Deploying System Center 2012 Endpoint Protection

[kaphc]

Having just discovered that as a school we are licensed to use System Center 2012 under the terms of our EES, we would like to deploy it (it'll save us about £500 a year so well worth it). It's a small primary school with about 150 kids and about 116workstations.

 

I'm now trying to work out what we will need to do to move from Symantec Endpoint Protection onto the System Center 2012Endpoint Protection. I know there are lots of guides out there but what I'm not clear on is this: Which software sits on the server to control all the clients? Is it System Center Configuration Manager I need to install or System Center Services Manager?

 

We will be running this on a Windows Server 2008 R2 and it's the sole server so I don't have a test environment and need to get this right first time! It has SQL Server 2005 already installed - will this need to be upgraded and if so will this be done as part of the System Center install or do I need to look into this separately?

 

Finally I'm thinking that we will need to deploy SCEP and then uninstall Symantec EP so that we have continued A/V coverage. Does that sound like a sensible order to do this in?

 

Thanks in advance to anyone who can help me figure this out!

[mrbios]

EDIT: removed what i put here originally, i was wrong: you can deploy endpoint protection standalone without the need for SCCM. I'd say SCCM is overkill for the amount of PCs you're talking here though, but if you feel it's worth it then by all means....

 

SCSM you don't need, that's like an organisational central management system, separate to what you're after.

Edited May 9, 2013 by mrbios

[ConradJones]

I would use SCCM (At that price) for 10 workstations, just to automate the build process if nothing else.

[kaphc]

Sorry, just to clarify as I didn't leave a space in the right place in my original post ... there's 116 workstations (90 of them netbooks).

 

If I deploy SCEP standalone is there any way of managing it centrally from the server to check for version installs, run reports of at risk computers etc? (Like Symantec Endpoint Protection Manager)?

[Modey]

There did used to be this the FEP 2012 client :- http://lms.truesec.se/

 

Not sure how up to date it is though or if it supports the new 2012 client.

[MartinT]

I'd go with SCCM. It's what I'm doing right now and I'll save about £1,000 per annum on AVG licencing for 160 workstations/laptops.

 

I have a time limit: I must get it going and fully deployed by the end of the month in order to cut-over from the expiring AVG.

[RabbieBurns]

Ive gone with SCCM and Endpoint protection, and Im going to hijack your thread if I may

 

Im looking to create a container which will show which computers dont have the SCEP installed. Using this page Subselect queries the easy way - Jeff Gilbert's Web blog at myITforum.com I have created the following:

 

select SMS_R_SYSTEM.ResourceID,SMS_R_SYSTEM.ResourceType,SMS_R_SYSTEM.Name,SMS_R_SYSTEM.SMSUniqueIdentifier,SMS_R_SYSTEM.ResourceDomainORWorkgroup,SMS_R_SYSTEM.Client from SMS_R_System where SMS_R_System.ResourceId not in (select SMS_R_System.ResourceId from SMS_R_System inner join SMS_G_System_ADD_REMOVE_PROGRAMS on SMS_G_System_ADD_REMOVE_PROGRAMS.ResourceID = SMS_R_System.ResourceId where SMS_G_System_ADD_REMOVE_PROGRAMS.DisplayName = "System Center 2012 Endpoint Protection")

 

But it doesn't seem to work; what bit have I done wrong please

[forrager]

We are using SCCM 2012 and under monitoring > endpoint protection > lower right hand pane there is a link which will take you directly to a list of clients which do not report as having FEP installed/functioning.

[RabbieBurns]

well that's just a tad easier than what I was attempting. Thanks