Ok, so I sat down yesterday and started migrating my network and clients over to the new Symantec Corporate Anti-Virus v10 package and ran into an interesting dilemma. If you want to skip my enlightening path to discovery and just get to the solution then scroll down to the Solution header otherwise read on.
Right off the bat I must warn you DO NOT INSTALL the v10 server anti-virus over a terminal server remote desktop connection!! I can’t stress this enough. If you install the server version, or do an in place upgrade of your v9 server install over a terminal server remote desktop it will not function correctly. The new v10 software uses self issued PKI certificates to secure server-to-server comms, among other things I’m sure, and they will not generate correctly if installed from anywhere but the console. Save yourself the headache, install the server software on-site, at the console, and not via RDP! If you do fall into this trap follow the “Rebuild the PKI folder structure” section of the Symantec KB article Symantec Anti-Virus server shows "Disabled" in the Symantec System Center after migration.
Ok, with the server gotcha’s out of the way I sat down at my first PC and started installing the new v10 package. All looked well until it started to install the LiveUpdate package. Here’s where it got interesting. The install process just, well… went out for lunch. The process didn’t hang or even consume large amounts of overhead, it just sat at the Installing LiveUpdate screen…. FOREVER! So…
My next thought was instead of installing the client from the server’s CLT-INST/WIN32 directory to try and install the client from the original CD. Now, for those of you who don’t know the CLT-INST directory is in the VPHOME share of the server computer and has all the proper GRC.dat files etc. needed for a seamless network install. It is easier to install from this directory, it’s the same files used for the “push” auto install you can initiate from the Symantec Console. You can also install from the original CD and just specify the server and group you want the client to be a member of. Of course this is not an option for large installs… I’m just laying out my train of thought. Anyway, it produced the same result but if you are reading this… you already know that.
—Solution—
Ok, you’re probably getting tired of my trek so I’ll bring it all together for you. If you run ISA Server 2004 (pre-SP1) and the proxy client is installed on the client’s workstation the Symantec install will halt at Installing LiveUpdate. If you uninstall the proxy client the Symantec install will succeed. Of course, who wants to uninstall the proxy client, install Symantec Corp v10 then go back and install the proxy client again. Luckily, you don’t have to.
The secret here is ISA Server 2004 SP1. If your ISA 2004 server is not running SP1 then shame on you!! Since ISA Server 2004 requires Windows Server 2003 and ISA Server 2004 SP1 is required prior to installing Windows Server 2003 SP1 that means you aren’t patching your servers! Bad admin, bad bad. Anyway, I digress so please excuse me, even if you installed SP1 on your ISA box you might have forgotten to push out the new proxy client to the workstations. Here’s how you tell. Open the Firewall Client on a workstation and click the help button in the bottom right corner. If you see this:
Then you are running the pre-SP1 proxy client and the Symantec v10 install will hang. Push out the new SP1 proxy client to your clients, you should have anyway, and the install will complete successfully. You want to see this:
There you have it. One of those days where you are just embarrassed in the end that something so simple kick your ass so hard. Yes, I’m a bad admin because I forgot to push the new proxy client out. I paid for it yesterday. Now, the easiest way to push this new proxy client out is via Group Policy. If you need help with that just post a comment. Oh, and most of you might have already found this but here is Symantec’s KB page listing this problem with no solution. Installation of Symantec Anti-Virus Corporate Edition 10.x stops at “Installing LiveUpdate” when using Microsoft ISA Server proxy Perhaps they’ll read this post. The workaround listed in the article above doesn’t work… why? One there’s not enough information given since an exception requires more than just the process name but as you may well know Google is full of people that have tried this workaround and failed time and time again. Moral? Don’t waste your time, update to SP1 and push out the new proxy client before you install the v10 update of Symantec Corporate Anti-Virus.