Symptoms:

When you use the Forefront Endpoint Protection (FEP) 2010 Group Policy Tool to import a policy file that was exported from System Center 2012 Endpoint Protection, it will fail with a screenshot similar to the following:

Cause:

The XML namespace is missing and a couple of registry value types have changed in System Center 2012 Endpoint Protection, which results in the error.

Resolution:

1. Perform the following changes manually
   • Add "xmlns="http://forefront.microsoft.com/FEP/2010/01/PolicyData"" in the "SecurityPolicy" section of the policy file.
   • Open the policy file, in the “AddKey Name="SOFTWARE\Policies\Microsoft\Microsoft Antimalware\Signature Updates"” section, replace “FallbackOrder” type “REG_DWORD” with “REG_SZ”.
   • Open the policy file, in the “AddKey Name="SOFTWARE\Policies\Microsoft\Microsoft Antimalware\Signature Updates"” section, replace “DefinitionUpdateFileSharesSources” type “REG_DWORD” with “REG_SZ”.
2. Automate the changes by using the script in the Script section

   You can use the script in the Script section to make the changes to the policy file. You can also write a Java script tool to automate the script. For example, you can name the script in the Script section FepGPFileCorrector.js, and then use a command such as the following:

   cscript.exe FepGPFileCorrector.js <originpolicyfile>.xml

   Where, originpolicyfile is the exported System Center 2012 Endpoint Protection policy file. Currently, the following is supported:

   • Full path of local xml file. For example, c:\test\output.xml
   • Full path of network share file. For example, \\atc-dist-01\test\output.xml
   • File located under the folder that script tool is running.

   The target/output policy file is named Converted-<originpolicyfile>.xml.

References:

The Forefront Endpoint Protection Group Policy Tool is used to convert policy settings contained in configured FEP policies to the format that is used by Group Policy. This tool can be obtained from the Microsoft Download Center (http://go.microsoft.com/fwlink/?LinkId=207729) as part of the FEP 2010 Group Policy Tools download package.

System Center 2012 Endpoint Protection provides several default policy template files that you can find in subfolder AdminConsole\XmlStorage\EPTemplates of site server installation directory. You can import the policy template files by using FEP 2010 Forefront Endpoint Protection Group Policy Tool by default.

Script:

@set @debug = false

//******************************************************************************

//

// Constants

//

//******************************************************************************

var c_sSecurityPolicy = "SecurityPolicy";

var c_sPolicySection = "PolicySection";

var c_sLocalGroupPolicySettings = "LocalGroupPolicySettings";

var c_sXmlns = "xmlns";

var c_sNameSpace = "http://forefront.microsoft.com/FEP/2010/01/PolicyData";

var c_sAddKey = "AddKey";

var c_sAddValue = "AddValue";

var c_sName = "Name";

var c_sType = "Type";

var c_sDisabled = "Disabled";

var c_sFallbackOrder = "FallbackOrder";

var c_sDefinitionUpdateFileShareSources = "DefinitionUpdateFileSharesSources";

var c_sDWord = "REG_DWORD";

var c_sSZ = "REG_SZ";

var c_sHelp = "cscript.exe FepGPFileCorrector.js <originpolicyfile> \r\n"

                + "\r\n"

                + "originpolicyfile Original exported SCEp2012 policy file.\r\n"

//******************************************************************************

//

// Globals

//

//******************************************************************************

var g_fso = null;// Scripting.FileSystemObject

var g_xmlSource = null;// Source XML document

var g_xmlTarget = null;// Target XML document

var g_shell = null;

var g_environment = null;

var g_sScriptDir = null;// cscript.exe running directory

var g_sOriginPolicyFile = null;// Original FEP2012 exported policy file

var g_sOriginFileName = null;// Original FEP2012 exported policy file name

var g_sOriginPolicyPath = null;// The directory hosting original FEP2012 exported policy file

//******************************************************************************

//

// GetAttribute

//

//******************************************************************************

function GetAttribute(oNode, sAttrib, bAllowNull) 

{

var attrib = oNode.attributes.getNamedItem(sAttrib);

if (attrib != null) 

    {

return attrib.text;

    }

else if (bAllowNull) 

    {

return null;

    }

return null;

}

// Validate script host version

if (Number(WScript.Version) < 5.6) 

{

    WScript.Echo(

                "This script requires Windows Script Host v5.6 or later. "

                + "Go to http://www.microsoft.com/scripting for download"

                );

    WScript.Quit(1);

}

if (WScript.FullName.toLowerCase().indexOf("cscript.exe") < 0) 

{

    WScript.Echo(

                "This script can only be executed with Cscript."

                );

    WScript.Quit(1);

}

if ((WScript.Arguments.length < 1) || (WScript.Arguments(0) == "/?")) 

{

    WScript.Echo(c_sHelp);

    WScript.Quit(1);

}

// Initialize

g_fso = new ActiveXObject("Scripting.FileSystemObject");

g_shell = new ActiveXObject("WScript.Shell");

g_environment = g_shell.Environment("Process");

g_sScriptDir = g_fso.GetParentFolderName(WScript.ScriptFullName);

g_sOriginPolicyFile = String(WScript.Arguments(0));

// If g_sOriginPolicyFile has not path

if ((g_sOriginPolicyFile.indexOf(":") > 0) && (g_sOriginPolicyFile.charAt(0) != ".")) 

{

    g_sOriginPolicyPath = g_sOriginPolicyFile.substr(0, g_sOriginPolicyFile.lastIndexOf("\\"));

    g_sOriginFileName = g_sOriginPolicyFile.substr(g_sOriginPolicyFile.lastIndexOf("\\") + 1);

}

else if ((g_sOriginPolicyFile.charAt(0) == "\\") && (g_sOriginPolicyFile.charAt(1) == "\\")) 

{

    g_sOriginPolicyPath = g_sOriginPolicyFile.substr(0, g_sOriginPolicyFile.lastIndexOf("\\"));

    g_sOriginFileName = g_sOriginPolicyFile.substr(g_sOriginPolicyFile.lastIndexOf("\\") + 1);

}

else

{

    g_sOriginPolicyPath = g_sScriptDir;

    g_sOriginFileName = g_sOriginPolicyFile;

}

if (!g_fso.FileExists(g_sOriginPolicyFile)) 

{

    WScript.Echo("XML file " + g_sOriginPolicyFile + " does not exist!");

throw new Error(1, "The XML file does not exist!");

}

//var oFile = g_fso.GetFile(g_sOriginPolicyFile);

//oFile.Attributes = oFile.Attributes & (~1);

g_xmlSource = new ActiveXObject("MSXML2.DOMDocument.6.0");

// Load original SCEP2012 exported policy file

if (!g_xmlSource.load(g_sOriginPolicyFile))

{

var pe = g_xmlSource.parseError;

    INFO(

        "XML load failed:\n"

        + " Location: " + pe.line + ", " + pe.linepos + "\n"

        + " Source: " + pe.srcText + "\n"

        + " Reason: " + pe.reason + "\n"

        );

throw new Error(-1, "Policy file is invalid.");

}

var oSrcSecurityPolicyNode;

//var oRootNodes = g_xmlSource.documentElement.selectNodes(c_sSecurityPolicy);

var oRootNodes = g_xmlSource.childNodes;

if (!g_xmlSource.hasChildNodes()) 

{

    WScript.Echo("XML file " + g_sOriginPolicyFile + " might not need to process, exit directly.");

    WScript.Quit(1);

}

for (var iIndex = 0; iIndex < oRootNodes.length; iIndex++) 

{

if (oRootNodes[iIndex].nodeName == c_sSecurityPolicy) 

    {

        oSrcSecurityPolicyNode = oRootNodes[iIndex];

if (oSrcSecurityPolicyNode != null) 

        {

 if (oSrcSecurityPolicyNode.attributes.getNamedItem(c_sXmlns) != null) 

            {

                WScript.Echo("XML file " + g_sOriginPolicyFile + " might not need to process, exit directly.");

                WScript.Quit(1);

            }

        }

break;

    }

}

g_xmlTarget = new ActiveXObject("MSXML2.DOMDocument.6.0");

var sTargetXmlFile = g_sOriginPolicyPath + "\\Converted-" + g_sOriginFileName;

if (g_fso.FileExists(sTargetXmlFile)) 

{

var oFile = g_fso.GetFile(sTargetXmlFile);

    oFile.Attributes = oFile.Attributes & (~1);

    g_fso.DeleteFile(sTargetXmlFile);

}

WScript.Echo("The target converted policy file: " + sTargetXmlFile);

var oSrcAddKeyNodes;

var oSrcAddValueNodes;

var sNameAttribute;

var sTypeAttribute;

var sDisabledAttribute;

var sNodeValue;

var oTargetAddKeyNode;

var oTargetAddValueNode;

var oAttributes;

// Check "SecurityPolicy" node in source XML

if (oSrcSecurityPolicyNode != null) 

{

// Create "SecurityPolicy" node for target XML

var oTargetSecurityPolicyNode = g_xmlTarget.createNode(1, c_sSecurityPolicy, c_sNameSpace);

// Add attributes under "SecurityPolicy" child node to target node 

    oAttributes = oSrcSecurityPolicyNode.attributes;

for (var index = 0; index < oAttributes.length; index++) 

    {

if (oAttributes.item(index).name != c_sXmlns) 

        {

            oTargetSecurityPolicyNode.setAttribute(oAttributes.item(index).name, oAttributes.item(index).nodeValue);

        }

    }

// Check "PolicySection" child node in source XML

var oSrcPolicySectionNode = oSrcSecurityPolicyNode.selectSingleNode(c_sPolicySection);

if (oSrcPolicySectionNode != null) 

    {

// Create "PolicySection" node for target XML

var oTargetPolicySectionNode = g_xmlTarget.createNode(1, c_sPolicySection, c_sNameSpace);

// Add attributes under "PolicySection" child node to target node 

        oAttributes = oSrcPolicySectionNode.attributes;

for (var index = 0; index < oAttributes.length; index++) 

        {

            oTargetPolicySectionNode.setAttribute(oAttributes.item(index).name, oAttributes.item(index).nodeValue);

        }

// Check "LocalGroupPolicySettings" child node

var oSrcLocalGroupPolicySettingsNode = oSrcPolicySectionNode.selectSingleNode(c_sLocalGroupPolicySettings);

if (oSrcLocalGroupPolicySettingsNode != null) 

        {

 // Create "LocalGroupPolicySettings" node for target XML

 var oTargetLocalGroupPolicySettingsNode = g_xmlTarget.createNode(1, c_sLocalGroupPolicySettings, c_sNameSpace);

            oSrcAddKeyNodes = oSrcLocalGroupPolicySettingsNode.selectNodes(c_sAddKey);

 for (var iKeyIndex = 0; iKeyIndex < oSrcAddKeyNodes.length; iKeyIndex++) 

            {

 // Create one "AddKey" node for target XML

                oTargetAddKeyNode = g_xmlTarget.createNode(1, c_sAddKey, c_sNameSpace);

 // Add attributes under "AddKey" child node to target node 

                oAttributes = oSrcAddKeyNodes[iKeyIndex].attributes;

 for (var index = 0; index < oAttributes.length; index++) 

                {

                    oTargetAddKeyNode.setAttribute(oAttributes.item(index).name, oAttributes.item(index).nodeValue);

                }

                oSrcAddValueNodes = oSrcAddKeyNodes[iKeyIndex].selectNodes(c_sAddValue);

 for (var iValueIndex = 0; iValueIndex < oSrcAddValueNodes.length; iValueIndex++) 

                {

 // Create "AddValue" node

                    oTargetAddValueNode = g_xmlTarget.createNode(1, c_sAddValue, c_sNameSpace);

 // Add attributes under "AddValue" child node to target node 

                    sNameAttribute = GetAttribute(oSrcAddValueNodes[iValueIndex], c_sName);

                    oTargetAddValueNode.setAttribute(c_sName, sNameAttribute);

                    sTypeAttribute = GetAttribute(oSrcAddValueNodes[iValueIndex], c_sType);

 if (sNameAttribute == c_sFallbackOrder) 

                    {

 if (sTypeAttribute == c_sDWord) 

                        {

                            oTargetAddValueNode.setAttribute(c_sType, c_sSZ);

                        }

 else

                        {

                            oTargetAddValueNode.setAttribute(c_sType, sTypeAttribute);

                        }

                    }

 else if (sNameAttribute == c_sDefinitionUpdateFileShareSources) 

                    {

 if (sTypeAttribute == c_sDWord) 

                        {

                            oTargetAddValueNode.setAttribute(c_sType, c_sSZ);

                        }

 else

                        {

                            oTargetAddValueNode.setAttribute(c_sType, sTypeAttribute);

                        }

                    }

 else

                    {

                        oTargetAddValueNode.setAttribute(c_sType, sTypeAttribute);

                    }

 if (oSrcAddValueNodes[iValueIndex].attributes.getNamedItem(c_sDisabled) != null) 

                    {

                        sDisabledAttribute = GetAttribute(oSrcAddValueNodes[iValueIndex], c_sDisabled);

                        oTargetAddValueNode.setAttribute(c_sDisabled, sDisabledAttribute);

                    }

                    sNodeValue = oSrcAddValueNodes[iValueIndex].text;

                    oTargetNodeValue = g_xmlTarget.createTextNode(sNodeValue);

                    oTargetAddValueNode.appendChild(oTargetNodeValue);

 // Append "AddValue" child node under current "AddKey" node

                    oTargetAddKeyNode.appendChild(oTargetAddValueNode);

                }

 // Append "AddKey" child node under "LocalGroupPolicySettings" node

                oTargetLocalGroupPolicySettingsNode.appendChild(oTargetAddKeyNode);

            }

 // Append "LocalGroupPolicySettings" child node under "PolicySection" node

            oTargetPolicySectionNode.appendChild(oTargetLocalGroupPolicySettingsNode);

        }

// Append "PolicySection" child node under "SecurityPolicy" node

        oTargetSecurityPolicyNode.appendChild(oTargetPolicySectionNode);

    }

// Append "SecurityPolicy" node

    g_xmlTarget.appendChild(oTargetSecurityPolicyNode);

    g_xmlTarget.save(sTargetXmlFile);

}

--Weitao Wang

This posting is provided "AS IS" with no warranties, and confers no rights.

On the FEP Support team, we occasionally receive cases from customers who need to allow a “known threat” to run in their environment for various reasons. Most of these have tried (unsuccessfully) to make this work by using File, Folder, or Process exclusions.  While it may be possible to achieve this goal using these methods, this would be an unsupported use of exclusions, and this is really “the wrong tool for the job.”  The recommended and supported method for allowing known threats to run is with the Threat Override policy.

Before we get too far into this, you may be thinking, “Why would I ever allow malware to run on my computers?” There are several typical reasons:

1. Your business requires a certain application, typically in the Remote Control Software, Monitoring Software, or Potentially Unwanted Software categories, that you have licensed and use for legitimate purposes.  So even though Forefront Endpoint Protection classifies it as ‘malware’,   in your environment, it is legitimate, licensed software. Note: many of the threats in these categories are also used by attackers for nefarious purposes.

2. You are in the IT Security department and are examining the behavior of malware in a controlled environment (lab).

3.    You are part of a company’s IT Security department and use some tools that are classified as malware as penetration testing tools.

OK, back to the customer issues we see occasionally, here is one recent example:

“Problem Description: FEP is currently flagging some 'malware' on a couple of our servers. It's not necessarily a false positive as it can be used for nefarious purposes. However, I would like to exclude it from the scans on a few of our servers. The problem I'm encountering is that I haven't been able to figure out how to exclude it using wildcards. I've searched for documentation, but examples and explanations are currently lacking. Here are some of the sites I've looked at:

http://technet.microsoft.com/en-us/library/gg398037.aspx

http://technet.microsoft.com/en-us/library/ff823837.aspx

http://blogs.technet.com/b/clientsecurity/archive/2010/03/08/wildcards-in-path-exclusions.aspx

If I put in the full path to the ISO file, it's no longer scanned. However the path to the ISO file can (and does) vary from server to server, including different drive letters. I would rather not have to enter 5-10 (or more) hard coded exclusion paths for the same exclusion, I would rather be able to use wildcards to exclude this ISO file regardless of it's location on a given server.”

Here was my response to the customer:

Hi <customer>, what you’re trying to do (allow a known threat to run) is accomplished by using the ‘Threat Override’ feature of Forefront Endpoint protection.  The file/folder/process exclusions are provided primarily for performance and compatibility reasons, not for allowing known threats to run.  So, for example, if you had a folder with a huge number of data files (i.e. millions) created by an application, and FEP was taking a long time to scan that folder, or a folder structure with many complex/nested zip files, you might need to exclude those files/folders.  Or, for process exclusions, if you had an application that performed poorly with FEP enabled, then you would exclude that process from being scanned by FEP.

The ‘Threat Override’ policy is the supported method for allowing known threats (executables which could potentially do ‘bad things’) to run.

It’s very easy to create and deploy a threat override.

Our documentation on creating policy and defining threat overrides is located here:

Either you edit an existing policy or you create a new policy. A procedure to create a new policy can be found here: http://technet.microsoft.com/en-us/library/ff823835.aspx

When you have your policy, you need to modify it to define a threat override. For guidance on how to edit a policy, see http://technet.microsoft.com/en-us/library/gg398037.aspx

Here is an example:

To enable a Threat Override, you would create a policy like this:

Then select a policy template, such as this:

Then finish creating the policy, and go to the Properties for the new policy, and click on the ‘Antimalware’ tab, and click ‘Overrides’ on the left hand side.Type in ‘MonitoringTool:Win32/MSNSniffer’, ensure the ‘Override action’ is set to the default (Allow), and click ‘Add’.

Note: If you aren’t sure of the exact threat name, go to the System Event log on the client where the threat was detected, and there should be an event with ‘Source: FCSAM’ and an Event ID of 3004.  The Description field will include the link to the Microsoft Security Portal entry for that particular threat, including the Threat Name that you enter below.

Then click ‘OK’, and assign that policy to computers where you want to allow this to run.

Please let me know if you have questions about this.

Here was the customer’s response, once he enabled the Threat Override:

“Faron,

Thank you for the additional information, it was very helpful. Once I added
the Threat Override, it no longer flagged during the scans.

Thanks for your help on this.”

For reference, here are links to more information on creating & editing FCS/FEP policy:

Creating a policy: http://technet.microsoft.com/en-us/library/ff823835.aspx

Editing a policy: http://technet.microsoft.com/en-us/library/gg398037.aspx

Hopefully this article is helpful in explaining the correct purpose and usage of Threat Overrides in Forefront Endpoint Protection.

Faron Faulk

Microsoft Platforms Security Technical Lead

[Updated 12/16/2011]

Earlier today we released an updated version (found here) of the Definition Update Automation Tool for Forefront Endpoint Protection 2010 Update Rollup 1.  This document provides steps for how to use this tool.

Important Note: We recommend installing the hotfix here if you are using the Definition Update Automation Tool.

Tool Description

With Forefront Endpoint Protection 2010 Update Rollup 1, you now can deploy Forefront Endpoint Protection definition updates to clients by using the Configuration Manager console. There are multiple definition update releases per day, thus making it time-consuming to manually download and deploy each definition update through the Configuration Manager Console. The Definition Update Automation Tool can be used to automate the steps required to keep a deployment of Forefront Endpoint Protection update definitions up to date. The tool will download the latest definition update and update the specified software update deployment with the latest definition. Configuring this tool to run automatically with Windows Task Scheduler or via a Configuration Manager Status Filter Rule can keep a deployment up to date without continuous and repetitive manual processes.

To learn more about managing software updates click here.

Changes since the Last Release

This tool was first released with Forefront Endpoint Protection 2010 Update Rollup 1. This release addresses a number of supportability issues, primarily around logging. 

Bug Fixes:

• Removal of /RefreshDP switch, add new switch: /DisableRefreshDP
• Improved logic to skip updating the deployment package if no content change was detected
• Corrected the default update filter string so it will not retrieve superseded updates and enables functionality when custom updates published by System Center Update Publisher are present

Command line Usage

Command line usage

Usage: SoftwareUpdateAutomation.exe parameters

Parameters:

/Help: Get program usage

/SiteServer: Site server computer name

/UpdateFilter: Filter for selecting software updates that are used for the destination packages

/AssignmentName: Name of destination software updates assignment

/PackageName: Name of destination software update package

/DisableRefreshDP: Disable automatic propagation of updated package to Distribution Points

/Verbose: Enable additional logging.

Example command line

SoftwareUpdateAutomation.exe /AssignmentName FEPDeployment /Package FEP

This example will use local machine as Site Server and use the default UpdateFilter. It will add the latest Forefront Endpoint Protection definition update into Assignment “FEPDeployment” and Package “FEP” and refresh the Distribution Points if any updates were made to the deployment package.

How to use this tool

To run this tool, you must copy the binaries to the Admin UI bin folder:

• <ConfigMgr Install Dir>\AdminUI\bin

Now you can run this tool manually from a command line, or use Task Scheduler or a Status Filter Rule to run it automatically.

Note: This tool will only download the latest Forefront Endpoint Protection definition update and add it to the existing deployment and package. It will not synchronize the definition update into Configuration Manager. It is still necessary to run software update synchronization to synchronize the latest Forefront Endpoint Protection definition update into the Configuration Manager database before you run this tool. Please refer to How to Configure Software Updates Synchronization(http://technet.microsoft.com/en-us/library/bb632893.aspx) for information on how to configure the software update synchronization.  As a best practice, before you run this tool, always make sure that a scheduled software update synchronization has completed.

How to Use Definition Update Automation Tool with Task Scheduler

1. Start Task Scheduler, and in the Actions pane, click Create Task.
2. In the Create Task dialog box, give the task a name, and then, under Security Options, make sure that the user account specified has the appropriate Configuration Manager permissions to update the definition package and definition assignment specified in the command line. To make sure the program has the right to create log under %ProgramData%, check Run with highest privileges.
3. On the Actions tab, click New, and in the New Actiondialog box, specify the following command line to run:
   • <ConfigMgr Install Dir>\AdminUI\bin\SoftwareUpdateAutomation.exe
4. In the Add arguments text box, enter the following arguments and then click OK:
   

   /AssignmentName AssignmentName /PackageName PackageName

   Where AssignmentName is the name of the software deployment for the definitions which you recorded earlier and PackageName is the name of the software package that contains the definitions which you recorded earlier. Parameters are not case sensitive.

5. On the Triggers tab, click New.
6. In the New Trigger dialog box, under Settings, select Daily.
7. Under Advanced settings, select the check box for Repeat task every, in the list click 8 hour, and then next to for a duration of, click Indefinitely.
8. In the New Trigger dialog box, click OK, and then in the Create Task dialog box, click OK.

How to Use Definition Update Automation Tool with Status Filter Rule

Note: This is the recommended scheduling option as it allows the Definition Update Automation Tool to automatically run after a WSUS synchronization completes successfully.

1. In the Configuration Manager console, navigate to System Center Configuration Manager / Site Database / Site Management / <site name> / Site Settings / Status Filter Rules.
2. Right-click Status Filter Rules, click New, and then click New Status Filter Rule.
3. On the General page of the New Status Filter Rule Wizard, specify a name for the new status filter rule and configure the following for the message-matching criteria:
   • Set Source: Configuration Manager Server
   • Component: SMS_WSUS_SYNC_MANAGER
   • Message ID: 6702
4. On the Actions page of the New Status Filter Rule Wizard, specify the following action:

• Run a program
• Program: <ConfigMgr Install Dir>\AdminUI\bin\RunSoftwareUpdateAutomation.bat

Sample RunSoftwareUpdateAutomation.bat:

“<ConfigMgr Install Dir>\AdminUI\bin\SoftwareUpdateAutomation.exe” /AssignmentName ”AssignmentName” /PackageName “PackageName”

Note: It is recommended to put the Definition Update Automation Tool command line in a batch file to prevent problems with the quotes (“).

The status filter Rule runs the tool under the System account. To enable the tool to download, make sure the system account has the appropriate proxy settings.   One option to configure the proxy settings for localsystem is to use the BITSAdmin Tool (for more information on the BITSAdmin Tool, click here).

You can use the command: bitsadmin /util /setieproxy localsystem to set the proxy setting for system account. (eg: bitsadmin /util /setieproxy localsystem myproxy *.mydomain.com)

More information about scheduling

A proper schedule for software update point synchronization is necessary to keep your Forefront Endpoint Protection clients up-to-date. Below is the recommended setting for these schedules when using this tool:

1. Software update point synchronization to run every day.

   In the Configuration Manager console, navigate to System Center Configuration Manager / Site Database / Site Management / <site name> / Site Settings / Component Configuration.

   Right-click Software Update Point Component, click Properties.

   Click Sync Schedule Tab, check Enable Synchronization on a schedule, check Simple schedule and Run every 1 Days.

2. Configure Definition Update Automation Tool to run every time software update point synchronization succeedes as described above in “How to Use Definition Update Automation Tool with Status Filter Rule”.

Additional considerations

There are four suggested Configuration Manager and Forefront Endpoint Protection 2010 topologies: See http://technet.microsoft.com/en-us/library/gg412503.aspx. In this section, we will give suggestions on where to run this tool for each topology.

• Centralized policy control and centralized Forefront Endpoint Protection administration

Run this tool on each central site.

• Centralized policy control and decentralized Forefront Endpoint Protection administration

Run this tool on each child site. Note: the assignment and package you used for this tool must also be created on child site.

• Decentralized policy control and decentralized Forefront Endpoint Protection administration

Run this tool on each child site. Note: the assignment and package you used for this tool must also be created on child site.

• Decentralized policy control and Forefront Endpoint Protection administration with centralized Forefront Endpoint Protection reporting

Run this tool on each child site. Note: the assignment and package you used for this tool must also be created on child site.

Trouble-shooting

SoftwareUpdateAutomation.log will always be the first place to investigate. The log file is located in %ALLUSERSPROFILE%.

You can use the parameter /Verbose to enable verbose logging.

When using Task Scheduler to run the tool, the task must be selected to run as highest privilege. Otherwise, no log file will be created.

Common Errors and Potential Workarounds

How to Configure Configuration Manager for Forefront Endpoint Protection Update and Create Deployment Package and Assignment

1. If needed, install Windows Server Update Services by using Server Manager. For more information, see How to Install Windows Server Update Services 3.0 in the Configuration Manager library on TechNet.
2. If needed, add the software update point site system role to your Configuration Manager environment. For more information about how to add the software update point site system role, see How to Add the Software Update Point Site Role to a Site System in the Configuration Manager library on TechNet.
3. Configure software updates to download the appropriate updates, and configure the synchronization schedule. For steps on configuring the software updates site system role, see How to Configure Software Updates Synchronization in the Configuration Manager library on TechNet.  When you configure software updates, ensure the following items are selected:
   • On the Classifications tab, select Definition Updates.
   • On the Products tab, select Microsoft Forefront Endpoint Protection 2010.
4. Create Deployment Package and Assignment
• In the Configuration Manager console, navigate to System Center Configuration Manager / Site Database / Computer Management / Software Updates / Update Repository/Definition Updates/Microsoft/Microsoft Forefront Endpoint Protection 2010
• In the details pane, click the most recent active Forefront Endpoint Protection 2010 definition update (represented by a green icon),and then click Download Software Updates.
• Create the definition update deployment package by completing the Download Updates Wizard for the selected update. When completing the wizard, ensure the following:
  
      On the Deployment Package page, in the Package Source text box, specify a shared folder with permissions appropriate for software distribution in your organization.
      Make note of the name you give this software package; you need this name for the PackageName parameter for the definition update automation tool, which is configured in a later step.
  
• When finished with the Download Updates Wizard, click Finish.
  
• In the details pane, click the same Forefront Endpoint Protection 2010 definition update from step 2, and then click Deploy Software Updates.
• Deploy the definition updates by completing the Deploy Software Updates Wizard. When completing the wizard, ensure the following:
  
      On the General page, specify a name for the software deployment. Make note of this name; you need this name for the AssignmentName parameter for the definition update automation tool, which is configured in a later step.
      On the Deployment Template page, select Create a new deployment definition.
      On the Collection page, click Browse and then select the target collection.
      On the Display/Time Settings page, set the Duration to 2 hours, and if you want users to not be notified that an update is available, select Suppress display notifications on clients.
      On the Create Template page, specify a name for the template.
      On the Schedule page, select As soon as possible. If you selected to suppress display notifications, verify that Set a deadline for software update installation is selected, and verify the deadline time.
      When finished with the Deploy Software Updates Wizard, click Finish.

--Jason Lewis

This posting is provided "AS IS" with no warranties and confers no rights.

Users like you make all the difference in the quality of our products.  The Microsoft Assessment and Planning (MAP) Toolkit Team will soon start recruiting Beta participants for our next version’s Beta program.

We’re currently recruiting users of Forefront Endpoint Protection 2010.  We of course welcome anybody who is interested in the MAP product. Click here to find more about what MAP has to offer. MAP helps customers and partners with a host
of scenarios as software usage tracking, software and hardware inventory, assessments for migration, virtualization and the cloud.

We really look forward to having you involved in our Beta program and hearing your thoughts on the features we’ve added.

As a way of saying thank you there will be prizes.  We don’t have all the details yet but in the past we gave away prizes such as Xbox 360s, Kinect for Xbox, and Zune media Players to a randomly selected subset of participants.

Sincerely,

The Map Toolkit Team

To proactively express your interest in MAP please

• Go to http://connect.microsoft.com and click “Sign In” (in the upper right of the page)
• If you are not already registered with Microsoft® Connect, it will guide you through a quick (and free) registration process
• Make sure you say “yes” to being contacted about participating in new Microsoft Connect programs
• Once you have completed the registration, sign in to Microsoft® Connect
• Search for "Microsoft Assessment and Planning Toolkit"
• Click join and you will be notified of beta programs and opportunities!

This announcement is sponsored by the Microsoft Solution Accelerators Team.
You can contact us at mapfdbk@microsoft.com

by Michael Cureton

We’ve become aware of two issues when using the Definition Update Automation Tool. This blog article presents workarounds for the issues.

Definition Update Automation Tool fails to add new definition updates to the deployment package

Symptoms

The FEP 2010 Definition Update Automation Tool may fail to add new definition updates to your deployment package. Reviewing the %ProgramData%\SoftwareUpdateAutomation.log file shows the following exception:

SmsAdminUISnapIn Error: 1 : Unexpected exception: System.ArgumentException: An item with the same key has already been added.
  at System.ThrowHelper.ThrowArgumentException(ExceptionResource resource)
  at System.Collections.Generic.Dictionary`2.Insert(TKey key, TValue value, Boolean add)
  at System.Collections.Generic.Dictionary`2.Add(TKey key, TValue value)
  at Microsoft.Forefront.EndpointProtection.SoftwareUpdateAutomation.SccmUtilities.CalculateCleanupDelta(ConnectionManagerBase connection, ICollection`1 freshUpdateFilesObjectList, IResultObject destinationPackageObject)
  at Microsoft.Forefront.EndpointProtection.SoftwareUpdateAutomation.SoftwareUpdater.Update(SoftwareUpdateAutomationArguments arguments)
  at Microsoft.Forefront.EndpointProtection.SoftwareUpdateAutomation.SoftwareUpdater.Main(String[] args)

Cause

More than one FEP 2010 definition update is being detected as active by the tool.

More Information

The FEP 2010 Definition Update Automation tool queries WMI (SELECT * FROM SMS_SoftwareUpdate WHERE ArticleID=2461484 AND IsSuperseded=0 AND IsEnabled=1) to get the single active FEP 2010 definition update. The exception happens as a result of more than one update being returned. The tool may detect more than one update as being active when one of the two conditions is TRUE:

1. One or more FEP 2010 definition updates has been expired but not superseded, OR
2. One or more FEP 2010 definition updates has been orphaned.

To confirm if you’re experiencing condition #1 or #2, run the below WMI query:

SELECT * FROM SMS_SoftwareUpdate WHERE ArticleID=2461484 AND IsSuperseded=0 AND IsEnabled=1 AND IsExpired=0

If the query only returns one row, then you are experiencing condition #1. If two or more rows are returned, you are experiencing condition #2.

Workarounds

Condition #1

If you are experiencing condition #1, you can prevent the symptom by simply adding the /UpdateFilter flag to the command line for the tool (SoftwareUpdateAutomation.exe) with the appropriate values to filter out expired definition updates that are not superseded.

For example:

SoftwareUpdateAutomation.exe /AssignmentName <AssignmentName> /PackageName <DeploymentPkgName> /UpdateFilter “ArticleID=2461484 AND IsSuperseded=0 AND IsEnabled=1 AND IsExpired=0”

Condition #2

If you are experiencing condition #2, you will need to manually decline the orphaned updates via the WSUS administration console. For each update returned from the WMI query that you used to confirm that you have condition #2, double-click on the LocalizedDisplayName property and note the definition version. The update with the highest definition version will be the active one. The update(s) with the lower definition versions have been orphaned.

For example, using the list below, 1.107.713.0 would be the active update and the other two updates are orphaned and would need to be declined manually in WSUS.

Definition Update for Microsoft Forefront Endpoint Protection 2010 - KB2461484 (Definition 1.103.1405.0)
Definition Update for Microsoft Forefront Endpoint Protection 2010 - KB2461484 (Definition 1.105.2231.0)
Definition Update for Microsoft Forefront Endpoint Protection 2010 - KB2461484 (Definition 1.107.713.0)

After you have determined the orphaned update(s) title (and version), load the WSUS snap-in and drill down to the Updates node. On the action pane, click New Update View. Select “Updates are in a specific classification” and “Updates are for a specific product”. In step 2, click any classification and ensure that only Definition Updates is checked. Next click any product and ensure that only Forefront Endpoint Protection 2010 is checked. In step 3, specify a name for the view and click OK.

Locate the created view in the WSUS console. Change the Approval value to "Any Except Declined" and the Status to "Any" and hit Refresh. Click the Title column so that the results are sorted using the version. Find the orphaned update(s) that you identified by version and select the Decline action for each. Once this is complete, you’ll need to wait for the next scheduled Software Update Point (SUP) sync to complete, at which time the updates that you declined will be marked as expired in the ConfigMgr database.

NOTE: Running a manual SUP sync will NOT expire the declined updates. Only a scheduled sync will perform this operation.

Once the sync is complete, you can run the WMI query used to determine condition to confirm that only one row is now returned. You will also need to run the tool going forward using the condition #1 workaround with the /UpdateFilter flag.

Definition Update Automation Tool does not refresh distribution points

Symptoms

The FEP 2010 Definition Update Automation Tool does not refresh distribution points (DPs) by default. Even though the help output for the tool states that /RefreshDP is set by default, it is not.

Workarounds

Add /RefreshDP to the command line for the tool (SoftwareUpdateAutomation.exe). For example:

SoftwareUpdateAutomation.exe /AssignmentName <AssignmentName> /PackageName <DeploymentPkgName> /RefreshDP

by Jeramy Skidmore

You can move the Configuration Manager site database and associated Forefront Endpoint Protection (FEP) databases after setup has completed to a different SQL Server computer system by:

1. Backing up the FEP data warehouse (FEPDW_<sitecode>)
2. Backing up the Configuration Manager Site Database (SMS_<sitecode>)
3. Uninstalling the FEP reporting component
4. Restoring the site database and FEP data warehouse to their new locations
5. Relocating the site database via Configuration Manager setup
6. And then reinstalling the FEP Reporting component

Detailed steps follow.

Note

Configuration Manager 2007 does support moving the site database from a remote SQL Server to the local site server computer if the site server computer is running a supported version of Microsoft SQL Server. For a list of supported SQL Server versions, see Configuration Manager Supported Configurations.

Note

FEP hosts two databases, the FEP database (FEPDB_sitecode) and the FEP data warehouse (FEPDW_sitecode). The FEP database serves as a proxy database for extracting data from the Configuration Manager site database. It does not need to be backed up or moved, and will be recreated when the FEP Reporting component is reinstalled.

To move the databases

Important: You will require access to the FEP 2010 installation media in order to successfully complete these steps.

1. Back up the site database on the current site database server and restore it on the new site database server computer using the SQL Server Management Studio. For more information, see How to Move the Site Database.
2. Back up the FEP data warehouse (FEPDW_sitecode) on the current FEP Reporting SQL Server and restore it to the new Reporting SQL Server. (If you have a remote reporting database and are not moving the FEP reporting database, you can skip this step.)

   Note

   Ensure that the database access permissions are the same on the new databases as they are on the original databases.

3. On the site server, in Add/Remove programs, uninstall Microsoft Forefront Endpoint Protection 2010 Reporting.
4. Ensure the primary site server computer account has administrative privileges over the new site database server computer.
5. Close any open Configuration Manager console connections to the site server.
6. On the primary site server computer, use the hierarchy maintenance tool (Preinst.exe) to stop all site services by using the following command: Preinst /stopsite.
7. On the primary site server computer, click Start, click All Programs, click Microsoft System Center, click Configuration Manager 2007, and click ConfigMgr Setup, or navigate to the .\bin\i386 directory of the Configuration Manager 2007 installation media and double-click Setup.exe.
8. Click Next on the Configuration Manager Setup Wizard Welcome page.
9. Click Perform site maintenance or reset this site on the Configuration Manager Setup Wizard Setup Options page.
10. Select Modify SQL Server configuration on the Configuration Manager Setup Wizard Site Maintenance page.
11. Enter the appropriate SQL Server name and instance (if applicable) for the new site database server as well as the site database name on the Configuration Manager Setup Wizard SQL Server Configuration page.
    Configuration Manager Setup performs the SQL Server configuration process.
12. Restart the primary site server computer, and verify the site is functioning normally.
13. On the site server, run serversetup.exe from the FEP installation media.
14. On the Installation Options step, choose Advanced Topology.
15. On the Advanced Toplogy step, ensure that FEP 2010 Reporting and Alerts is selected.
16. On the Reporting Configuration step, provide the proper computer, instance, and database name for your SQL implementation. Ensure the Reuse existing database check box is selected.
17. Proceed through setup. This process will recreate the FEP database alongside the relocated site database, and recreate the SQL jobs necessary to move information from the site database into the FEP databases. The FEPDB will be repopulated according to the information stored in the site database.

Hi folks,

There have been some questions about these two areas of definition updates, so I wanted to clarify this a bit.

Whenever FEP does a definition update, a silent rescan of all running processes and loaded modules is performed. If there is malware running that is now detected by the new definitions, that malware is detected within a few seconds of performing the update. There is no action needed on your part after new definitions are downloaded – this silent rescan happens automatically.

Additionally, the FEP client can be configured to check for definition updates automatically on service start. The behavior is the same as described in Checking for definition updates when starting (yes, that particular blog article deals with FCS, but the FEP behavior is the same). The registry key already exists in the FEP ADMX, which you can download as part of the FEP2010grouppolicytools-<locale>.exe here. For full documentation about all the values in the ADMX, see the FEP ADMX Reference.

Thanks!

 By Adwait Joshi

Hello,

An Update Rollup for Forefront Endpoint Protection 2010 is now available here: http://go.microsoft.com/fwlink/?LinkId=223229 .

 In addition to hotfixes, this Update also includes some important changes to note:

1. Support for Windows Embedded 7 platforms:  With this update, the FEP client software is supported on certain Windows Embedded 7 platforms (including Windows Thin PC) and Windows Server 2008 Server Core.  For more information about the additional support, see Prerequisites for Deploying Forefront Endpoint Protection on a Client Computer.
2. Signature Update Automation Tool used with Configuration Manager Software Update:  This tool automates downloading FEP definition updates using Configuration Manager 2007 Software Updates.  This is a command line tool that uses Configuration Manager APIs to get new definitions from Microsoft Update via the Configuration Manager software update feature, distribute the content to distribution points, and deploy the updates to Endpoint Protection clients on a recurring schedule.  The automation of the tool is done through the Windows task scheduler. To download the tool, see http://go.microsoft.com/fwlink/?LinkID=221205
3. Two new preconfigured policy templates for the following server workloads:
1. Microsoft Forefront Threat Management Gateway
2. Microsoft Lync 2010

You can find more details in the “What’s New” document on the  Technet site.  Please check out this KB article for a full list of fixes included in this Update Rollup.

Thanks,

Adwait Joshi

Sr. Technical Product Manager

Forefront Endpoint Protection

Hey folks!

I wanted to let you know that we have guidance for migrating from FCS v1 to FEP 2010 here (http://technet.microsoft.com/en-us/library/gg477033.aspx).

The process involves the following high level steps:

1. Document the policy settings you want to preserve from FCS to FEP. There is no policy migration between the two versions.
2. In WSUS, unapprove all the FCS v1 client installation packages.
• If you forget to do this, you may end up with FCS v1 reinstalled.
3. Install FEP on your Config Mgr installation, and proceed with the FEP client deployment.
• The FCS v1 client software is automatically uninstalled and FEP is installed.
• Also – the definitions already on the client computers are preserved, speeding up the up-to-date process for definition downloading.

Thanks!

Kim Ditto-Ehlert
Senior Technical Writer

From Angela Latimer, CSS

If you are using Forefront Endpoint Protection (FEP) 2010, you may have tried running one of the three default FEP reports and noticed that not all areas or sub-reports display properly. You may see an error in processing the reporting data or retrieving the data, similar to the error displayed below:

Error while trying to run the Antimalware Activity Report:

We found this error was due to the installed version of Microsoft SQL Server not being up-to-date with the latest Cumulative Update package. Cumulative Update packages contain hot fixes that address issues in the currently installed version of Microsoft SQL Server which may be versions ranging from Release to Manufacturing (RTM), Service Pack (SP), or Feature Release (R).

In digging into the details of the error related to FEP reports not displaying properly, we found the following errors in the System Center Configuration Manager Console and/or in the %drive%:\Program Files (x86)\Microsoft Configuration Manager\Logs\SRSRP.log file, reporting Error ID 7403 related to the health of SRS Reporting Point thread:

STATMSG: ID=7403 SEV=E LEV=M SOURCE="SMS Server" COMP="SMS_SRS_REPORTING_POINT" SYS= SITE= PID=2880 TID=5572 GMTDATE=Wed Oct 21 17:57:26.302 2009 ISTR0="HACM01" ISTR1="" ISTR2="" ISTR3="" ISTR4="" ISTR5="" ISTR6="" ISTR7="" ISTR8="" ISTR9="" NUMATTRS=0 SMS_SRS_REPORTING_POINT 10/21/2009 10:57:26 AM 5572 (0x15C4)  
Failures reported during periodic health check by the SRS Server . Will retry check in 57 minutes SMS_SRS_REPORTING_POINT 10/21/2009 10:57:26 AM 5572 (0x15C4)

In the two environments we discovered this issue, Microsoft SQL Server 2008 and SQL Server 2008 R2 were running, but had NOT had the Cumulative Update package installed. As soon as this update was installed, the FEP reports began displaying properly.

At the time of this blog, these are the most current Cumulative Update Packages for Microsoft SQL Server 2008 and 2008 R2. However, you should do a Bing search to ensure you are always installing the latest version.

• For SQL Server 2008 R2: Cumulative Update Package 7 for SQL Server 2008 R2 - http://support.microsoft.com/kb/2507770
• For SQL Server 2008 SP2: Cumulative Update Package 4 for SQL Server 2008 SP2 - http://support.microsoft.com/kb/2527180
• For SQL Server 2008: Cumulative Update Package 4 for SQL Server 2008 - http://support.microsoft.com/kb/963036

Forefront Endpoint Protection 2012 beta is here!  We are extremely excited to announce the availability of Forefront Endpoint Protection 2012 Beta.  Customers can download the Beta software immediately here. You can also download the pre-requisite System Center Configuration Manager 2012 Beta 2 here. 

Forefront Endpoint Protection 2012 continues to deliver on the promise of Forefront Endpoint Protection 2010, simplifying and improving endpoint protection while also greatly reducing infrastructure costs. It builds on System Center Configuration Manager 2012, allowing customers to implement endpoint protection as part of a unified infrastructure for securing and managing physical, virtual, and mobile client environments. This shared infrastructure lowers ownership costs while providing improved visibility and control over endpoint management and security.   

• What’s new in FEP 2012:
  • Support for System Center Configuration Manager 2012
  • Improved real time alerts and reports
  • Role-based management
  • User-centric reports (post beta)
  • Easy migration from FEP 2010/ConfigMgr 2007
  • Support for FEP 2010 client agents 

Forefront Endpoint Protection 2012 continues to provide proactive protection against known and unknown threats using multiple technologies in the antimalware engine like behavior monitoring, network inspection system and heuristics.  With cloud based updates through the spynet service, endpoints get updated protection against new threats in real time.  See the benefits of enabling Dynamic Signature Service in FEP here. 

You can find more product details on our Website or TechCenter. And for more information about convergence of management and security, please visit our new Windows Optimized Desktop page.

You can now evaluate Forefront Endpoint Protection 2012 beta and System Center Configuration Manager 2012 beta with a community of early adopters.  Join the Community Evaluation Program for System Center Configuration Manager and evaluate the products with guidance from the product team and by sharing of experiences and best practices among a community of peers.

We hope you will evaluate the early version and give us your feedback!

Forefront Endpoint Protection team

From Shain Wray, CSS

Using a CNAME (alias) DNS record for the server name when installing the Configuration Manager site database server components is supported in Configuration manager setup. However, it is not allowed by FEP and causes errors during setup.

A workaround for this issue is to avoid using the CNAME and change the site database server name in Configuration manager to the name of the site database server that is listed in Active Directory. Use the following steps to work around this issue.

1. On the primary site server computer, use the hierarchy maintenance tool (Preinst.exe) to stop all site services with the following command: Preinst /stopsite.
2. On the primary site server computer, click Start, click All Programs, click Microsoft System Center, click Configuration Manager 2007, and click ConfigMgr Setup, or navigate to the .\bin\i386 directory of the Configuration Manager 2007 installation media and double-click Setup.exe.
3. Click Next on the Configuration Manager Setup Wizard Welcome page.
4. Click Perform site maintenance or reset this site on the Configuration Manager Setup Wizard Setup Options page.
5. Select Modify SQL Server configuration on the Configuration Manager Setup Wizard Site Maintenance page.
6. Enter the appropriate SQL Server name and instance (if applicable) for the new site database server as well as the site database name on the Configuration Manager Setup Wizard SQL Server Configuration page.
7. Configuration Manager Setup performs the SQL Server configuration process.
8. Restart the primary site server computer, and verify the site is functioning normally.

Symptom:

When using a CNAME, you experience a FEP installation failure during the Reporting Services database installation. The FEP installation user interface displays a generic failure error. When reviewing the ServerSetup_<date_time>.log file, an error similar to the following is logged –

[2/7/2011 3:02:38 PM][Verbose] Successfully retrieved site info: Site server: SCCMSVR. Site Name: CONTOSO Development Site. Site Code: TEST. Site DB server: DB1. DB Name: CONFIGMANAGER_TEST. DB Instance: MSSQLSERVER. SRS Computers: SCCMSVR.CONTOSO.COM
[2/7/2011 3:02:38 PM][Verbose] Machine account resolver received machine name 'DB1'
[2/7/2011 3:02:38 PM][Verbose] Successfully connected to Domain Controller. LDAP path: 'LDAP://contoso.com'
[2/7/2011 3:02:38 PM][Verbose] Successfully constructed AD search filter. Filter: '(&(objectclass=computer)(objectCategory=computer)(cn=DB1))'
[2/7/2011 3:02:38 PM][Verbose] Successfully constructed AD search filter. Filter: '(&(objectclass=computer)(objectCategory=computer)(dnsHostName=DB1))'
[2/7/2011 3:02:38 PM][Verbose] AD query result is empty
[2/7/2011 3:02:38 PM][Verbose] Unexpected exception while resolving machine account. Domain Controller: 'DB1'. Exception: Microsoft.Forefront.EndpointProtection.Configure.Utility.ActiveDirectoryUtilitiesException: Setup cannot resolve the fully qualified domain name for the following computer in Active Directory.
[2/7/2011 3:02:38 PM][Verbose]> Verify the following: the computer name is correct, the local computer is connected to the domain, the specified computer is a member of the same domain as the local computer, the specified computer is connected to the domain. Computer name: DB1
[2/7/2011 3:02:38 PM][Verbose]> at Microsoft.Forefront.EndpointProtection.Configure.Utility.ActiveDirectoryUtilities.GetMachineAccount(String comuterName)
[2/7/2011 3:02:38 PM][Normal] The SQL Server computer cannot be found in Active Directory. Please verify that the provided computer name is valid, and that the computer is properly joined to the domain. If the specified computer is a SQL Server cluster, make sure that you have specified the cluster's SQL Network Name, and that the cluster is properly joined to the domain using 'Cluster Administrator'. SQL Server computer name: DB1. Error message: Failed to resolve machine account for DB1. Exception: Setup cannot resolve the fully qualified domain name for the following computer in Active Directory.
[2/7/2011 3:02:38 PM][Normal]> Verify the following: the computer name is correct, the local computer is connected to the domain, the specified computer is a member of the same domain as the local computer, the specified computer is connected to the domain. Computer name: DB1

We have been working hard on a solution for customers that encountered issues with our update in March. I wanted to let you know what we are planning to address this.

We are authoring a package that is specifically designed to find systems that have a failed upgrade to our March update. To do this, we will be pushing a package from Microsoft Update that looks for several specific conditions:

1. The SSA package from Forefront Client Security to be present.

2. Several Antimalware registry keys are present, even though Antimalware software had been removed due to an upgrade.

3. You are running Vista or higher OS (including Server OS like Windows Server 2008)

If all of these items are true, then we will reinstall the update package and return the system to normal.

If a system fails any one of these conditions, we aren’t going to install. The first case is a safe check because only FCSv1 customers have this particular package. The second one is equally important, because if a admin has actually intentionally removed FCSv1, the Antimwalware keys we are looking for would no longer exist. The third obviously focuses the package on machines that it applies to.

We are planning to release this package on 4/5. Our intention is to make this available and visible before the upcoming patch Tuesday window so administrators and users can choose to deploy it ahead of any other updates pending the following Tuesday. WSUS admins will be able to find this package by its KB number 2524280.

Please note that this package is intended to fix only a very specific case of an upgrade failure. There are many technical reasons that a package may fail to upgrade that we cannot address in this manner. Examples include a damaged registry, Windows installer repository issues or binaries being held by external processes beyond our control. If you need additional assistance please contact your support professional or visit http://support.microsoft.com/ph/12632 .

Forefront Client Security Engineering team

So I’ve been around here at Microsoft for a bit, and have been working with Microsoft products (and products related to Microsoft) for some time, but even now things slip under radar and get missed.

Fortunately, folks like Stefan Schörling  (links to his blog) are fantastic at finding tidbits that can make your job easier.

I wanted to call out a blog post by Stefan about a Codeplex tool called Package This - that allows you to build a custom help file, using the TechNet Library as a source. Coolness in a major way. Wish I had this tool when I was out in the field….

Enjoy!

Hi Everyone,

Microsoft Management Summit is just a few days away in Las Vegas. We hope to see you there. You will see a lot of Forefront Endpoint Protection (FEP) at MMS this year!

Here’s the list of Forefront Endpoint Protection Sessions at MMS, please make sure to check them out. Please stop by at the FEP kiosk and share your feedback with the FEP extended team of engineers and consultants from around the world.

Wed 3/23	10:15a - 11:30a	BI01 Advanced Malware Threat Detection and Removal with Forefront Endpoint Protection 2010
Wed 3/23	4:00p - 5:15p	BI02 Forefront Endpoint Protection Overview: Managing desktop security and antimalware solution with System Center Configuration Manager
Thu 3/24	4:00p - 5:15p	Integrating Management & Security at Microsoft: Forefront Endpoint Protection 2010 deployment case study at Microsoft
Wed 3/23 Thu 3/24	11:45a - 1:00p 4:00p - 5:15p	Forefront Endpoint Protection Overview-Instructor Led Lab
Wed 3/23	5:30p - 6:30p	BOF: Forefront Endpoint Protection 2010 Setup and Configuration (Birds of Feather-Interactive session)

Looking forward to meeting you in Las Vegas!

AJ

Adwait Joshi
Sr. Technical Product Manager
Management and Security Division

Update 9 March 2011

Hello all,

Today (8 March 2011), we released an update to FCSv1.   Changes include:

• This update enables computers running Forefront Client Security to update definitions at the scheduled time while running on battery power.
• This update contains changes to allow computers running Forefront Client Security service to open files encrypted by Prim'X ZoneCentral that are located in a network shared folder.
• This update corrects issues in the mpfilter.sys kernel component used by Client Security that causes real-time protection errors on computers running Windows 2000.

For already installed FCS client installations, install the update for Microsoft Knowledge Base article 2508823 (http://support.microsoft.com/kb/2508823).
For new FCS Client installations, deploy the client components listed in Microsoft Knowledge Base article 2508824 (http://support.microsoft.com/kb/2508824).

For more information about the update, Microsoft Knowledge Base article 2508823 (http://support.microsoft.com/kb/2508823) has the detail.

Thanks!

From Jeff Tondt

Visio is one of the most popular tools for creating diagrams that describe effective systems and processes. In every project in which I participate, when it comes to documenting what you did I always have to create a diagram where I defined architecture, server configuration, network, etc. A picture is worth a thousand words and Visio is the tool of choice in these documentation tasks.

With SMSMap you can read FEP components and ConfigMgr/SMS site roles through COM and automate Visio to draw a diagram of the hierarchy including the FEP SQL Reporting Server, FEP Data Warehouse SQL Server, and the FEP Reporting Component.

Developed by Jeff Tondt this free utility is available at http://www.tondtware.com and works on ConfigMgr SP2 / R3 and down to SMS 2003. Seeing the whole FEP/ConfigMgr hierarchy as a picture can help you quickly understand how your infrastructure is laid out. This handy tool automates creation of your infrastructure documentation and frees you up for other Forefront product installations.

Some screenshots of SMSMap:

Hello folks!

Did you know that Windows 7 SP1 is available for download? Windows 7 SP1 brings some great features to the platform, and everyone's pretty excited about it.

We want to make absolutely clear that Windows 7 SP1 is supported by the following endpoint security products:

• FCS with KB2394433 or later
• MSE v1 with KB2254596 or later
• MSE v2
• FEP 2010  

If in doubt about what you have installed, view your version number, on the Help menu, click About.

If your version is reported in the range of 2.0.1677 to 2.0.2530, then you should:

• Uninstall the unsupported pre-release version of the of the client currently installed, and
• Install one of the release antimalware packages listed above, according to your organizational needs.

Thanks!

Note:  The same statements apply for Windows Server 2008 R2 SP1 as well; you need the same update to allow FCS function. (Douglas Hill 3/23/2010)

So have you ever wondered what the Microsoft SpyNet opt in page is really all about?

Microsoft SpyNet is a cloud service that allows the FEP or MSE client on your computer to report information about programs that exhibit suspicious behavior to the Microsoft Malware Protection Center (MMPC) researchers. When this information is reported, definitions for previously unknown threats can be created and distributed, minimizing the time that a new threat is spreading in the wild before protection is available. (Note: older clients, like FCS and Windows Defender, also participate in SpyNet, but to get the full benefits of SpyNet, which includes Dynamic Signature Service, you should move to FEP or MSE.)

Additionally, when your FEP or MSE client reports new malware to the Microsoft SpyNet cloud service, the Dynamic Signature Service can recognize when a definition is available but not yet released, and deliver that definition for that specific threat in real-time from the cloud. Upon delivery of the dynamic signature, the threat will be detected and can be removed from the system

Hey – here’s a thought. Take 3 minutes and watch this – Microsoft SpyNet and the Dynamic Signature Service in action:

(Please visit the site to view this video)

Hello!

A while back we posted a reporting workbook for the Forefront Endpoint Protection Security Management Pack. This workbook allows you to connect to your FEP Security Management Pack database and create custom reports based on the data contained within the database.

We have a new addition to this – a workbook you can use to create custom FEP reports. This new workbook works in much the same way as the one previously released. You must first connect the workbook to your FEP database, and then you can use the worksheets to generate custom reports based on the data contained within the database.

In order to make it easier for you to find both workbooks, I’ve attached a zip file that contains both of them to this blog article (if you already downloaded the one for the FEP Security Management Pack, it has not changed). Each workbook has instructions on the first worksheet on how to connect it to your database.

Enjoy!

The MscSupport tool is a tool designed to collect support data to troubleshoot Forefront Endpoint Protection. You can download the tool from the Forefront Endpoint Protection 2010 Tools download page (http://www.microsoft.com/downloads/en/details.aspx?FamilyID=04f7d456-24a2-4061-a2ed-82fe93a03fd5).

When to use the MscSupport tool

It is a troubleshooting tool, so you only need to run the tool when you have a problem with Forefront Endpoint Protection.
On the other hand, you don’t need to run the tool with every occasion. Typically you need to collect the MscSupport data in the following scenarios:

• Remote online troubleshooting is difficult
• The cause of the problem is not clear
• You have a Support case with Microsoft

What data does the tool collect

The data collected depends on the system you run the tool on. The tool collects additional information when it is run on the server hosting the FEP2010 server roles.

• Support files (see below), like the FEP log files. For more information about the FEP log files, see http://technet.microsoft.com/en-us/library/gg477022.aspx
• Complete event logs
• Configuration Manager log files (server and/or client) . For more information about Configuration Manager log files, see http://technet.microsoft.com/en-us/library/bb892800.aspx
• Services information
• Running processes
• drivers
• Autoruns
• System info
• Firewall policy

The Support files are files that contain FEP2010 specific information. This information can be gathered when you run the below command (located in C:\Program Files\Microsoft Security Client\Antimalware) in a Command Prompt:

Mpcmdrun -GetFiles

The following data is collected:

• Any trace files from Microsoft Antimalware Service
• The Windows Update history log
• All Microsoft Antimalware Service events from the System event log
• All relevant Microsoft Antimalware Service registry locations
• The log file of this tool
• The log file of the signature update helper tool

Microsoft is committed to protecting your privacy. Please read the Microsoft Privacy Statement<http://go.microsoft.com/fwlink/?LinkId=81184> for more information.

How to run the MscSupport tool

The tool must be executed with Administrator privileges on the system you want to collect the data from, otherwise the data collected by the tool may not be complete.

The data the tool collects will be placed in a cabinet file and is located in %SystemDrive%\MscSupportData

1. Open Windows Explorer and navigate to the location where you stored the tool
2. Right-click MscSupportTool.exe and click Run as administrator
3. The tool will start to collect the support data
   
   
4. When data gathering is complete, you can close or open the folder that contains the CAB file
   
   

Kurt Sarens, Senior Support Engineer

The FEP2010 Reporting account is defined during the FEP server setup, with the installation of the Reporting role to be exact.
The account is used by SQL Reporting Services (SRS) to access the FEP data source used by reporting. Incorrect credentials may result in an error as below or similar:

This post is to provide you with the steps needed to change the reporting account in the occasion you have a need to do so.

Note: all below steps must be executed with an administrator account.

Access to the FEP database used by reporting

These steps must be executed on the SQL Server hosting the data warehouse database (FEPDW_XXX, where XXX is your Configuration Manager site code).

1. Open SQL Management Studio and select Database engine from the Server type list. Enter or browse the SQL Server name hosting the reporting database.
2. Under the Security container in SQL Management Studio, right-click Logins and then click New Login.
3. Enter the login name (including domain) for your new reporting account.
4. On the left-hand side in the Page selection area, select User Mappings.
5. On the right-hand side, select the FEPDW_XXX database.
6. In the Database role membership area below, check AN_ReaderRole and then click OK.

Access to the OLAP cube

These steps must be executed on the SQL server hosting the data warehouse database (FEPDW_XXX, where XXX is your Configuration Manager site code).

1. In SQL Management Studio, select Connect Object Explorer from the File menu.
2. In the Connect to Server window, select Analysis Services from the Server type list.
3. Expand the FEPDW_XXX database and the Roles container.
4. Right-click the ReportsUserReadRole and click Properties.
5. Click the Membership page on the right-hand side.
6. Add your new reporting account if it is not listed on the right-hand pane by clicking the Add button.
7. Remove the old reporting account from the list.

Change the account on the Reporting server

These steps can be executed from any system. XXX is your Configuration Manager site code.

1. Open http://<reportserver>/reports (replace <reportserver> with the name of the report server).
2. Click the Forefront Endpoint Protection_XXX link.
3. Click the Show Details button in the top right.
4. Click the DataSources link.
5. Click the DefaultDataSource link
6. Enter the credentials of the new reporting account and click Apply.

Update the reporting account in the registry

These steps must be executed on the server hosting the FEP2010 Reporting role.

1. Open the registry editor on the reporting server.
2. Navigate to HKLM\Software\Microsoft\Microsoft Forefront\Forefront Endpoint Protection 2010\Server
3. Double-click REPORTUSER and enter the new reporting account (in the format domain\username).
4. Close the registry editor.

Kurt Sarens, Senior Support Engineer

An issue has been identified in Forefront Client Security (FCS) where when viewing the computer details report from the Forefront Client Security management console, the antimalware client version on 64-bit clients is not reported accurately. This is because of an error in the way the Operations Manger 2005 Management Pack collects this information.

During Forefront Client Security installation, the antimalware package creates several registry keys and creates files in several different directories. During the antimalware installation on 64-bit computers, the following key is created under [HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Microsoft Forefront\Client Security\1.0\AM]

"InstallLocation=C:\\Program Files (x86)\\Microsoft Forefront\\Client Security\\Client\\Antimalware\\"

The antimalware version is not reported because the MOM agent is 32-bit and on 64-bit computers runs under Windows on windows subsystem. Because of this the MOM agent queries the WOW6432 node of HKEY_LOCAL_MACHINE. When the MOM script queries for the installation path and gets a value of “C:\Program Files (x86)\Microsoft Forefront\Client Security\Client\Antimalware,” it then attempts to discover the file version for MsMpEng.exe, which is not located in this directory. On 64-bit computers MsMpEng.exe is located in “c:\Program Files\Microsoft Forefront\Client Security\Client\Antimalware. When this query fails, the AM version property is set to “N/A”.

If you are experiencing this issue, we suggest you open a support case with using one of the methods documented here: http://support.microsoft.com/select/Default.aspx?target=assistance

Thanks,

Chris Norman, Senior Escalation Engineer

One of our support engineers, Jeramy Skidmore, has posted a fantastic article on how to provision a limited FEP Administrator in the Configuration Manager console.

He walks you through the process of provisioning the new FEP Administrator, installing the Configuration Manager console and then the FEP console extensions for Configuration Manager, and then creating the custom MMC for the newly provisioned FEP Admin.

Take a look: http://social.technet.microsoft.com/wiki/contents/articles/setting-up-a-new-fep-administrator.aspx

Thanks Jeramy!!

We wanted to update you about an issue with FEP that you may have seen in your organization. This is a known issue, and we’ll keep you up to date with developments.

Symptoms:

Periodically, the FEP data collection job (FEP_GetNewData_FEPDW_xyz) fails. When the job fails, the FEP Health Management Pack for Operations Manager and the FEP BPA report an error with the FEP datawarehouse job either failing or not running. The failure is in one of the following job steps:

• Step 6: End raise error section on DW, raise errors that were thrown from DW DB
• Step 7: ssisFEP_GetErrorsDuringUpload_FEPDW_xyz

Cause:

This happens because of the following scenario:

1. The antimalware client is from time to time sending a malformed malware detection data item to the FEP server.
2. The server tries to process this data item as part of the data collection job (FEP_GetNewData_FEPDW_xyz).
3. During data item processing, the job sees that this data item is malformed and ignores it.
4. After processing completes, the data collection job (FEP_GetNewData_FEPDW_xyz) looks to see if any data items were malformed, and if so, it fails the job.

Impact:

• Malformed data items are lost (they don’t get processed); all properly-formed data items are processed.
• You may experience a small performance impact during the data collection job (FEP_GetNewData_FEPDW_xyz) due to the handling of malformed data items.
• The data collection job (FEP_GetNewData_FEPDW_xyz) appears as failed in the job history.
• If the SQL Server Monitoring Management Pack is installed on your Operations Manager server, the data collection job (FEP_GetNewData_FEPDW_xyz) appears with an error.
• If the Forefront Endpoint Protection Server Health Monitoring Management Pack is installed on your Operations Manager server, the FEP deployment appears as critical and an alert is issued.