To get an unmanaged Symantec Endpoint Protection (SEP) client, you typically
export a package from the Symantec Endpoint Protection Manager (SEPM) or extract it from the full installation file
. Unmanaged clients are designed for computers that do not connect to a central management server and must handle their own updates and policy changes locally. Broadcom TechDocs 1. Exporting from SEPM (Recommended)
This method allows you to customize features and settings before creating the installer. Broadcom support portal Access Packages : Log in to the SEPM console, go to the tab, and select Install Packages Select Version
: Right-click the desired client package (e.g., Windows or Mac) and select Configure Settings Export Settings : Select the option Export an unmanaged client Installation Settings
: Choose between Silent, Unattended, or Interactive installation types. Feature Sets
: Select which protection components to include, such as Firewall, SONAR, or Virus protection. to generate the package. It is usually exported as a single file for easy deployment. Broadcom support portal 2. Extracting from Full Installation Files
If you don't have SEPM installed, you can find unmanaged installers within the official product download. Broadcom TechDocs : Obtain the full installation Broadcom Support Portal
: Double-click the full installation file to extract its contents to a temporary folder. Locate Folders
: Navigate to the following folders within the extracted contents depending on your OS: (32-bit) or
(Windows) or the installer stub (Linux/Mac) found in these folders. Broadcom TechDocs 3. Repackaging for Linux (seplpkg) How to get an unmanaged client installation package
To obtain and "repack" (export) a Symantec Endpoint Protection (SEP) unmanaged client, you can either download standalone installers directly or use the Symantec Endpoint Protection Manager (SEPM) to create a custom installer with specific feature sets Broadcom support portal 1. Download Standalone Unmanaged Installers
If you do not have a SEPM console or just need the standard unmanaged client: Access the Portal : Log in to the Broadcom Support Portal and navigate to "My Entitlements". Select Product
: Search for your license (e.g., Endpoint Security Complete) and click the Download All Clients : Look for the file named To get an unmanaged Symantec Endpoint Protection (SEP)
Symantec_Endpoint_Protection_Version_All_Clients_Language.zip Extract Files
: Unzip the file to find separate folders for Windows (32-bit and 64-bit), Mac, and Linux unmanaged installers. Broadcom TechDocs 2. Export (Repack) Custom Unmanaged Clients via SEPM
If you need a "repacked" installer with custom settings (e.g., silent install, specific features):
unmanaged client for Symantec Endpoint Protection (SEP) is a standalone installation that does not report to a central management console (SEPM). Users often look for a "repack" to simplify deployment or to install a version that functions independently for remote or offline devices. Spiceworks Community How to Obtain an Unmanaged Client
Official unmanaged clients should always be obtained through the Broadcom Support Portal or by exporting them from your existing management console. Broadcom TechDocs Direct Download
: Secure a standalone client installer directly from the Broadcom portal. Export from SEPM
: If you have the Management Manager (SEPM), you can "repackage" or export a client specifically for unmanaged use: Install Packages Right-click your preferred version and select In Export Settings, choose Export an unmanaged client This creates a custom
in your chosen folder that can be run on any compatible machine. Linux Repackaging : For Linux systems, Symantec provides a specific SEP Linux Packager tool (seplpkg)
to download and repackage installers for specific distributions like RHEL. Broadcom TechDocs Key Differences: Managed vs. Unmanaged Managed Client Unmanaged Client Administration Managed via SEPM Console Managed locally by the user Pushed from SEPM or GUP Downloads via LiveUpdate from Broadcom Set centrally by Admin Default or hard-coded at export Internal corporate network Remote/Home users, labs, or trial Important Security & Licensing Notes Symantec SEP Managed or Unmanaged? - Security
To create a repackaged Symantec Endpoint Protection (SEP) unmanaged client, you must export it from the Symantec Endpoint Protection Manager (SEPM) console. This process generates a standalone installer that users can download and run without requiring a connection to your management server for updates. 1. Configure Custom Installation Settings
Before exporting, define how the client will behave during and after installation.
Access Settings: In the SEPM console, go to Admin > Install Packages > Client Install Settings.
Create New Settings: Click Add Client Install Settings. Name it (e.g., "Unmanaged_Standard") and choose the Installation Type: Interactive: Full user prompts. Silent: No user interface or interaction. intrusion prevention (IPS)
Post-Install Actions: Select the installation location and determine if the computer should automatically restart after the installation completes. 2. Define the Feature Set
Determine which security modules to include in your package.
Access Feature Sets: Go to Admin > Install Packages > Client Install Feature Set.
Customize Modules: Click Add Client Install Feature Set. You can enable or disable specific features such as Virus and Spyware Protection, Network Threat Protection (Firewall), and Proactive Threat Protection.
Note: Disabling heavy modules like Network Threat Protection is sometimes recommended for specific compatibility needs. 3. Export the Unmanaged Package
This step "repackages" the software into a single distributable file.
Initiate Export: Go to Admin > Install Packages > Client Install Packages. Right-click the desired version and select Export.
Select Destination: Browse to a folder where the exported package will be saved.
Export as Single File: Check the box for Create a single .EXE file for easier distribution via download.
Set to Unmanaged: Crucially, under Export Settings, select Export an unmanaged client.
Apply Customizations: Select the Client Install Settings and Feature Set you created in the previous steps. Finalize: Click OK to generate the package. 4. Distribution and Installation Once the .exe is generated, it is ready for deployment.
Deployment: Copy the exported file to a web server for user download, a shared network drive, or a USB drive.
Client Setup: The end-user simply runs the .exe. As an unmanaged client, it will download virus definitions directly from the Broadcom (Symantec) LiveUpdate servers rather than your SEPM. Key Comparison: Managed vs. Unmanaged How to get an unmanaged client installation package go to the tab
Broadcom offers a virtual appliance. While technically "managed," the cloud console has zero on-prem resource usage, effectively giving you remote control without the messy local repack.
Security researchers and malware analysts often need a reliable, enterprise-grade AV to test against malicious files. They do not want the overhead of a management console. An unmanaged client provides the scanning engine without the administrative layer.
Even with a legitimate repack, you may face issues:
Problem: "Installation has detected a newer version of SEP."
Solution: Run the CleanWipe utility (official Broadcom tool) to scrub remnants of old antivirus.
Problem: The client shows "Managed" even though you used the repack.
Solution: This happens if the installer finds a previous managed sylink.xml in the registry. Delete HKLM\Software\Symantec\Symantec Endpoint Protection\CurrentVersion\Sylink before installing.
Problem: LiveUpdate fails to download definitions.
Solution: Unmanaged clients rely on the default Hosts file. Flush your DNS: ipconfig /flushdns. Ensure your firewall allows outbound traffic to liveupdate.symantecliveupdate.com.
SEP is an enterprise-grade security solution that combines antivirus, anti-spyware, firewall, intrusion prevention (IPS), and device control on a single agent. Unlike consumer antivirus (like Norton), SEP is designed for businesses with hundreds or thousands of endpoints.
If you have a legitimate license, do not search for a shady download. Create your own repack in 20 minutes.
Repackaging SEP for deployment in an organization can be necessary for various reasons, such as:
However, it's crucial to download software from official sources to ensure security and compliance. The official Symantec (now part of Broadcom) website or your licensed distributor are the best places to obtain legitimate and up-to-date versions of SEP.
Symptom: You try to remove the client to replace it, but it prompts for a password. Fix: Symantec protects unmanaged clients with a local password. Use the CleanWipe utility (available from Broadcom support) to forcibly remove the client. Do not download CleanWipe from third-party sites.
In enterprise IT environments, Symantec Endpoint Protection (SEP) is a standard for securing workstations. While the ideal deployment method involves pushing a "Managed Client" via the Symantec Management Console (SEPM), there are specific scenarios where an Unmanaged Client is required.
This write-up details the definition, use cases, and technical process of downloading and repackaging the SEP unmanaged client for distribution.