Decommissioning Symantec Endpoint Protection Managers

Products

• Endpoint Protection

Issue/Introduction

A Symantec Endpoint Protection Manager (SEPM) needs to be decommissioned and removed from the environment.  What impact will this have and how can I prevent Symantec Endpoint Protection (SEP) clients from continuing to reach out to this SEPM?

Environment

Release : 14.3.x

Component :

Cause

A SEPM is no longer needed in the environment or is due to be replaced.

Resolution

Things to Consider before proceeding

• The SEPM site will have one less SEPM sharing the load.  If this SEPM was used for load balancing, ensure the remaining SEPMs can handle the load in it's absence.  Consider stopping the services on the target SEPM and monitoring the resource consumption of the remaining SEPMs for a few days before completely removing it.
• If the affected site is replicating with another site and the target SEPM is the first server in the list, removing it will break replication as the first SEPM in the server list is responsible for replication.  Replication will need to be broken and re-established after the SEPMs removal utilizing the new first SEPM in the list.
• Before making major changes to the SEPM site, it's recommended backup the database and follow standard Disaster Recovery procedures.

Decommissioning SEPM

1. Uninstall Symantec Endpoint Protection Manager (If prompted to remove the database, be sure to NOT choose to remove the database unless this is the only SEPM in the site and the intention is to decommission the site).
2. Open the SEPM on another SEPM in the site and navigate to Admin>Servers.  
3. Select the SEPM that was just uninstalled and choose the option to 'Delete Selected Server'.  After the SEPM is removed, that should automatically remove the SEPM from the Default Management Server list.  If custom management server lists are in use, they'll need to be manually updated.  Management Server Lists can be found by navigating to Policies>Policy Components>Management Server Lists.