search cancel

Difference between a SEP GUP v/s LiveUpdate Administrator


Article ID: 157180


Updated On:


Endpoint Protection


What is the difference between the Symantec Endpoint Protection (SEP) Group Update Provider (GUP) and LiveUpdate Administrator (LUA)?


Which update architecture is best for your environment?



Group Update Provider v/s Liveupdate Administrator




Extra software and potentially hardware needed.



Average daily network transfer from remote sites

10 mb +/-

100mb +/- (600mb+ once per month)

Max daily network transfer from remote sites

100 mb +/-

100mb +/- (600mb+ once per month)

Distribute product updates/patches


Yes (if made available)

Content update : Remote site from update server

Pull from remote (on demand)

Push from LUA, then pull (scheduled)

Supported clients per distribution point

10,000 (higher possible with higher spec)

Unlimited (in theory)

Bandwidth throttling : Remote site to



No (not for FTP, only for HTTP)

Operating system per distribution point

Windows System


Resilience to WAN network issues



Client to distribution point roaming and load balancing



Provide incremental updates for out of date clients

Yes (period configurable but typically 2--‐4 weeks)

Yes (up to 1 year out of date)


Note: The difference between a GUP and LUA 2.x. The GUP will only retrieve content as it is requested, and will retrieve it from the Symantec Endpoint Protection Manager (SEPM).
This means that it will always retrieve the smallest and most efficient package possible. It will not download any unnecessary content. An LUA is designed to apply updates generally to a mixed environment. It will update itself on a schedule, and will download all content available at that time. An LUA downloading 32-bit and 64-bit windows definitions only may download 4-6 GB of data per month. The equivalent GUP is likely to download less than 500 MB.

Any SEP client on a Windows system can become a GUP. The system to be used would be determined by the architecture, client count the GUP would service, etc.

LiveUpdate Administrator requires a Windows server for the application. A built in test/production web sites for content distribution could be used or any other web server on Windows/Linux/UNIX could be configured within LUA.

A GUP is a SEP client configured to become a surrogate content distribution point to the SEPM. It accomplishes this by storing local copies of deltas requested by clients talking to it. It does not actually create deltas, rather it proxies the request on behalf of a client and asks the SEPM for the delta/full content. It retains these files to provide to other clients thereby reducing the content processing load on the SEPM(s). It also provide granular bandwidth throttling capabilities which perhaps speak to one of its main use cases.

LiveUpdate Administrator is a full application that runs on Microsoft IIS. It automates the download and distribution of security and client updates to it's own distribution web sites, or any other web server chosen to configure. It can provide content updates for non Windows SEP clients (e.g. SAVFL, SEP for Mac, SMSMSE, etc). 

Applies To

Symantec Endpoint Protection 11.x and 12.1

LiveUpdate Administrator