I've implemented vShield in my environment, with SVA's installed on each of six ESXi hosts. My understanding is that the clients (virtual machines), then become fully protected by virtue of the host, and that the SEP client is no longer necessary. But something else seems to be going on. When I uninstall a SEP client, that machine disappears from the SEPM console, and if I run an EICAR test on that machine, it fails to see any threat. The SEPM console has also begun to show the vast majority of my clients offline, even though they aren't, which, I suspect, is in some way due to the server being virtual as well. If anyone can provide me with some guidance on how to get SEPM to function properly in this scenario, I would appreciate the help.
The SEPM monitor shows all six hosts with their SVA's, but reports zero clients on those SVA's. vShield looks good, with the thin agent enabled on nearly every VM at this point. Firewalls have been checked to be off and are not the problem, either.
Thanks.
Keith