After installing Endpoint Protection 15 on a client, it moves automatically to a group syncd from an On-Premises Endpoint Protection Manager
Last Updated April 26, 2019
If a Symantec Endpoint Protection (SEP) 15 client is installed on a device which was previously sync'd to the Cloud portal through a Cloud enrolled Symantec Endpoint Protection Manager (SEPM), it will automatically move to the group it was previously in. This can even happen if the SEP 14.1/14.2 client is uninstalled before deploying SEP 15 to it. Below is a sample sequence of events.
Install On-Premise 14.1/14.2 SEPM and deploy clients to a group called "Test_Group"
Enroll SEPM with the cloud portal and let everything sync
Uninstall the SEP 14.1/14.2 client from the device
In the Cloud portal, deploy a package: Devices -> Installation Package -> Direct Installation package (Default group), then export the package and install
After installation completes, the SEP 15 client will move to the "Test_Group" instead of the Default group
There are two methods to avoid this scenario:
Do an inplace upgrade of the 14.2 client to 15
Delete the device through the SEPM, let the deletion event sync with the Cloud portal, then proceed with the SEP 15 deployment after uninstalling the existing client.
Subscribing will provide email updates when this Article is updated. Login is required to Subscribe