Best EPO , VirusScan Client Deployment Methods?

[mcse924]

Hi,

I am re-thinking my deployment strategy and am curious as to what other admins are doing our there.

Currently, I create a Ghost image of a machine with all the standard apps needed in our company. I have included VirusScan and EPO client on these images (installed manually, NOT via EPO). However, upon rollout, I noticed communication problems with some, not all, of the desktops rolled out in this manner. Some machines were unable to receive updates of DATs. I noticed in the EPO Server Events Viewer the message "Task enforcment of task....failed". However, this did not happen on all machine rolled out in this manner, only a few.

On the upside, I have been able to remove the EPO Agent and VirusScan on the troublesome machines via EPO, then re-deploy via EPO once the machine is clean. But, I'd rather have the AV software working properly from the get go.

I have since begun testing an alternatative way to deploy VirusScan and the EPO Client Agent via EPO. I use Installation Designer to create a "locked down" install and remove the Mcafee splash screen on startup, I replace the Vscan451.msi on the EPO Server with my customized msi file, then push out an EPO client Agent to a target machine, and enforce an Install VirusScan policy on the target machine. Machines rolled out in this fashion have NEVER had issues with communicating with the EPO server.

My ultimate dilemma is that this process only adds to the total rollout time of each machine. On the one hand, I like EPO, but I did not want to use it as a deployment tool, only an AV management console for our network.
I like a "one image includes all" solution, as it is the fastest and most efficient method to do a rollout.

Any feedback is much appreciated.

THANKS!!

 

[Eyas]

Hi

We use our logon scripts to deploy the agent to the clients. It seems to work just fine. Then the agents reports in we sort them via IP into different groups. The main reason for this solution is that we have a distrubited client responsability and seldom knows when a new client is attached to the network. By using their logonscript (which we control) we can asure that the agent is installed and running. Otherwise it will simply be installed and the client will report in.

The VS software we've choosed to install via the ghost though. The reason for doing this is that it doesn't strain the network as much and that we've found it to be a more reliable installation method.

/Eyas

 

[AVChap]

It would seem that VS doesn't really like to be "pre-installed" in an image file. You can still install it with an image, along with the ePO agent. Just make sure that the ePO server updates VS once it connects back. This is what we do.

HTH, AVChap
... my $1 worth of advise, 2cents isn't enough due to inflation