On a system running the FCS Client, you may run into the event listed below which occurs on the local system and may cause an Alert to fire on the FCS Console.
This issue can occur when the client system has had a Real-time protection Security Agent de-selected in the FCS Client UI.
For example, if you do the following and restart the system or restart the Microsoft Forefront Client Security AntiMalware Service you will receive the event.
1. Go to Tools/Options in the FCS Client UI2. Uncheck any of the security agents under "Use real-time protection"3. Restart the AM service or reboot the system
The following event is logged -
Event Type: ErrorEvent Source: FCSAMRtpEvent Category: NoneEvent ID: 3002Date: 9/20/2008Time: 7:00:38 PMUser: N/AComputer: FCS ClientDescription:Microsoft Forefront Client Security Real-Time Protection agent has encountered an error and failed. User: Domain\administrator Agent: Application Execution Error Code: 0x8007139f Error description: The group or resource is not in the correct state to perform the requested operation.
For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.
This error can be ignored if one of the Security Agents provided by Real-time protection have been intentionally disabled.
Thanks and please post any comments or questions.
Security Technical Lead