Integrity enforcement checks and remediation

[Steve]

I want my integrity clients to be checked for their symantec DAT version. If this is too out of date I want the remediaition to force them to update from my internal AV server.

I have enabled all the relevant firewall ports - i.e allowing communication from client to AV server over AV ports without SVC checks, but my symantec guy says there is no way we can force the client to do an upgrade. All they suggest is we get the AV server to poll the clinets every 10 minutes.

This way my clients may have to wait 10 mins to become compliant and be allowed in.

This is no good. Has anyone set up a likewise remediaition? If this is all symantec has to offer I could do this with a manually created SVC file.

[RobertGraham]

The only way I can think of doing this is to write a batch file or some sort that downloads the most recent DAT file from the Symantec server every day and renames it to something like dailydat.exe.

Then, use this generic name in your auto-remediation configuration. I haven't tested this, but it should work. The only problem would be when someone tries to auto-remediate while the download is running. Ideally, you have a two day window and get the DAT daily.

Let me know if I haven't explained this clearly.