Symantec 8 to 9 - Several Questions 1

[burritonator]

I am in the process of upgrading our antivirus server from Symantec 8 to 9. We have a single antivirus server in our organization, with the Symantec System Center running on the same machine (the OS is NT 4.0). I did a full uninstall of Symantec Antivirus, System Center, and all other related tools from the server before installing version 9. Note that this is my first experience installing and setting up an antivirus server using Symantec products. I was not invloved with the installation and configuration of version 8 when it was installed on this server. Below are my questions about some of the things that I have encountered:

1. When I install the Symantec System Center and start it, a server group is already listed with the same name that it had in the version 8 install, despite the fact that I did a full uninstall of version 8 before installing version 9. Should this happen, and if not, what could be causing it?

2. After I complete the server installation of Antivirus 9 and the needed tools, the name of the server group listed in System Center has changed to the name of the new server group that I created during the install. When I unlock that server group, a second server group immediately appears with the same name except for a "(2)" after it. The first server group has nothing listed below it - the "Groups" folder is empty and no server is listed at all. The second server group contains several entries in the Groups folder (despite the fact that I haven't created any yet). The server itself is also listed, and a large number of the client computers are already listed when I click on the server. Can anyone give me any insight as the why the second server group appears when I unlock the first one, why the first one is empty, and why the second one's Groups folder is already populated when I haven't created any groups yet? (I am wondering if despite doing a full uninstall, there are still some left over files from version 8 that 9 is picking up).

3. Perhaps I made a mistake in doing this, but after the situation described in step 2 occured, I dragged the antivirus server from the second server group to the first, and I deleted all of the Groups from the second server group. I then deleted the second server group itself. Therefore, I was left with the one server group that I created during install, with the server listed beneath it and the Groups folder empty. When I select the NT Client Install option and push the version 9 client to client PCs, the program reports that the clients have received the update successfully. When I go to those client PCs and check them, the following things seem to be true: The version of the Antivirus client on those PCs has been updated to version 9, even if the PC hasn't been rebooted. However, the field that lists the version of the virus definition file is blank. Rebooting doesn't help. However, if I go back to the server, manually select the PC in question, and click the "Update Virus Defs Now" option, the PC does show the latest version of the virus definitions a few minutes later. One oddity that I have noticed is that the information displayed for each PC on the server does not change to reflect the fact that the PC has installed the version 9 client until it has also successfully downloaded the virus definitions. In other words, I can check a client PC and verify that it has version 9 installed, but the server still shows version 8, until I am able to get the PC to download the virus definitions. Then the version is correctly shown on the server as version 9. Is this normal?

4. When I select the "NT Client Install" option to push the version 9 client to the client PCs, I am able to push it to some PCs with no problem. For other PCs, however, I get a message stating "You must log on as Administrator to the Windows NT Workgroup of which the PC is a member". I have tried every username and password combination that I can think of, to no avail. The administrator username and password for the PC are even rejected. What is more confusing is that in some Workgroups, I am able to access some PCs while others in the same workgroup generate the password prompt. Any ideas?

5. As a last resort, on one the PCs that I could not push the update to due to the situation described in question 4 above, I went to the PC and installed the the version 9 client on the client side by accessing the install package in the /VPHOME/Clt-inst/Win32 folder on the server. It installed successfully and downloaded the latest version of the virus definitions. Since I can't access this PC from the server, however, due to the login failure described in question 4, how can I ensure that PCs that fall into this category download the latest virus definitions without having to physically go to each PC and download them manually?

6. Here is another thing that makes me concerned that some information is still being picked up from the uninstalled version 8 when I install version 9 on the server: The list of client PCs that appears when I click on the server in the System Center differs from the list of PCs that appears when I choose the "NT Client Install" option. Some of the PCs appear in both places, while others only appear in one of these two locations. For instance, we have one group of PCs on our network that is in a different subnet than all of the rest of our PCs. Those PCs show up when I click on the server in System Center. They all show having downloaded updated virus definitions yesterday, despite the fact that the server is now running Antivirus 9 and those clients are still running version 8. However, when I select the "NT Client Install" option, those PCs aren't even listed among the PCs that I can push updates to (their Workgroup isn't even listed). Can anyone tell me what is going on there?

7. Of the clients that I can access from the server, many of the ones that I was able to push the version 9 update to give an error when I click them from the server and select the "Update Virus Defs Now" option. The error states a virus definition download could not be started on the PC. What could cause this?

I apologize for being so lengthy, but I wanted to make sure I described my problems with as much detail and accuracy as possible. All help will be greatly appreciated.

Thanks,
Burritonator

 

[Stiddy]

Wow, long post but at least you explained yourself well. Lets see if I can answer some of your questions.

1. I would say that even though you did a full uninstall, the registry settings for all of the groups remained. I my mind this would be a good thing because I would not have to recreate them, or perform a discovery in the tools menu to find all of the servers within the network which are parent servers.

2. I would have most likely deleted group one and renamed group 2 to groups 1's name, know you still have the environment that you say someone else built. Know you can change it to your own config, but atleast your not starting from scratch.

3. ("The version of the Antivirus client on those PCs has been updated to version 9, even if the PC hasn't been rebooted" - they do not need to be rebooted on an upgrade).

(" However, the field that lists the version of the virus definition file is blank. Rebooting doesn't help. However, if I go back to the server, manually select the PC in question, and click the "Update Virus Defs Now" option, the PC does show the latest version of the virus definitions a few minutes later." - I dont know why but I have noticed that to. Maybe symantec changed it that way so endusers wont be calling every other day stating that "My virus definitions are 2 whole days old. HAHA")

("One oddity that I have noticed is that the information displayed for each PC on the server does not change to reflect the fact that the PC has installed the version 9 client until it has also successfully downloaded the virus definitions. In other words, I can check a client PC and verify that it has version 9 installed, but the server still shows version 8, until I am able to get the PC to download the virus definitions. Then the version is correctly shown on the server as version 9. Is this normal?" - In that case I would delete the client from the SSC console. When it contacts the parent server and you do a refresh in the SSC, the client will be populated with the updated info. By deleting a client in the SSC, you are not removing antivirus from the client itself, rather just removing it from the SSC.)

4. ("When I select the "NT Client Install" option to push the version 9 client to the client PCs, I am able to push it to some PCs with no problem. For other PCs, however, I get a message stating "You must log on as Administrator to the Windows NT Workgroup of which the PC is a member". - I would make sure that the default shares like admin$, ipc$, c$, etc. are shared on those particluar machines. Also, make sure you really do have administrative access. I have seen users remove domain admin from their local admin group thinking they are slick.)

5. If you can see the pc in the SSC as a client to a parent server, then it will get the updates from the parent server. Symantec has some way of bypassing typical rights with NT, AD, etc. and continue to push virus definition files to clients.

6. ("Can anyone tell me what is going on there?" - Again, I would make sure that admin$ is shared on those machines. Thats all I can think without doing more research.)

7. ("What could cause this? - I dont even have the option to 'Update Virus Defs Now' on clients, only on antivirus servers.")


Additional info:

http://www.symantec.com/techsupp/enterprise/select_product_kb.html

HTH - Stiddy

 

[burritonator]

As it turns out, I found some instructions on Symantec's website for manually uninstalling Antivirus 8 and 9 from a server. After I finished the manual uninstall and reinstalled the SSC, no server groups showed up. After completing the install of Antivirus 9, only the new server group that I created during the install was present. Additionally, the groups folder was empty, and the client list in the SSC was not populated. The server is now going through a discovery process and is locating the clients throughout the network, as the list of clients shown in the SSC is slowly growing.

Apparently, the problems that I was having were due to some of the old configuration from Antivirus 8 still being picked up when I installed 9, despite the fact that I had uninstalled 8 first. Once I was able to fully remove all traces of 8 by doing the manual uninstall and perform a true clean install of 9, everything seems fine (so far

Thanks,
Burritonator

 

[Stiddy]

I am still going to be curious about the problem you had with some of your clients not showing up within NT CLient Install. Keep me posted as to the results after the SSC finishes dicovering your clients.