Forefront Endpoint Protection Blog

Important information regarding the recent Microsoft Anti-Malware Platform Update

J.C. Hornbeck — Wed, 17 Apr 2013 15:09:36 GMT

As you may be aware, after our recent announcement regarding the Microsoft Anti-Malware Platform Update, the two stand-alone releases (KB2831312 and KB2831316) were temporarily removed from Microsoft Update on April 10. This was because of a detection logic issue that was discovered with the Windows Defender platform update made available to Windows 8 clients (see http://support.microsoft.com/kb/2781197). The Windows Defender update was being erroneously offered to clients that had the new FEP or SCEP platform updates applied, leading to installation failures of KB2781197 that were misleading as the update does not actually apply when FEP or SCEP have been updated to the latest platform.

This has been addressed and these updates will be restored on Wednesday April 17 (today).

The KB articles for these updates are as follows:

Stand-alone / Unmanaged Clients:

KB2831312 - An anti-malware platform update for stand-alone Forefront Endpoint Protection 2010 clients is available from Microsoft Update (http://support.microsoft.com/kb/2831312)

KB2831316 - An anti-malware platform update for stand-alone System Center 2012 Endpoint Protection Service Pack 1 clients is available from Microsoft Update (http://support.microsoft.com/kb/2831312)

Managed Clients (by Configuration Manager 2007 for FEP, or by System Center 2012 Configuration Manager for SCEP):

KB2827684 - An anti-malware platform update for Forefront Endpoint Protection 2010 clients is available from Microsoft Support (http://support.microsoft.com/kb/2827684)

KB2828233 - An anti-malware platform update for System Center 2012 Endpoint Protection Service Pack 1 clients is available from Microsoft Support (http://support.microsoft.com/kb/2828233)

As noted in the KB articles, these updates may require reboots during installation.

Note that managed customers (using Configuration Manager 2007 or System Center 2012 Configuration Manager) may also see failures when installing update KB2781197 on Windows 8 clients that have the FEP or SCEP platform update applied. These failures can be ignored and should cease now that the update KB2781197 detection logic has been revised.

J.C. Hornbeck | Knowledge Engineer | Microsoft GBS Management and Security Division

Get the latest System Center news on Facebook and Twitter:

System Center All Up: http://blogs.technet.com/b/systemcenter/
System Center – Configuration Manager Support Team blog: http://blogs.technet.com/configurationmgr/
System Center – Data Protection Manager Team blog: http://blogs.technet.com/dpm/
System Center – Orchestrator Support Team blog: http://blogs.technet.com/b/orchestrator/
System Center – Operations Manager Team blog: http://blogs.technet.com/momteam/
System Center – Service Manager Team blog: http://blogs.technet.com/b/servicemanager
System Center – Virtual Machine Manager Team blog: http://blogs.technet.com/scvmm

Windows Intune: http://blogs.technet.com/b/windowsintune/
WSUS Support Team blog: http://blogs.technet.com/sus/
The AD RMS blog: http://blogs.technet.com/b/rmssupp/

App-V Team blog: http://blogs.technet.com/appv/
MED-V Team blog: http://blogs.technet.com/medv/
Server App-V Team blog: http://blogs.technet.com/b/serverappv

The Forefront Endpoint Protection blog : http://blogs.technet.com/b/clientsecurity/
The Forefront Identity Manager blog : http://blogs.msdn.com/b/ms-identity-support/
The Forefront TMG blog: http://blogs.technet.com/b/isablog/
The Forefront UAG blog: http://blogs.technet.com/b/edgeaccessblog/

KB: How to restore files quarantined by Endpoint Protection to an alternative location

J.C. Hornbeck — Wed, 10 Apr 2013 16:07:45 GMT

A file quarantined by Forefront Endpoint Protection 2010 (FEP 2010) or System Center 2012 Endpoint Protection (SCEP 2012) may be restored to an alternative location by using the MPCMDRUN command-line tool. The syntax is explained in the article below:

KB2834037 - How to restore files quarantined by Endpoint Protection to an alternative location (http://support.microsoft.com/kb/2834037)

J.C. Hornbeck | Knowledge Engineer | Microsoft GBS Management and Security Division

Get the latest System Center news on Facebook and Twitter:

Windows Intune: http://blogs.technet.com/b/windowsintune/
WSUS Support Team blog: http://blogs.technet.com/sus/
The AD RMS blog: http://blogs.technet.com/b/rmssupp/

App-V Team blog: http://blogs.technet.com/appv/
MED-V Team blog: http://blogs.technet.com/medv/
Server App-V Team blog: http://blogs.technet.com/b/serverappv

KB: Updating the antimalware definitions in FEP/SCEP fails with error 0x80248014

J.C. Hornbeck — Tue, 09 Apr 2013 16:26:48 GMT

We just published a new KB article that explains an issue where you receive error 0x80248014 when trying to manually update the antimalware definitions on a Win8 computer running FEP 2010 or SCEP 2012 installed. You can find the complete article here:

KB2832355 - Updating the antimalware definitions in FEP/SCEP fails with error 0x80248014 (http://support.microsoft.com/kb/2832355)

J.C. Hornbeck | Knowledge Engineer | Microsoft GBS Management and Security Division

Get the latest System Center news on Facebook and Twitter:

Windows Intune: http://blogs.technet.com/b/windowsintune/
WSUS Support Team blog: http://blogs.technet.com/sus/
The AD RMS blog: http://blogs.technet.com/b/rmssupp/

App-V Team blog: http://blogs.technet.com/appv/
MED-V Team blog: http://blogs.technet.com/medv/
Server App-V Team blog: http://blogs.technet.com/b/serverappv

The Microsoft anti-malware platform will be updated today

J.C. Hornbeck — Tue, 09 Apr 2013 13:53:57 GMT

The anti-malware platform will be updated Tuesday April 9, 2013 across multiple products. These products include Forefront Endpoint Protection 2010 and System Center 2012 Endpoint Protection SP1 standalone clients, and the managed versions of both. For all the details please see the following:

Announcement: Microsoft Anti-Malware Platform Update (http://blogs.technet.com/b/configmgrteam/archive/2013/04/05/announcement-microsoft-anti-malware-platform-update.aspx)

J.C. Hornbeck | Knowledge Engineer | Microsoft GBS Management and Security Division

Get the latest System Center news on Facebook and Twitter:

Windows Intune: http://blogs.technet.com/b/windowsintune/
WSUS Support Team blog: http://blogs.technet.com/sus/
The AD RMS blog: http://blogs.technet.com/b/rmssupp/

App-V Team blog: http://blogs.technet.com/appv/
MED-V Team blog: http://blogs.technet.com/medv/
Server App-V Team blog: http://blogs.technet.com/b/serverappv

KB: Clicking the Update button in the System Center 2012 Endpoint Protection client user interface fails with error 0x8024402c

J.C. Hornbeck — Wed, 03 Apr 2013 17:15:06 GMT

Just a quick note on a new Knowledge Base article we just published on SCEP 2012. This article discusses an issue where in a very specific scenario, clicking the Update button in the System Center 2012 Endpoint Protection client user interface fails with error 0x8024402c. See the KB article below for details:

KB2831244 - Clicking the Update button in the System Center 2012 Endpoint Protection client user interface fails with error 0x8024402c (http://support.microsoft.com/kb/2831244)

J.C. Hornbeck | Knowledge Engineer | Microsoft CTS Management and Security Division

Get the latest System Center news on Facebook and Twitter:

Windows Intune: http://blogs.technet.com/b/windowsintune/
WSUS Support Team blog: http://blogs.technet.com/sus/
The AD RMS blog: http://blogs.technet.com/b/rmssupp/

App-V Team blog: http://blogs.technet.com/appv/
MED-V Team blog: http://blogs.technet.com/medv/
Server App-V Team blog: http://blogs.technet.com/b/serverappv

KB: How to setup a mirror on a Linux server running System Center 2012 Endpoint Protection

J.C. Hornbeck — Mon, 01 Apr 2013 18:21:17 GMT

The mirror functionality is a feature to distribute definition updates to Linux clients running System Center 2012 Endpoint Protection (SCEP) that do not have an Internet connection. The procedure in this article outlines the steps to setup a mirror on a Linux server running System Center 2012 Endpoint Protection for Linux, as well as the steps to configure Linux clients to retrieve definition updates from the mirror.

You can find the complete article here:

KB2827654 - How to setup a mirror on a Linux server running System Center 2012 Endpoint Protection (http://support.microsoft.com/kb/2827654)

J.C. Hornbeck | Knowledge Engineer | Microsoft CTS Management and Security Division

Get the latest System Center news on Facebook and Twitter:

Windows Intune: http://blogs.technet.com/b/windowsintune/
WSUS Support Team blog: http://blogs.technet.com/sus/
The AD RMS blog: http://blogs.technet.com/b/rmssupp/

App-V Team blog: http://blogs.technet.com/appv/
MED-V Team blog: http://blogs.technet.com/medv/
Server App-V Team blog: http://blogs.technet.com/b/serverappv

The System Center Security Monitoring Pack for Endpoint Protection now supports System Center 2012 Operations Manager SP1

J.C. Hornbeck — Wed, 13 Feb 2013 17:23:31 GMT

Just a quick note to let you know that we’ve completed app compatibility testing for the System Center Security Monitoring Pack for Endpoint Protection and it now officially supports System Center 2012 Operations Manager Service Pack 1. No updates or changes are required.

J.C. Hornbeck | Knowledge Engineer | Management and Security Division

Get the latest System Center news on Facebook and Twitter:

Windows Intune: http://blogs.technet.com/b/windowsintune/
WSUS Support Team blog: http://blogs.technet.com/sus/
The AD RMS blog: http://blogs.technet.com/b/rmssupp/

App-V Team blog: http://blogs.technet.com/appv/
MED-V Team blog: http://blogs.technet.com/medv/
Server App-V Team blog: http://blogs.technet.com/b/serverappv

Forefront Endpoint Protection 2010 (FEP 2010) now supports SQL Server 2012 SP1

J.C. Hornbeck — Tue, 12 Feb 2013 16:52:15 GMT

Forefront Endpoint Protection 2010 now supports upgrading an existing Forefront Endpoint Protection database and reporting database to Microsoft SQL Server 2012 Service Pack 1.

To use SQL Server 2012 SP1 with Forefront Endpoint Protection 2010, you must upgrade the existing instance of SQL Server from SQL Server 2008, SQL Server 2008 R2 or SQL Server 2012. It is not supported to install new Forefront Endpoint Protection components on an existing or new instance of SQL Server 2012 or SQL Server 2012 SP1.

The following update is required to use Forefront Endpoint Protection with Microsoft SQL Server 2012 and 2012 SP1:

KB2683558 - Forefront Endpoint Protection data warehouse and reports fail to get new data on SQL Server 2012 (http://support.microsoft.com/kb/2683558)

J.C. Hornbeck | Knowledge Engineer | Management and Security Division

Get the latest System Center news on Facebook and Twitter:

Windows Intune: http://blogs.technet.com/b/windowsintune/
WSUS Support Team blog: http://blogs.technet.com/sus/
The AD RMS blog: http://blogs.technet.com/b/rmssupp/

App-V Team blog: http://blogs.technet.com/appv/
MED-V Team blog: http://blogs.technet.com/medv/
Server App-V Team blog: http://blogs.technet.com/b/serverappv

Important update for SCEP/FEP users

J.C. Hornbeck — Tue, 05 Feb 2013 17:22:36 GMT

Hi all, the following update was released towards the end of last year as a Critical (non-security) Update via Windows Update. The update addresses an issue with the Windows Filtering Platform that would cause the Network Inspection System (NIS) feature of System Center Endpoint Protection (SCEP) and Forefront Endpoint Protection (FEP) to drastically slow down network performance when actively protecting machines. The KB article can be found here:

KB2735855 - Network connection is slow when you run a WFP-based application on a computer that is running Windows 7 or Windows Server 2008 R2 (http://support.microsoft.com/kb/2735855)

If you have SCEP or FEP deployed, or any firewall/AV software that leverages the Windows Filtering Platform, it is strongly recommended that you deploy this update if you use NIS.

J.C. Hornbeck | Knowledge Engineer | Management and Security Division

Get the latest System Center news on Facebook and Twitter:

Windows Intune: http://blogs.technet.com/b/windowsintune/
WSUS Support Team blog: http://blogs.technet.com/sus/
The AD RMS blog: http://blogs.technet.com/b/rmssupp/

App-V Team blog: http://blogs.technet.com/appv/
MED-V Team blog: http://blogs.technet.com/medv/
Server App-V Team blog: http://blogs.technet.com/b/serverappv

KB: Attempting to export a Malware Policy in Endpoint Protection fails with "Specified Settings Failed to be Exported"

J.C. Hornbeck — Mon, 10 Dec 2012 21:40:00 GMT

Just a quick heads up on a KB article we just published. This one talks about an issue where attempting to export an Antimalware policy in System Center 2012 Endpoint Protection 2012 (SCEP) fails with the error:

The specified settings failed to be exported!

In this case, the error occurred because the policy had an ampersand character (&) in the name but other characters such as ", ', < and > can cause it as well. You can read the entire article here:

2784157 - Attempting to export a Malware Policy in Endpoint Protection fails with "Specified Settings Failed to be Exported" (http://support.microsoft.com/kb/2784157)

J.C. Hornbeck | Knowledge Engineer | Management and Security Division

Get the latest System Center news on Facebook and Twitter:

Windows Intune: http://blogs.technet.com/b/windowsintune/
WSUS Support Team blog: http://blogs.technet.com/sus/
The AD RMS blog: http://blogs.technet.com/b/rmssupp/

App-V Team blog: http://blogs.technet.com/appv/
MED-V Team blog: http://blogs.technet.com/medv/
Server App-V Team blog: http://blogs.technet.com/b/serverappv