SEP Agent Deployment Passwords and Licensing What to Know First
Rollouts rarely fail on the interesting parts. They fail on a password nobody wrote down and a licence nobody checked. SEP deployment touches both: the agent can be protected by an uninstall password that you choose, the antivirus you are replacing may demand one you did not choose, and the whole product runs on licences that live in the manager. Settle all three before push day.
✍️ Technical Anshu🖥️ SEPM Console⏱️ Ten minutes of prevention
🎥 Watch the full deployment in the video — SEPM console, wizard and push, step by step
None of this is complicated, but all of it is much easier before fifty PCs are involved. The uninstall password decides whether a curious user (or a piece of malware) can simply remove the protection. The old product's password decides whether your migration day runs smoothly. And licensing — SEP is a commercial product from Broadcom, activated inside the manager — decides how many endpoints you may honestly deploy to. Take them one at a time.
Removal attempt — OFFICE-PC06
A password is required to uninstall this client
This Symantec Endpoint Protection client is protected by an uninstall password set in the manager console. That is the feature working as designed — the same prompt stops a user, or malware, from stripping the protection off this PC.
The prompt you want your users to hit is the same prompt you will hit one day. Set the password deliberately, and keep it where your team can find it. (Illustrative panel.)
1
Set a Client Uninstall Password Deliberately
SEP lets the administrator password-protect the client — including uninstalling it — through policy in the manager console:
With a password set, removing or disabling the agent asks for it. Casual removal by users stops, and so does the simplest malware trick of uninstalling the antivirus first.
Decide the password as an office decision, not a personal one, and record it in the office password safe the day you set it.
The honest cost: one day you will need that password — for a reinstall, a migration, a repair. If it is lost, removal becomes a support case instead of a two-minute job.
If your rollout uses the saved-package route later, remember a protected client also resists being replaced — password first, then package.
2
The Other Products Password Problem
The password that surprises people mid-rollout belongs to the antivirus being replaced:
Many endpoint products protect their own uninstall with a password set in their console by whoever managed them before you.
SEP's automatic third-party removal can be stopped cold by that prompt.
Before rollout day, test-remove the old product from one PC and discover whether a password exists — then find it, or line up that vendor's official removal tool.
Finding this on the pilot group is a success story; finding it on forty PCs at once is not.
3
Licensing Lives in the Manager
SEP is not a free product with a paid upgrade; it is licensed software, and the manager is where the licence lives:
Symantec's enterprise security business belongs to Broadcom, so SEP licences are bought and renewed through Broadcom or your reseller.
The licence is activated in the SEPM console using the licence details from your purchase, and the console shows your licensing status.
Keep the licence paperwork with the same care as the uninstall password — renewal day is the wrong day to go searching for it.
This guide deliberately does not quote prices or package terms: they depend on your agreement, your reseller and the current Broadcom programme.
4
Stay Inside the Seats You Own
A deployment wizard will happily push an agent further than your licence reaches. The discipline is yours:
Know roughly how many endpoints your licence covers before a big rollout, and check the count in the console as you go.
Prioritise: protect the machines that are actually in use first, and clear out long-dead computer entries so the picture is honest.
If the office has grown past the licence, that is a purchasing conversation — not a reason to leave new PCs unprotected, and not a detail to hide.
Watch for licence warnings in the console instead of muting them; an expired or over-used licence is exactly the kind of quiet problem that surfaces during an incident.
🔴 The one-line version: choose the uninstall password on purpose and write it down, discover the old antivirus's password on one pilot PC, and confirm your licence covers the fleet before you push — three small acts that remove nearly all of a rollout day's drama.
🎥 Watch the Full Video
See the complete SEP agent deployment on screen — every wizard screen and the result in the console.
No. SEP is a commercial, licensed product, sold through Broadcom and its resellers. Costs and terms depend on your agreement, so get them from your reseller or Broadcom rather than from a guide — and be suspicious of any site offering the managed product as a free download.
We lost the client uninstall password. What now?
Check the office password records first — it was set in the manager console policy, and your own console is where it was defined. If it is genuinely lost, the recovery route is through Broadcom support channels, which is exactly why the password belongs in the office safe from day one.
Where do I see how many endpoints my licence covers?
In the SEPM console's licensing view, where the licence was activated. Check it before a large rollout and again at renewal; the console also surfaces warnings when licensing needs attention.
This guide is based on the Technical Anshu video on deploying the SEP agent • Stuck on a step? Ask in the video comments 🙏