Upgrade to SEP 12.1.4 from 11.x

Posted on 2014-03-16
Last Modified: 2014-03-26

Just putting together a plan for upgrading our Symantec Endpoint Protection v12.1.4 from 11.x and wondering when/how do we upgrade our client install package we've created?  These are the different package we created for our desktops,  64_bit servers and 32_bit_servers. They're stored on another volume from the main SEP install in the mgmt server and I can't find mention how packages are upgraded.

Also, can someone confirm that exclusions we've set on individual servers are kept post pushing out the upgrade from mgmt server

Question by:kswan_expert
LVL 76

Expert Comment

ID: 39934075
You can upgrade using the SEP management console, under the group structure, replace the existing SEP install packages (the three client packages that are added when SEP 12.x are installed) with the new version.  During the addition of the new package, make sure your options are to use the same settings that exist on the client.  Then you have the option to deal with the scheduling of the install as well as the notification process to the user when an update is about to be performed.

The client when checking with the SEP central system/s will over the period of the scheduled upgrade download the.
These require managed clients.

The other option is to use GPO to push the packages, you would however had to have  used the .msi rather than the .exe package type.
LVL 90

Expert Comment

by:John Hurst
ID: 39934089
I had been running V12.1.4 quite well on both Windows 7 and Windows 8.1. I have not worked out exactly why, but the upgrade to V12.1.4a required uninstalling V12.1.4 after a failed upgrade.

So you might consider uninstalling v11 on your server and then installing V12.1.4a. Then try try pushing that out to a few clients and make sure it works. That will guide your later strategy and steps.
LVL 76

Accepted Solution

arnold earned 250 total points
ID: 39934108
You do not need to uninstall v11 (went through this process), you need to make sure to get the v11 to the 11.07MP4a 11.0.7400.1398.  This will update the DB to a point that the sepv12.1.4a can upgrade without uninstall.

The only annoying thing is that the sepv12 checks and periodically detects some "change in system (application install/some update/...." at which point you can go no further.  You would need to reboot the system onto which you want to install the management portion until it is "clear" for the update to go through.
LVL 61

Assisted Solution

btan earned 250 total points
ID: 39934202
understand that Symantec sends you client installation package updates, and then you add them to the Symantec Endpoint Protection database to distribute them from the SEPM. In your case, you export the packages from the client and note that it should have an installation package (that you can import later) consists of two files. One file is named product_name.dat, and the other file is named

When you export packages, you must browse to a directory to contain the exported packages. That folder should have the files needed, note that the export process creates descriptively named subdirectories in this directory and places the installation files in these subdirectories.

These is an overview for handling the client upgrade.

Next for the upgrade via autoupgrade (which is recommended), there is caution note and besides that I see the rule set and exception should be ported over as well as included in the installation package files. Due to possible bandwidth concerns, it is best to schedule AutoUpgrade for after hours.

Enterprise versions of SEP 11.0.x or 12.1.x cannot be upgraded to the Small Business Edition of 12.1.x.

If you upgrade from 11.x and use Application and Device Control, you must disable the Application Control rule "Protect client files and registry keys." After the clients receive the new policy, you may upgrade using AutoUpgrade.

As a whole, when you upgrade a client, the "overinstall" automatically detects the client, and upgrades and installs it appropriately. You do not need to uninstall existing clients before you install the new version.
What Security Threats Are You Missing?

Enhance your security with threat intelligence from the web. Get trending threat insights on hackers, exploits, and suspicious IP addresses delivered to your inbox with our free Cyber Daily.

LVL 61

Expert Comment

ID: 39934217

Author Comment

ID: 39935668
Thanks for the answers guys, appreciate it.

Arnold - we're on version 11.0.5002.333 and i'd not read that we need to upgrade to 11.07MP4a.   In the upgrade guides it states you can upgrade seamlessly from 11.x. Can you expand on this or post a link?

LVL 76

Expert Comment

ID: 39935792
I was keeping and was at a level where it was an issue.
the setup also uses ms sql as the backend.

Out of abundance of caution when possible, bring the version as close to current before going to new major version.

When you run the installer, it will validate and will let you know if it can not proceed.
LVL 61

Expert Comment

ID: 39935798
in case this help, I saw the migration paths for Symantec Endpoint Protection Manager (SEPM) 11.x to Symantec Endpoint Protection 12.1 enterprise edition here

e.g. Supported 11.0.5002.333 (RU5) -> 12.1.671.4971 (RTM) or higher

also for latest upgrade e.g. 12.1.4a  you should already know this link

Featured Post

How to run any project with ease

Manage projects of all sizes how you want. Great for personal to-do lists, project milestones, team priorities and launch plans.
- Combine task lists, docs, spreadsheets, and chat in one
- View and edit from mobile/offline
- Cut down on emails

Join & Write a Comment

Suggested Solutions

Title # Comments Views Activity
Can locky virus be transmitted by USB key ? 5 65
Virus clean 26 123 and McAfee 3 71
VMware Black Screen 13 31
UPDATE - 6/15/2011 Added support for Release Update 6 Maintenance Patch 2 Point Patch 1 (RU6 MP2 PP1). Fixed a defect in the username field that was hard-coded to look for a specific domain (left over code from testing). This release will be the …
For those of you actively in the Malware fightling business, we now have available an amazing new tool in the malware wars (first recommended to me by rpggamergirl (, the Zone Advisor for the Virus and …
Sending a Secure fax is easy with eFax Corporate ( First, Just open a new email message.  In the To field, type your recipient's fax number You can even send a secure international fax — just include t…
When you create an app prototype with Adobe XD, you can insert system screens -- sharing or Control Center, for example -- with just a few clicks. This video shows you how. You can take the full course on Experts Exchange at

743 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question

Need Help in Real-Time?

Connect with top rated Experts

11 Experts available now in Live!

Get 1:1 Help Now