How to create a customized distribution package for Symantec AntiVirus Corporate Edition

Question/Issue:
You want to build a single file that can be distributed to clients that will install Symantec AntiVirus Corporate Edition and configure its options to your specification. In previous versions of Symantec AntiVirus, this could be accomplished using Symantec Packager, which is no longer supported. Symantec AntiVirus is fully Microsoft Windows Installer® (MSI) compliant, which allows configuration options to be passed to the Microsoft Windows Installer through command-line options. This document outlines how to create a typical installation command line and how to create a single file to use to distribute Symantec AntiVirus, and provides some sample command lines for the most commonly requested configuration.

Solution:
To create a single executable file to distribute to your clients, you will need to use a third party tool to create a package that will launch Setup.exe after being extracted. Many vendors provide freeware or relatively inexpensive utilities that can be used to create a self extracting and self launching executable that can be distributed to clients. This document will be limited to working with self extracting zip executables but many of the methods would apply to other packaging and distribution tools as well.

Configuring product features
When you install Symantec Client Security using the MSI, you can control the installation of its features. These features are passed to the Microsoft Windows Installer by the ADDLOCAL property, whose value is a list of features, delimited by commas, that are to be installed locally. If this property is not used, all product features will be installed. If you choose to use this property, you must include in its value all the features you wish to install, and omit only those you do not wish to install. In addition, any features not specified during an upgrade that are already installed on the target system will be removed during the upgrade by the Installer.

For instance, if you wanted to install Symantec AntiVirus Client but omit only the Outlook and Lotus Notes snap-ins, your ADDLOCAL property would have the following value.

ADDLOCAL=SAVMain,SAVUI,SAVHelp,Pop3Smtp,QClient

If you want to install Symantec Client Security (AntiVirus and Firewall) and also not install the Outlook and Lotus Notes snap-ins, you simply add the Symantec Client Security firewall client features to the ADDLOCAL property as shown below.

ADDLOCAL=SAVMain,SAVUI,SAVHelp,SCFMain,SCFHelp,AntiSpam,Pop3Smtp,QClient

Symantec Client Security feature reference

Symantec AntiVirus server features
The following are the features that are configurable for the Symantec Client Security server installation.

Feature	Description
SAVMain	Specifies the basic Symantec AntiVirus files. This feature is required.
SAVUI	Makes the user interface available to the target computer.
SAVHelp	Lets you include Symantec Client Security Help files.

Symantec AntiVirus client features
The following are the features that are configurable for the Symantec Client Security AntiVirus client components.

Feature	Description
SAVMain	Specifies the basic Symantec AntiVirus files. This feature is required.
SAVUI	Makes the user interface available to the target computer.
SAVHelp	Includes Symantec Client Security Help files.
EMailTools	Includes all Auto-Protect email components.
OutlookSnapin	Includes the Microsoft Exchange Auto-Protect email component.
NotesSnapin	Includes the Lotus Notes Auto-Protect email component.
Pop3Smtp	Includes the Internet Email Auto-Protect component.
QClient	Includes the Quarantine client.

Symantec Client Firewall features
The following are the features that are configurable for the Symantec Client Security firewall client components. Installing firewall client components without the required AntiVirus components is not supported.

Feature	Description
SCFMain	Specifies the basic Symantec Client Security firewall client files. This feature is required.
SCFHelp	Includes Symantec Client Security firewall client Help files.
AntiSpam	Include the AntiSpam components.

Configuring installation options
Additional public properties are also available in Symantec Client Security for managing other installation options during the installation. Some of these properties only need to be added to your command line if you want to change the default options.

Client and server options

Option	Value	Description and settings
ENABLEAUTOPROTECT=<value>	1 = Enables Auto-Protect after installation. This is the default. Any other number = Disables Auto-Protect after installation.	Determines whether Auto-Protect is enabled after the installation is completed.
RUNLIVEUPDATE=<value>	1 = Runs LiveUpdate immediately after installation. This is the default setting. Any other number = Does not run LiveUpdate after installation.	Determines whether or not LiveUpdate runs at the end of the installation process. Note: To use the RUNLIVEUPDATE property, Administrator or Power User privileges are required. If you attempt the installation without the correct privileges, the installation may fail without notice. LiveUpdate is a required component of the Symantec Client Security installation.
NETWORKTYPE=<value>	1 = Managed. 2 = Unmanaged. This is the default. 4 = Server. Use this only if installing the server version.	Describes the management state of the target computer when installation is complete.
REBOOT=<value>	Force = Require the computer to restart. Suppress = Prevent most restarts. ReallySuppress = Prevent all restarts as part of the installation process.	Determines whether or not the computer restarts after installation. Note that the ReallySuppress option does not suppress restarting when uninstalling.
SERVERNAME=<parent server name>		Specifies the name of the parent server that will manage the target computer.
INSTALLDIR=<target directory>		Specifies the installation directory on the target computer. The default directory is C:\Program Files\Symantec AntiVirus. If the path specified contains long file names, use quotation marks around it..
MIGRATESETTINGS=<value>	1 = Migrate settings. This is the default. 0 = Do not migrate settings.	Determines whether or not to migrate previous settings on the client during an upgrade from previous versions.

Server only options

Option	Description and settings
SERVERGROUPNAME=<name>	Specifies the name of the server group that the target server will join. You can create a new server group by using a unique server name.
SERVERGROUPPASS=<password>	Specifies the password of the server group that the target server will join.

Configuring the user interface level

The following switches set the user interface level that will be displayed during installation.

Option	Description and settings
/qn	No User Interface (silent mode)
/qb	Basic User Interface. (Use qb! to hide the Cancel button.)
/qr	Reduced User Interface. No modal dialog box appears at the end of the installation.
/qf	Full User Interface. Authored FatalError, UserExit, or Exit modal dialog boxes appear at the end.
/qn+	No User Interface except for a modal dialog box displayed at the end.
/qb+	Basic User Interface with a modal dialog box displayed at the end. The modal box is not displayed if the user cancels the installation. Use qb+! or qb!+ to hide the Cancel button.
/qb-	Basic User Interface with no modal dialog boxes. Please note that /qb+- is not a supported User Interface level. Use qb-! or qb!- to hide the Cancel button.
/qb!-	Basic User Interface with progress bar but no modal dialog boxes.

Note: The ! option is available with Microsoft Windows Installer 2.0 and works only with Basic User Interface. It is not a valid argument with the Full User Interface option.

Using Setup.exe vs. Symantec Client Security.msi
The installation of Symantec Client Security requires the target systems have Microsoft Windows Installer version 2.00.2600.1183 or higher installed. For your convenience, a setup stub (Setup.exe) has been included with the install files, which will verify and install the required version of the Microsoft Windows Installer® as needed on the target systems. If you are unable to ensure that all your target systems have the correct version before deployment, it is recommended that you use the provided Setup.exe InstallShield stub instead of the raw Symantec Client Security.msi installer.

The following InstallShield switches can be passed to the InstallShield stub:

Switch	Function
/l	Language ID
/s	Hide initialization dialog
/v"<msi commands>"	Pass parameters to Msiexec.exe

To pass standard MSI switches to the .msi package called by the Setup.exe file, use the switch /v"<MSI command(s)>", where <MSI command(s)> are the parameters you want to pass to the MSI installer. You can pass multiple MSI commands or properties. All MSI commands must be enclosed within the quotation marks.

Note: Due to an incompatibility between InstallShield and the Windows Installer, if you intend to use the INSTALLDIR property, you must do one of the following:

Use the 8.3 naming convention to denote long path names.
Use a Symantec product's .msi file to launch the package.
Edit the .msi file.
Create a transform.

This is because the InstallShield switch /v requires that quotation marks surround the commands passed to the Windows Installer and the INSTALLDIR= property also requires quotations for long file names. This causes the command to be truncated, for example, to /v"INSTALLDIR=" instead of /v"INSTALLDIR="<full long file name>"".

Creating a verbose Windows installation log
To help in troubleshooting installation issues, it is recommended that you have the Windows Installer create a verbose installation log during installation. This installation log is valuable when submitting installation related issues to Symantec Technical Support. To create a verbose log file in your installation, add the following to your command line.

/l*v %temp%\<log file name>

Defining a client group during the installation of managed clients
You cannot define a client group during installation by using command line options. Instead, create a Grc.dat file and place it in the directory with the source files used for installation, and do not use the NETWORKTYPE or SERVERNAME properties. The Grc.dat will be processed at the end of the installation and apply any settings contained within that file accordingly.

The following is an example of a simple Grc.dat file that will set the client to be managed, define its parent server and set its client group assignment:

In most situations, the sample Grc.dat above contains enough information to permit the clients to contact their parent server. In some instances, however, you may want to populate the AddressCache information of the parent server during installation when the ability of clients to resolve the name of the Parent Server to an IP or IPX address is unreliable. To do so, you will need to locate and open the Grc.dat file on the Parent Server and copy the AddressCache portion of the file into your custom Grc.dat, as shown in the example below.

Below is an example of what a typical Grc.dat would look like on a parent server using TCP/IP. Symantec AntiVirus Parent Servers running both IP and IPX would vary slightly.

Note: For unmanaged installations, you can use the unsupported tool Configuration Editor (ConfigEd.exe) to build a custom Grc.dat to include with your installation that will then configure your clients' Auto-Protect options and other desired client settings. ConfigEd and instructions on its usage are provided on the CD in the <cd root>\tools\Nosupt\ConfigEd folder for your CD for convenience.

Including a custom Symantec Client Firewall policy file with your installation
If you are installing Symantec Client Firewall, you can also include a custom firewall policy file (Cpolicy.xml) with your installation files, which will be applied to the client upon restarting after installation. The Cpolicy.xml can be created by the Symantec Client Firewall Administrator and then copied into the folder containing the source files for Symantec Client Security. For more information on using the Symantec Client Firewall Administrator to create this file, please see the Symantec Client Security Administrator's Guide included on the installation CD.

Note: When upgrading existing Symantec AntiVirus clients to Symantec Client Security 2.0, the installer will not apply the Cpolicy.xml during the upgrade process by default. You can change this behavior by passing the installer property MIGRATESETTINGS=0 which, in effect, tells the installer to discard all previous client settings and apply the settings included in your package. Using this setting will also cause the installer to discard any previous AntiVirus settings as well, so, if you are not installing into a managed environment, you will need to include a new Grc.dat with the installer files to set those options.

Locating the source files
Depending on what product you have purchased from Symantec, you either have Symantec Client Security 2.0, which includes Symantec AntiVirus Corporate Edition 9.0 and Symantec Client Firewall, or Symantec AntiVirus Corporate Edition 9.0 as a stand-alone product. This document covers the creation of a package for installation of Symantec Client Security, but the methods and procedures are similar for both products.

If you are installing only Symantec AntiVirus Corporate Edition 9.0, the source files needed are located on the installation CD, in the <cd root>\SAV folder.

If you are installing Symantec Client Security 2.0, the source files are located on the CD in the <cd root>\SCSClnt folder.

Building the installation package
Following are a few examples of some common command lines and the syntax for their use.

Note: Product feature names are case sensitive. Use the feature name exactly as it appears in the Symantec Client Security Feature Reference section of this document.

When installing Symantec Client Security (AntiVirus and Firewall) with the following features and options

Suppress InstallShield initialization dialog (/s)
Run LiveUpdate at end of installation (RUNLIVEUPDATE=1)
This is the default setting and can be omitted.
Force a restart on client system (REBOOT=FORCE)
Install all features, excluding all e-mail plug-ins (ADDLOCAL=SAVMain,SCFMain,SAVUI,SAVHelp,SCFHelp,QClient,AntiSpam)
Run installation in passive or with a Basic User Interface (/QB)

The command line is as follows:
setup.exe /s /V"REBOOT=FORCE ADDLOCAL=SAVMain,SCFMain,SAVUI,SAVHelp,SCFHelp,QClient,AntiSpam /QB"

When installing Symantec Client Security (AntiVirus and Firewall) with the following features and options

Suppress InstallShield initialization dialog (/s)
Create a verbose Windows Installer Log file in the targets temp directory called SCS_Installation.log (/l*v %temp%\SCS_Installation .log)
Run live Update at end of installation (RUNLIVEUPDATE=1)
This is the default setting and can be omitted.
Suppress a reboot on client system (REBOOT=ReallySuppress)
Install all product features excluding only the Outlook and Lotus Notes mail snap-ins, (ADDLOCAL=SAVMain,SCFMain,SAVUI,SAVHelp,SCFHelp,Pop3Smtp,QClient,AntiSpam)
Run installation with no user interface or silent mode (/QN)

The command line is as follows:
setup.exe /s /V"/l*v %temp%\SCS_Installation .log REBOOT=ReallySuppress ADDLOCAL=SAVMain,SCFMain,SAVUI,SAVHelp,SCFHelp,Pop3Smtp,QClient,AntiSpam /QN"

When installing Symantec Client Security (AntiVirus and Firewall) with the following features and options

Suppress InstallShield initialization dialog (/s)
Create a verbose Windows Installer Log file in the targets temp directory called SCS_Installation.log (/l*v %temp%\SCS_Installation .log)
Do not run live Update at end of installation (RUNLIVEUPDATE=0)
Force a reboot on client system (REBOOT=FORCE)
Install all product features including the all mail snap-ins,
The ADDLOCAL value is omitted, since the default behavior is to install all product features.
Do not migrate previous settings during upgrade of previously installed clients (MIGRATESETTINGS=0)
Run installation with no User Interface or silent mode (/QN)

The command line is as follows:
setup.exe /s /V"/l*v %temp%\SCS_Installation.log RUNLIVEUPDATE=0 REBOOT=FORCE MIGRATESETTINGS=0 /QN"

When installing Symantec Client Security Server with the following features

Suppress InstallShield Dialog (/s)
Create a verbose Windows Installer Log file in the targets temp directory called SCS_Installation.log (/l*v %temp%\SCS_Installation .log)
Do not run live Update at end of installation (RUNLIVEUPDATE=0)
Suppress a reboot (REBOOT=ReallySuppress)
Assign the Server Group automatically during installation (SERVERGROUPNAME=<server group name>)
Pass the server group password to Installer SERVERGROUPPASS=<password>
Run Installation in Passive mode (/QB)

The command line is as follows:
setup.exe /s /V"/l*v %temp%\SCS_Installation.log RUNLIVEUPDATE=0 SERVERGROUPNAME=<group name> SERVERGROUPPASS=<password> /QB"

Creating a batch file for passing command line parameters
Because of the potential length of the command line, it is suggested that you create a simple batch file to execute the commands. This batch file is launched by the zip self-extraction program when executed. The file only needs to contain the command line to install Symantec Client Security, but the file could contain other instructions or commands as needed.

Creating the installation package
When you have all of the files configured, use a third-party utility to create a package.

To create the package

Copy all of the source files for the applicable products to an empty temporary working location. Be sure to use the correct source files for the product and features that you wish to install.
Copy your Grc.dat and Cpolicy.xml files to the same working directory, as needed.
Create a batch file called Setup.bat, with the command line that will install the desired options and features.
Compress the entire directory into a single .zip file.
Use your self-extracting .zip creation program to create an installation package from the .zip file. Set Setup.bat as the program to launch after unzipping the file.

Available Translations:

Document ID: 2004042112230948
Last Modified: 09/02/2009
Date Created: 04/21/2004
Operating System(s): Windows 98, Windows 2000 Professional, Windows XP Home, Windows XP Professional Edition
Product(s): Symantec AntiVirus Corporate Edition 10.0, Symantec AntiVirus Corporate Edition 9.0
Release(s): SAV 10.0 [All Releases], SAV 9.0 [All Releases]