I am running SEPM 12.1.4013.4013 on Windows Server 2008 R2 Enterprise on a 50/10mb connection. I have 75 clients that are disbursed throughout 13 different locations which are all on a 1.5mb or 3mb connection (T1 or Dual T1).
The issue I am having is with what I can only assume are the LiveUpdates. All of my clients seem to be constantly pulling data from the SEPM Server, which is killing the bandwidth on both the server end, and all of my remote connections. Looking at the Resource Monitor on the server, shown below, it shows that the httpd.exe process (located at: C:\Program Files (x86)\Symantec\Symantec Endpoint Protection Manager\apache\bin) has dozens of connections open (one for pretty much each of my Clients) where it is sending data to each one at the rate of 30K/s. Now I know 30K/s is not alot, however when you multiply that by 75 it adds up quickly.
Looking around at the Policies that I have in place, I am unable to see any option where I can force the Client to update using Symantec's LiveUpdate Servers. And quite honestly, I have no idea if that is even possible. If it is possible, how would one go about it?
I have the LiveUpdate Policy configured to update Daily, starting at 9:55PM. However, it is now 9:00AM (11 hours later) and it is STILL going, and causing my network latency to skyrocket.
Is there anything that I can do to help prevent this from happening? Updating from a LiveUpdate Server that is not in-house would be best, as it would be faster overall, and would cause less network usage on the SEPM server itself.
Any thoughts?
---------
Jason M. Hecker
Director of Information Technology
Great Lakes Dermatology
jhecker@glderm.com