2 weeks, it started not having the antivirus updates again, so I was then looking around to see if some certificate was messed up. I would try to run the live update but it said it was downloading but then it did not install the Latest Definition.

Solution: I ended up making a support call to Symantec and a friendly support tech helped me and it was solved in about 3 minutes. He went into the C:\ProgramData\Symantec\Symantec Endpoint Protection\CurrentVersion\Data\Definitions\VirusDefs folder confirmed that the definitions were there. Then we started Task Manager, went to details and ended the ccsvchst.exe task being run by SYSTEM. We then closed this and went back into Symantec and it was updated.

Reason: Apparently, the issue was that some update was waiting for a reboot but since this was a server and it was a non-security patch it could wait, I didn't reboot. I'm not sure why the Symantec program didn't say "cannot update due to pending reboot".