Should a deployment of Symantec Endpoint Protection (SEP) by Active Directory GPO be Published or Assigned?
 

Symantec does not support installation of SEP by Publishing. Publishing software to a network's users by GPO does not immediately install the software, but adds the option for users to install it upon demand. Publishing an antivirus package like SEP by this method, would leave computers in an unprotected state, until the user actively chooses to install it.. Therefore, in the Deploy Software dialog box of the new package, click Assigned.

For full details on the supported method of installing SEP by Active Directory GPO, see the topic "About installing clients with Active Directory Group Policy Object" in the Symantec™ Endpoint Protection 14 Installation and Administration Guide.