Need to decide between - Norton AntiVirus Corporate Edition or Trend Micro OfficeScan Client/Server Edition

McAfee Consumer - System hog.  McAfee Enterprise - not so much.  Again, Sophos and McAfee would be my shortlist (Sophos updates come out faster and more frequently than just about anyone).

10.1 broken? Contact symantec for a new build. 10.1 for me has worked flawless.

PLUS!! No one mentioned McAfee's recent catastrophe with the faulty .dat file that deleted all .dll and .exe files!

Every vendor has hiccups once in awhile, you just tend to hear about the bigger vendors mistakes than the others. Not to mention most larger networks I have seen/worked for have use the the giants (symantec & mcafee).

PS: If you tell Trend that you are "thinking" of switching...that you currently use norton...they may authorize a discount as a "competitive sale".

Don't be afraid to haggle.

McAfee is the same way...they will discount if you make it clear that it is a competitive purchase.

bigjimbo:
You're talking about the "4715" fiasco.
We were lucky because of the timing of our downloads and scan.
McAfee had 4715 down and 4716 up before we did our nightly pull.
Real glad I didn't have to explain that one to the boss.

To their credit, McAfee had the fix posted in about 3-4 hours.

I remember checking around with some of my buds and no one else got hit with it either. I wonder how big of a problem it actually was.

Regards,
Vic

Let me clarify the broken install comment. I was referring to the vp_log32.exe not working, not the setup.exe.

Anyway, for those of you who hate Symantec products, I can only say that for the last 9 years I have never had a significant problem with the enterprise edition. I haven't seen any problems with computers slowing down, software compatibility, or bugs for that matter. Any questions I've had to call support about, were dealt with in short order.
So ignore the Symantec nah-sayers, it's a good, solid AV package for the enterprise.
However, there is always room for improvement...mostly in the management console area, IMHO.

SunBow sums it up well, go with what you know, and/or a product with features that fits your environment.
I'll add to that initial costs and renewal costs, as well as extra's like an Exchange client.

The only product that I had an issue with was F-Secure, and only on workstations with multiple user profiles. Any user other than the one used to install the client had a pop-up open up when logging on. Same thing happens on my home PC. I never did get that resolved before moving on with the next AV package to test.

younghv,

you guys are lucky...my last org was hit really bad. over 60 servers were crippled, over 5k users affected...thankfully it happened over a weekend.


all i can say was that I was HAPPPPPPPPPYYYY to not have been in their shoes ( i had taken another job a few months before this happened )


====

all trash talk aside.. ford > chevy > dodge > and so on!

contact vendors, get pricing...test...test...test (if time permits) go with what you liek the best...arguing which vendor is better will go on for years......

management likes to hear ESTABLISHED names...(why its been hard for me to get NOD32 approved into a test bed) so getting approval maybe easier as most everyone has heard of either McAfee or Norton (symantec)

One of the most critical things an AV vendor can do is provide TIMELY updates.  Getting the updates 2 days after a MAJOR virus hits is NOT acceptable to me.  Symantec, in my experience and based on information I read some time ago, is FREQUENTLY late in providing virus definitions for cleaning systems.  In one PERSONAL experience, a few years back when a couple of MAJOR viruses hit McAfee had updates in hours - but a Symantec protected network was infected and while symantec released "Beta" definitions AND a MANUAL tool to clean the infection, the FINAL definitions weren't available for two days - Anyone in charge of an enterprise network should be more than dismayed by this pathetic response by a supposedly capable company like symantec.

Sophos - a company of 1000 or so people consistantly puts out definition updates faster than ANYONE else - AND more frequently.  McAfee is typically second best.  Symantec is typically last.  And everyone else is sandwiched in between.

And a note on Trend - their Exchange product appears to have issues dealing with ESMTP mail - a Sys Admin I'm acquainted with has expressed his problems with Trend and this and Trend has not had an answer.

SlyDog > SunBow sums it up well, go with what you know, and/or a product with features that fits your environment.

:-))

> Any questions I've had to call support about

The few I had were done well. Although not as timely, I may have been paving the way for a few others to follow. For the newer stuff. For the day to day stuff they fairly well had the answers ready by the time I'd call.

leew > Sophos - consistantly puts out definition updates faster than ANYONE else - AND more frequently

Possibly they are first to get virus. Most of the companies all share well with each other.

An important issue is for compatibility testing. Will the A/V provider test? How well! Will you or I test it first, to ensure it is compatible with out environment? Or will you simply deploy it ASAP and go home thinking you resolved something yourself.

bigjimbo813 > ...test...test...test .. go with what you liek the best

:-))     ditto

Yes, most companies will share with each other - they share samples, NOT definitions/cleaning instructions - that's up to the vendor to develop.  Sophos shares with roughly 20 other companies.  But follow a timeline and tell me which you would prefer:

let's say the "sharing" is automated and takes place at midnight each night, Eastern Time.  
At 6am a new virus is caught by sophos.
by noon, they have determined how to clean it and issue a definition file for it.
By 12:15, in theory, all your computers could be protected.
If other vendors don't catch the same virus that day, they get the sample the next day at midnight.
Now it takes them 9 hours or more to go through all the viruses they get during that transfer and don't have a fix for it until 3PM the next day.  Now they may not even issue a new definition file for another day or more.  

Which would you rather - be protected 6 hours after discovery or two+ days?

Thanks for ALL the input!