For most organizations, the upgrade from SEP 14.2 to 14.3 is low-risk if you follow a phased rollout:
The performance gains and improved Linux support alone justify the move. Just ensure your legacy OSes are either upgraded or placed in a separate group with a 14.2 client lock.
Have you encountered issues during your SEP 14.3 upgrade? Share your experience in the comments below.
Ready to upgrade? Download SEP 14.3 from the Broadcom Support Portal (login required).
This is arguably the most significant change in 14.3.
If your administrators access SEPM via a remote console installation:
Export the 14.3 Windows client MSI from the SEPM:
Admin > Install Packages > Export Client Install Package
Deploy via your software distribution tool.
Failure to prepare is preparing for a failed upgrade. Complete these steps before touching your SEPM.
| Task | Tool/Command |
|------|---------------|
| Full database backup | sepbackup.exe or native SQL backup |
| Full SEPM backup (including server config and Sylink.xml) | SEPM > Admin > Backup Server |
| Verify system requirements (Java 8 update 171+ required) | java -version |
| Check disk space (minimum 10 GB free for logs & upgrade temp files) | fsutil or Explorer |
| Disable real-time AV scanning on the SEPM server (excluding Symantec folders) | Group Policy or local AV |
Upgrading from Symantec Endpoint Protection (SEP) 14.2 to 14.3 is a significant transition that introduces enhanced security features, including improved behavioral protection and Antimalware Scan Interface (AMSI) integration 🛡️ Pre-Upgrade Requirements
Before initiating the upgrade, ensure your environment meets the minimum standards to prevent installation failures.
Back up the Symantec Endpoint Protection Manager (SEPM) database and the Server Private Key Disk Space: SEPM requires at least
of free space (100 GB recommended). If using a local database, is required. Operating System: SEP 14.3 RU6 and later discontinued support for 32-bit
operating systems; ensure your servers and clients are 64-bit or remain on 14.3 RU5 for 32-bit needs. Prerequisites: Windows Server 2012 R2 requires the Visual C++ 2017 redistributable 🚀 Upgrade Procedure
Follow this sequence to ensure a smooth transition across your infrastructure. 1. Upgrade the Manager (SEPM) Always upgrade the management server before the clients. Disable Replication:
If you have multiple sites, cancel replication before starting. Stop Services:
Manually stop the SEPM services (Manager, API, and Web Server) to prevent file locking. Run Installer:
Execute the 14.3 setup file as an administrator. The Management Server Configuration Wizard will automatically update the database schema. 2. Upgrade the Clients
Once the manager is stable, roll out the updated packages to your endpoints. Symantec ™ Endpoint Protection 14.3 Release Notes symantec endpoint protection upgrade 14.2 to 14.3
Smooth Transition: Upgrading Symantec Endpoint Protection (SEP) 14.2 to 14.3
Upgrading your security infrastructure can be daunting, but moving from Symantec Endpoint Protection (SEP) 14.2 to the 14.3 release is a significant step toward modernizing your defense. Version 14.3 introduces critical enhancements like Antimalware Scan Interface (AMSI) integration and support for newer operating systems like Windows Server 2022 and SQL Server 2019.
Here is a streamlined guide to ensure your upgrade is successful and your endpoints remain protected. Why Upgrade to 14.3?
Before diving into the "how," here’s why the "why" matters:
AMSI Support: Protection against dynamic script-based malware (PowerShell, JavaScript).
Broader OS Support: Full compatibility with newer Windows 10/11 builds and Linux distributions like Ubuntu 18.04 and RHEL 8.
Infrastructure Improvements: The management server (SEPM) now supports Java 11, improving performance and security for the console. Pre-Upgrade Checklist
Don't hit "Install" just yet. Follow these Best Practices to avoid common pitfalls:
Backup Everything: Perform a full VM snapshot and use the SEPM database backup tool located in the %Symantec%...\\data\\backup folder.
Stop Replication: If you have multiple SEPM sites, cancel replication before starting the upgrade.
Check Requirements: Ensure your server has the Visual C++ 2017 redistributable (a prerequisite for 14.3) and enough disk space for the new database schema.
Pause Services: Manually stop the three main SEPM services (Manager, API Service, and Web Server) and any syslog services that might lock files. Step-by-Step Upgrade Process 1. Upgrade the Management Server (SEPM)
Download the 14.3 package from the Broadcom TechDocs portal.
Run the setup as an Administrator. The wizard will handle the database schema migration automatically.
Tip: Skip the "LiveUpdate" during installation to save time; you can run it once the console is back up. 2. Re-enable Services and Replication
Once the installer finishes, the management services should start automatically. Log in to the console to verify the version has updated, then re-enable any replication partners you paused earlier.
Upgrading from Symantec Endpoint Protection (SEP) 14.2 to 14.3 is a significant jump that introduces architectural changes, such as the transition from an embedded database to Microsoft SQL Server Express. 1. Pre-Upgrade Checklist
Before starting, ensure your environment meets the new requirements:
System Requirements: The Symantec Endpoint Protection Manager (SEPM) now requires a minimum of 2 CPU cores (4 recommended) and at least 512MB RAM (4GB recommended). For most organizations, the upgrade from SEP 14
Disk Space: Ensure at least 15 GB of free space on the system drive and 25 GB on the installation drive.
Database: SEP 14.3 automatically upgrades the legacy embedded database to SQL Server Express. If you use a remote SQL server, verify it is version 2014 or later.
Backups: Use the Database Backup and Restore utility to create a full backup and save your disaster recovery file (typically in C:\Program Files (x86)\Symantec\Symantec Endpoint Protection Manager\Server Private Key Backup). 2. Upgrade the Management Server (SEPM) Always upgrade the SEPM before the clients.
Stop Replication: If you have multiple sites, stop replication by right-clicking the site in the SEPM console and selecting Cancel Replication.
Stop Services: Manually stop the Symantec Endpoint Protection Manager and Symantec Management Client services.
Run Installer: Execute Setup.exe from the 14.3 installation media. The Management Server Configuration Wizard will run automatically after installation to migrate your database.
Verify: Log into the SEPM console and confirm the version has updated to 14.3. 3. Upgrade the SEP Clients Once the SEPM is stable, roll out the 14.3 agents:
The fluorescent lights of the server room hummed a low, steady B-flat, a sound that usually soothed Elias. But tonight, it felt like a countdown. Propped up by a lukewarm cup of coffee, Elias sat before his dual-monitor throne, the blue glow reflecting off his glasses. On the left screen: the Symantec Endpoint Protection Manager (SEPM)
console, currently ruling over his kingdom of three thousand workstations at version . On the right: the downloaded
installation package, waiting like a silent invitation to chaos.
"It’s just a minor jump," he whispered to the empty room. But in the world of enterprise security, there is no such thing as "just" a jump. Elias began with the database backup
. He watched the progress bar crawl, knowing that if the schema conversion failed mid-upgrade, this file would be his only tether to a functioning network. Once the safety net was tucked away, he launched the installer.
The wizard greeted him with a polite, "Welcome." Elias clicked 'Next' with the grim determination of a soldier crossing a bridge he intended to blow up behind him. He watched the Management Server Configuration Wizard
take over. It began stopping services—one by one, the heartbeats of the network’s defense went flat. Reporting Service: Stopped. Management Server: Stopped.
Minutes felt like hours. The "Upgrading Database" bar appeared. This was the gauntlet. Version 14.3 brought a leaner architecture and better integration with the Cloud console
, but it had to rewrite the old 14.2 rules to do it. The disk activity lights on the rack across from him flickered frantically, a rhythmic blinking that looked like Morse code for 'I hope you checked the system requirements.' Suddenly, the bar surged to 100%.
Elias didn't celebrate yet. He logged back into the console. The interface was familiar, yet sharper. Now came the real test: the Client Deployment . He created a new Auto-Upgrade
group, moving a handful of "sacrificial" test machines from 14.2 to the new 14.3 package. He monitored the logs, holding his breath until the first heartbeat returned. Workstation-042: Online. Version: 14.3.1.xxxx.
A small green dot appeared next to the machine name. Then another. Then five more. The new, lighter The performance gains and improved Linux support alone
was reporting in, its footprint smaller, its defenses bolstered by improved AMSI integration EDR capabilities
Elias leaned back, the tension finally leaving his shoulders. The bridge was crossed, the kingdom was secure, and the B-flat hum of the server room felt like a lullaby again. He took a final sip of his cold coffee and began scheduling the rest of the company for the following night. new features introduced in the 14.3 release?
Upgrading from Symantec Endpoint Protection (SEP) 14.2 to 14.3 is a multi-step process that requires updating the management server before the client machines. 1. Preparation and Backup
Before starting, ensure your environment is ready to prevent data loss or downtime: Back up the Database: Symantec Database Backup and Restore tool to create a fresh backup of your SEPM database. Check System Requirements:
Version 14.3 may have different OS or hardware requirements. Verify them on the Broadcom TechDocs Turn off Replication:
If you have multiple management servers, disable replication before starting the upgrade. 2. Upgrade the Symantec Endpoint Protection Manager (SEPM)
The management console must always be at a version equal to or higher than the clients. Download the Installer: Obtain the 14.3 installation files from the Broadcom Support Portal Run Setup.exe:
Choose "Install Symantec Endpoint Protection Manager" from the splash screen. Upgrade Wizard:
The installer will detect your 14.2 version and offer to upgrade. Follow the prompts. Management Server Configuration Wizard:
After the files are installed, this wizard will run automatically to update the database schema. Ensure it finishes successfully before moving to the next step. 3. Upgrade the SEP Clients
Once the server is on 14.3, you can push the update to your endpoints. Auto-Upgrade: In the SEPM console, go to Clients > [Group Name] > Policies > Client Upgrade Settings
. Check the box for "Enforce client upgrade to version" and select the 14.3 package. Manual Export: If you prefer manual installation, go to Admin > Install Packages
, export the 14.3 client, and run it on the target machines. 4. Post-Upgrade Verification Check Client Status: SEPM Dashboard to confirm that clients are reporting back as version 14.3. Update Policies:
If you notice communication issues, right-click the SEP icon on a client and select Update Policy to force a refresh. Broadcom TechDocs Do you need help troubleshooting
a specific error encountered during the database migration or client deployment?
Updating security policies on the Windows client - Broadcom TechDocs
Here are a few options for a post about upgrading Symantec Endpoint Protection (SEP) from 14.2 to 14.3, tailored for different platforms (LinkedIn, a technical blog/forum, or an internal company update).
Would you like a command-line silent upgrade script for the SEP client (for SCCM/PDQ deployments) or the exact SQL commands to back up the SEPM database before upgrading?