On a system running the FCS Client, you may run into the event listed below which occurs on the local system and may cause an Alert to fire on the FCS Console.

This issue can occur when the client system has had a Real-time protection Security Agent de-selected in the FCS Client UI.

For example, if you do the following and restart the system or restart the Microsoft Forefront Client Security AntiMalware Service you will receive the event.

1.  Go to Tools/Options in the FCS Client UI
2.  Uncheck any of the security agents under "Use real-time protection"
3.  Restart the AM service or reboot the system

The following event is logged -

Event Type: Error
Event Source: FCSAMRtp
Event Category: None
Event ID: 3002
Date:  9/20/2008
Time:  7:00:38 PM
User:  N/A
Computer: FCS Client
Description:
Microsoft Forefront Client Security Real-Time Protection agent has encountered an error and failed.
  User: Domain\administrator
  Agent: Application Execution
  Error Code: 0x8007139f
  Error description: The group or resource is not in the correct state to perform the requested operation.

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.

This error can be ignored if one of the Security Agents provided by Real-time protection have been intentionally disabled.

Thanks and please post any comments or questions.

Shain Wray

Security Technical Lead