Installing Symantec AV with Group Policy

[MrMMills]

I've been toying with Group Policy and just did this recently. I hope someone else can benefit:

I used this:

Installing Symantec AntiVirus 10.x using a Group Policy Object (GPO) installation
http://service1.symantec.com/SUPPORT...1?OpenDocument

in conjunction with a portion of info from this:

How to deploy Symantec AntiVirus clients into an existing client group
http://service1.symantec.com/SUPPORT...ent&seg=hm

Now anytime a computer is added to a Department "Computer OU" the Computer GP automatically adds (assigns) the Symantec AV
software to that Computer. Also the AntiVirus install is set to put that computer in the the proper Symantec
"Client Group" under the Symantec Primary Server.

No more manual deployments! I created one GP for each department (each department has their own OU) so that the proper GRC.DAT file gets installed on the user pc, as well as, the Computer automatically being added to the correct "Group" column under the Symantec System Center Console.

[PreviousPoster]

Installing Symantec AntiVirus 10.x using a Group Policy Object (GPO) installation
http://service1.symantec.com/SUPPORT/ent-security.nsf/0/b22b7e79bcb5bb9488257031006764a1?OpenDocument

This link has changed to
http://entsupport.symantec.com/docs/n2005070111491948

How to deploy Symantec AntiVirus clients into an existing client group
http://service1.symantec.com/SUPPORT/ent-security.nsf/0/648d7a63d41afb6e882570d00079500b?OpenDocument& seg=hm

This link has changed to
http://entsupport.symantec.com/docs/n2005120714050448

[MrMMills]

Hey CoolMarty, thanks for updating the links from my original post. I hope my notes from last year helped you.

I haven't modified my setup yet for Vista clients. It seems as Symantec AV CE 10.1 is meant only for WinXP and below, while Symantec AV CE 10.2 is meant for only Vista (last time I checked).

I've had some issues getting the web based install of SAV CE working from the web page onto a Vista client - I haven't had time to look into it but my first thought is that I will need one page for XP clients (SAV CE 10.1) and one page for Vista Clients (SAV CE 10.2)

I'm guessing I will have to put a WMI filter on the Policy to make sure that the correct version gets pushed down to the correct client.

I'm curious to hear about how your AV deployment with GP went, and if Vista added any hoops to the deployment process. Were those two KB articles enough, or is there more to it now with Vista?

[jdobiash]

So far my best bet for dealing with seperate Vista packages is to create a Group which only has Vista Computer objects in it. This way I can assign a GPO to only be deployed to those Vista machines and then I also made sure the GPO for the XP version wouldn't be applied to them by denying that Group the Apply right. I've done this with our Symantec AV package and it appears to work pretty well so far.

[PreviousPoster]

I am loading Symantec Mobile Security suite but the MSI installer keeps failing. This happens when I load the plug-ins or the SSC for Mobile. Any ideas on it. I am think it is in the GP/Local Security Policy.