Are the pkgs being set to run on first boot? I'm almost certain that would be necessary for any A/V package to work properly. They typically can't be installed on the non boot volume and expect to work. Many pkgs require being installed into the actual OS after the image is laid down and the Mac reboots.

Also, I would seriously avoid using snapshot pkgs for items like this. You are very likely bypassing all of the original packages scripted logic by doing that, which is Bad.

Similar to @mm2270 Don't use a snapshot, use an installer .pkg and have it set to install at boot when imaging.
If you need settings snapshot just those that are relevant into a .dmg and deploy them also at boot with a higher priority than the main installer (so they are overlaid with what is there).
We install ESET pretty much exactly like this, it has a small config file with the management server address in it which we overlay after (once it hits the management server it gets all the rest of it's config anyway).
But yeah especially if you have different OS X versions floating around, because of the high OS integration of AV you pretty much want it actually installing on each machine.

Same here. Snapshot packaging AV software is likely to cause problems. Although in this case it sounds like it might just be the "install on boot drive after imaging" @mm2270 mentioned.

We don't see the others as much but are deploying Sophos quite regularly without issues.

We deploy Sophos with no issues. I created a snapshot and then set to install via smart group and policy.

The service doesn't startup until the mac reboots but that works for us as it kicks in when we reboot to encrypt.

We're using Symantec installed via Casper imaging without any trouble. It's a .pkg installer and runs after first reboot.

@cdev Could you elaborate on how you do this? Is there a way to set something to run after first reboot using Imaging? I haven't found how to do that, but it's clear I'm missing something.

Use Admin and double click on the package. Under "Options" you will see "Install on boot drive after imaging". Check that off and save. That should do it!

Agreed with all above. If this weren't as critical as AV you could always have installers run post imaging via automated policy. I'm still trying to bring myself around to that methodology on some things.

Will I am 100% on board with "getting stuff working"... : )

I want to remind everyone that we are enabling the vendors to continue making crappy software whenever their installers don't drag and drop in Casper admin.. In this day and age it is unacceptable that people don't build software following Apple guidelines and rules..

C

PS I said we as I am guilty of this too.. we all have to push back together...

Here is a link to Symantec's site about deployment with ARD or Casper. This works for us.

https://support.symantec.com/en_US/article.HOWTO92266.html

Do this...

It just works...

https://derflounder.wordpress.com/2015/02/26/deploying-sophos-enterprise-anti-virus-for-mac-9-2-x/