Forefront Client Security Support Blog

New KB published on Forefront Client Security definition updates

2010-01-12T21:08:24Z

Ever wonder about what FCS clients are actually downloading when they update? Have you clicked on “File Information” option in WSUS or downloaded a package from the Microsoft Update catalog, seen a long list of update files, and questioned what they were?

For answers to these questions and more see: http://support.microsoft.com/?id=977939

Thanks,
Craig Wiand
Microsoft Forefront Escalation Engineer

Distribution Component

2009-07-27T17:01:00Z

Back in October, the Forefront Client Security product team made an announcement that WSUS 3.0 on 64bit OS would be a supported scenario and to not install the Distribution component on 64bit Operating systems.

"Also, we are announcing support for definition distribution via WSUS 3.0 installed on an x64-based platform. To support this configuration, the FCS distribution component must not be installed on the x64-based WSUS 3.0 server, as WSUS 3.0 does not require the installation of the FCS distribution component. Existing FCS documentation will be updated accordingly"

This announcement and WSUS 2.0 officially reaching end of life and no longer being supported have generated numerous questions on the distribution component. Is it still required to be installed on 32bit Operating systems now that all installs of FCS are on WSUS 3.0 or later? I wanted to take a minute and explain the purpose of the distribution component and if it is still required.

Forefront Client Security v1 was designed to take advantage of the WSUS 2.0 infrastructure to distribute the FCS anti-malware client and signature updates. The one drawback to this design was that WSUS 2.0 only synchronized updates once a day. With a goal of publishing definition updates approximately every 8 hours at a minimum, there needed to be a method of having WSUS 2.0 checking for updates multiple times a day. If nothing was done to change the synchronization behavior of WSUS 2.0, a FCS anti-malware client using that WSUS server for updates may not have the latest definition updates which would leave it at an increased risk of infection.

The Distribution component was released with Forefront Client Security v1 and was designed to address the issue of synchronizing updates multiple times in one day on WSUS 2.0. In addition, the Distribution component accomplished the three following tasks:

Adds the Forefront Client Security product to the list of products synchronized
Adds Definition Updates to the category of updates synchronized
Creates an Auto-Approve rule for “All Computer” for Definition Updates

With the release of WSUS 3.0 the ability to configure how often the server synchronizes the available updates (http://technet.microsoft.com/en-us/library/cc708616(WS.10).aspx) was included in the product. This removes the key reason for the distribution component. It can still be used but is no longer required on WSUS 3.0 or later to keep the server up-to-date.

When deploying WSUS 3.0 or later if you do not install the Distribution component you will need to accomplish the following tasks to receive the FCS Product and Anti-malware definition updates:

· Change the synchronization frequency to greater than once daily

· Add Forefront Client Security to the list of products to synchronize

http://technet.microsoft.com/en-us/library/cc708616(WS.10).aspx

· Add Definition Updates to the classifications of updates to be synchronized

· Create the Auto-Approval for the FCS and definition Updates.

* Because of Eula's On Client updates you may still have to manually approve certain non-definition updates.

http://technet.microsoft.com/en-us/library/cc708474(WS.10).aspx

Thanks and have a great Day,

Chris Norman
Senior Support Engineer

After install of KB971026 for FCS, the full Client package for FCS is re-offered from WSUS

2009-06-20T01:07:00Z

Yesterday Microsoft released KB971026 which is an update to the FCS Antimalware engine. This update installs successfully without issues. However, after this update is applied, the initial FCS Client package called "Client Update for Microsoft Forefront Client Security (1.0.1703.0)" on the WSUS server would then be offered to the system. If the Client Update for Microsoft Forefront Client Security (1.0.1703.0) package attempted to install, it would fail as there is already a later version of the FCS Antimalware engine on the system. The Client Update for Microsoft Forefront Client Security (1.0.1703.0) package would then be continually offered and continually fail to install.

This issue has been resolved with an update to the metadata for the Client Update for Microsoft Forefront Client Security (1.0.1703.0) package. There was never an issue with KB971026, it did however expose an issue with the Client Update for Microsoft Forefront Client Security (1.0.1703.0) package.

In order to apply this fix. Please perform the following -

1. Customers will need to sync their WSUS servers to get the updated metadata.

2. The affected systems will need to have a detection cycle run on the clients in order for the package to stop continually being offered. Please note that the detection cycle will happen automatically within 24 hours or less depending on the automatic updates settings for detection frequency that are set via the policy.

If you have any questions, please feel free to post them.

Thanks,

Shain Wray

Security Technical Lead

Understanding catch-up scans

2009-06-18T18:17:06Z

A catch-up scan is a scan that is initiated because a regularly scheduled Forefront Client Security antimalware scan was missed. Usually these scheduled scans are missed because the computer was turned off at the scheduled time. The FCS documentation at http://technet.microsoft.com/en-us/library/bb418896.aspx states:

Scheduled malware scans enable you to choose the time of day when the Client Security agent on each managed computer begins a scan. This enables you to select a time that is likely to have minimal impact on users. You can also configure whether a scheduled scan is a full scan or a quick scan. If a client computer is offline for two consecutive scheduled scans, Client Security starts a scan the next time someone logs on to the computer. For more information, see Configuring scheduled and interval malware scans.

To expand on this, scans can be scheduled to run either daily or weekly and either full or quick scans. If there is no scheduled scan configured, there will be no catch-up scan run. If the scheduled scan is configured for daily, then after two days of being missed the next time the antimalware service starts, after a short delay of about ten to twenty minutes, the missed scheduled scan will be run. The scan type will be based upon the scan type of the scheduled scan: if a full scan is scheduled the catch-up scan will be a full, if the scheduled scan is a quick scan the catch-up scan will also be a quick. If the scan is configured for weekly, then after missing the scan two consecutive weeks the next time the antimalware service starts, after a short delay of about ten minutes, the missed scheduled scan will be run. The number scans missed(two) before the catch-up scan is invoked is non-configurable.

In the current version, the Forefront Client Security antimalware client differentiates scans initiated through the UI from scans initiated through the command line of scheduled tasks. Scans invoked through the antimalware UI do not count as “scheduled” and cannot can be used to avoid catch-up scans. The only exception to this is if a computer has never run a scheduled scan; this helps prevent prevent newly installed clients from running a catch-up scan when they receive policy.

If you miss a scheduled scan and want to run your own catch-up scan so it will run at a convenient time, you should invoke the scan through the command line:

“%programfiles%\Microsoft Forefront\Client Security\Client\antimalware\mpcmdrun.exe” –Scan

Additionally, catch-up scans are only applicable to scans that are scheduled for a particular time, they do not apply to interval-based scans as shown below

An interval scan is essentially just a timer that starts roughly when the service starts. If the computer is rebooted, the service is restarted, or the scan interval changes the timer is reset.

By default catch-up scans will be enabled. If you do not wish to run catch-up scans you may use an ADM file and set the following registry key HKEY_LOCAL_MACHINE\ SOFTWARE\Policies\Microsoft\Microsoft Forefront\Client Security\1.0\AM\Scan – DisableCatchUpScan . You can cut-and-paste the below example into a text file and rename it to an ADM to test this:

CLASS MACHINE
CATEGORY !!FCSCategory
          POLICY !!CatchUp_Name
                   KEYNAME "SOFTWARE\Policies\Microsoft\Microsoft Forefront\Client Security\1.0\AM\Scan"

                   EXPLAIN !!CatchUp_Explain
                   VALUENAME DisableCatchupScan
                     VALUEON NUMERIC 1
                     VALUEOFF NUMERIC 0
          END POLICY
END CATEGORY
[strings]
FCSCategory="Microsoft FCS Scan Override"
CatchUp_Name="Disable Catch-up Scan"
CatchUp_Explain="This setting instructs the FCS antimalware client not to re-attempt a missed scan"

Thanks,
Craig Wiand
Microsoft Forefront Escalation Engineer

Testing FCS antimalware detection with your own library

2009-04-15T23:13:55Z

During evaluation of the Forefront Client Security antimalware protection many customers will review the information provided by independent antimalware testers such as

(When reading these sites, note that Microsoft’s Forefront Client Security and OneCare products use the same malware protection engine and definitions)

Other customers may want to test FCS detection capabilities against their own private malware library. Doing this with a large library can present somewhat of a challenge because the user interface can becoming quite filled and slow to respond when filled with thousands of entries. Alternatively, you might try to examine the event log for 3004 events(real-time protection detected threats) and/or 1006 events (scan detected threats).

The problem with both the user interface and the event log query is that FCS will consolidate threats of the same type into a single infection report. Therefore, if you have 5,000 sample files but only 4,500 are unique (e.g. you have multiple EICARs or multiple RBOTs.gens) then you will get a maximum of 4,000 detection events or items in the UI. Why does FCS do this aggregation? It is done because in a typical “real-world environment” administrators will act on malware as a whole rather than have different actions for different instances, components, or files of a malware threat. It also ensures removal is done properly and threats are not only partially addressed.

To illustrate this behavior, I used a single copy of EICAR and nine of the different SpyCar samples in a test with FCS. So although I have 10 total files, FCS shows the following:

Notice that FCS says that only 2 items were detected. To a casual reviewer unfamiliar with the FCS behavior described above this would leave the impression that FCS only detected 20% of the files. While it is easy to understand what is happening in this trivial example, it is more difficult in a larger library.

By investigating the detection further, and scrolling down, we can see that the files for each threat are listed as resources:

This is also true of the event log entries:

Log Name: System
Source: FCSAM
Date: 4/15/2009 3:36:21 PM
Event ID: 1006
Task Category: None
Level: Warning
Keywords: Classic
User: N/A
Computer: computer.microsoft.com
Description:

Microsoft Forefront Client Security scan has detected spyware or other potentially unwanted software.

For more information please see the following:

http://go.microsoft.com/fwlink/?linkid=37020&name=Tool:Win32/SpycarTestSuite&threatid=17424

Scan ID: {FF8CDDEA-1CE8-4644-97FB-55C5C36329C9}
Scan Type: AntiMalware
Scan Parameters: Custom Scan
User: DOMAIN\craigw
Name: Tool:Win32/SpycarTestSuite
ID: 17424
Severity: Severe
Category: Tool
Path Found: file:C:\fcstest\IE-SetSearchPage.exe;file:C:\fcstest\IE-SetHomePage.exe;file:C:\fcstest\IE-KillAdvancedTab.exe;file:C:\fcstest\IE-HomePageLock.exe;file:C:\fcstest\HKLM_RunOnceEx.exe;file:C:\fcstest\HKLM_RunOnce.exe; file:C:\fcstest\HKLM_Run.exe;file:C:\fcstest\HKCU_Run.exe;file:C:\fcstest\AlterHostsFile.exe
Detection Type: Concrete

So to properly determine the number of files (not different threats) you would need to find each detection and count the number of file based resources associated with it. This is clearly a challenging undertaking for a large malware library. It can be helped somewhat by leveraging the MpLog-xxx-xxx.log file found in the %ALLUSERSPROFILE%\Application Data\microsoft\Microsoft Forefront\Client Security\Client\Antimalware\Support directory. It will list the total number of threats found, and then the count of resources for each threat:

Product Version: 1.5.1958.0
Engine Version: 1.1.4502.0
AS Signature Version: 1.55.1678.0
AV Signature Version: 1.55.1678.0
************************************************************
Begin Resource Scan
Scan ID:{FF8CDDEA-1CE8-4644-97FB-55C5C36329C9}
Scan Source:1
Start Time:Wed Apr 15 2009 15:35:30
End Time:Wed Apr 15 2009 15:36:21
Explicit resource to scan
Resource Schema:folder
Resource Path:@S-1-5-21-124525095-708259637-1543119021-1851\C:\fcstest\
Threat Count:2

Threat Name:Tool:Win32/SpycarTestSuite
ID:17424\
Severity:5
Number of Resources:9
Resource Schema:file
Resource Path:C:\fcstest\IE-SetSearchPage.exe
SigSeq:37829992017238
Resource Schema:file
Resource Path:C:\fcstest\IE-SetHomePage.exe
SigSeq:37827904169718
Resource Schema:file
Resource Path:C:\fcstest\IE-KillAdvancedTab.exe
SigSeq:37829556567249
Resource Schema:file
Resource Path:C:\fcstest\IE-HomePageLock.exe
SigSeq:37827406791016
Resource Schema:file
Resource Path:C:\fcstest\HKLM_RunOnceEx.exe
SigSeq:37828071703283
Resource Schema:file
Resource Path:C:\fcstest\HKLM_RunOnce.exe
SigSeq:37829705680185
Resource Schema:file
Resource Path:C:\fcstest\HKLM_Run.exe
SigSeq:37827006632665
Resource Schema:file
Resource Path:C:\fcstest\HKCU_Run.exe
SigSeq:37825853825063
Resource Schema:file
Resource Path:C:\fcstest\AlterHostsFile.exe
SigSeq:37826058080799

Threat Name:Virus:DOS/EICAR_Test_File
ID:2147519003
Severity:5
Number of Resources:1
Resource Schema:file
Resource Path:C:\fcstest\eicar.com
SigSeq:5866324352432
End Scan
************************************************************

When we sum up the detected resources we see that FCS did indeed detect all 10 files.

Another testing approach would be to set all of the default actions to remove via the FCS client Tools > Options UI:

Then stop the FCS service(net stop FCSAM), copy the malware library to the machine, restart the FCS service(net start FCSAM), run a custom scan of the folder, and then choose to Apply Actions in the detection dialog. This should remove all the threats and resources detected. If any threats remain in the folder after the action has completed that would indicate that either there was no detection or there was a failure to remove them. Failures would be reflected in both the UI and the event log.

If you find malware that FCS does not detect or detects but has problems removing, please submit it through the Microsoft Malware Protection Center portal.

Thanks,
Craig Wiand
Microsoft Forefront Escalation Engineer

Slipstreaming a Client Security client installation

2009-04-01T15:27:00Z

As I mentioned in my previous blog posting, there have been several updates to the FCS antimalware client since its release. Through traditional deployment methods you will install the release to manufacturing components(RTM) of the FCS client which has no updates and extremely limited detection capabilities. At installation, the client has the base 1.0.0.0 antimalware definitions. Immediately after the installation it will use the Windows Update API(WUA) to attempt to download the current definitions from either your WSUS server or Microsoft Update(whichever it is configured for). During the next Automatic Updates cycle it will download the latest antimalware update(currently KB956280) and install it.

At the time this posting was made Microsoft has not published an updated FCS client package to WSUS (although it is being considered) or revised the CD media available for download. Therefore, if you choose to deploy the FCS client via WSUS or the CD it will go through the above RTM installation and then subsequent update.

If you are doing a manual, scripted, or System Center Configuration Manager/SMS/similar style of deployment then you can update the antimalware client installation package to install the latest version, instead of the RTM. You can do this through the following steps:

1. Determine the latest version of the antimalware client. This link points to the KB article http://go.microsoft.com/fwlink/?LinkId=125926 for that version

(above the article number is 956280)

2. Visit the Microsoft Update catalog and query for “Forefront Client Security” http://catalog.update.microsoft.com/v7/site/Search.aspx?q=forefront%20client%20security

3. Add the appropriate language of the KB from Step #1 to your basket and download (both x86 and x64 will be included).

4. Extract the contents from the update package

Open a command prompt
Change directory to the download location
Run the executable with a /extract switch for each package:
>all-fcsam-kb956280-x64-enu_1dfb1029721f86ea98674400ffcb5cba629d0bc8.exe /extract
In the dialog presented, enter a temporary directory

5. Locate the mp_ambits.msi file in the temporary directory extracted contents

6. Copy the entire client directory from the CD media (including the MSI files, KB914882 installers, and the x64 subdirectory) to the deployment location(typically a file share)

7. Replace the mp_ambits.msi in the deployment location with the extracted copies of both x86 and x64 in their respective \client and \client\x64 directories

Using this method will deploy a slipstreamed FCS antimalware client; however, that client will still have the base 1.0.0.0 definitions and invoke a WUA download of definitions at installation completion. This download cannot be prevented in the current version of the FCS product. If you were scripting an installation and did not wish this WUA download to occur, you might disable network connectivity or temporarily stop the Automatic Updates service and use a standalone definition update installation. The standalone definition installers are also available from the Microsoft Update catalog website shown in the screenshot above as well as through links off of the MMPC portal and KB938202.

Thanks,
Craig Wiand
Forefront Client Security Escalation Engineer

MarioForever Detection Issue With FCS

2008-12-16T19:02:00Z

On or about December 9^th, Microsoft Malware Protection Center included new information in the FCS definitions to ‘clean' the file ‘user32.dll' in the system32 and system32\dllcache folders which may have been modified at some earlier time by the Marioforever malware. Most of these infections occurred in May/June 2008. In those cases, signature updates were provided to quarantine/remove the actual malicious code (executables) from affected machines. However, the malware also modified part of the user32.dll file (a core Windows file) which will now be successfully restored by FCS.

A side effect of this is that FCS may now detect certain components which it may not have detected previously, though the malware has been disabled since it was originally detected.

Important things to note:

This is only applicable to FCS customers who were previously exposed to the Marioforever malware, and then subsequently cleaned.
This is not a re-infection.

Thanks,

Faron

Security Technical Lead

Changing the management group to which an FCS client reports

2008-11-13T00:13:00Z

During the course of your FCS deployment it may be necessary to redirect an FCS client from one FCS collection server to another. Common reasons why an admin would do this include moving the machines from a test server to a production server or load balancing machines across down-level installations of an Enterprise Manager deployment. Note: if you are migrating FCS topologies which involves changing the collection server name then you should follow the steps in the collection server topology migration guide.

After reading the FCS deployment guide, it is easy to fall into the misconception that you can simply deploy new policy to that computer and it will automatically see the server name change and begin reporting to the new server. Unfortunately this is not the case. As summarized here:

In standard Client Security deployment, Client Security agents are deployed to target managed computers by creating and deploying a Client Security policy. This policy writes the names of the Client Security collection server and the Client Security Management group to the target computers. The computers then download the Client Security agent from the distribution server, and they install it with the configuration information from the Client Security policy. This results in the target computers reporting to the Client Security Management group that created the Client Security policy.

The key aspect of this is that the management group and collection server names are only read during installation time. Deploying new policy will change these registry keys but it will not change the configuration of the MOM agent, which is responsible for sending data to the collection server. Therefore, to redirect the FCS client we must modify the configuration of the MOM agent.

There are several ways to do this, each having their advantages and disadvantages. Your choice will likely depend on the number of clients being redirected and the configuration of those clients. Note that special care should be used on a FCS collection server or a MOM 2005 management server, in most cases it is inappropriate to script the MOM agent to those machines and one should manually run clientsetup.exe. Additionally, reconfiguring the MOM agent requires administrative rights and scripts shown below will require an elevated command prompt.

Add/Remove Programs (Uninstall or change a program)

Perhaps the most straightforward way to modify the MOM agent configuration is by going into Add/Remove Programs locating Microsoft Operations Manager 2005 Agent and choosing Change. Click, Next on the welcome screen and then choose the Modify option. What you do next will depend on the nature of the redirection, specifically the question you should be asking is “Does the name of the management group differ between these installations?”

If the group name will be the same then you would want to choose the “Modify Management Group” and then change the Management server name field to be the new FCS collection server(yes this is a mix of FCS and MOM terminology)

If you are load balancing across down-level installations or moving from test to production then it is possible that the management group names will differ. In this case, you will want to run the installation wizard twice. The first time choose “Add a new management group” and enter the new management group name and the new collection server name. The second time you should choose the “Remove management group” option and ensure that old management group is chosen in the dropdown list. In effect, you are momentarily reporting to both installations. This is the basic guidance presented in the MOM 2005 documentation.

In all the installation options during the wizard you should choose a port of 1270, an Agent Control Level of Full, and a MOM agent action account of LocalSystem. These setting are what FCS clientsetup.exe uses.

Since this activity will modify/reinstall the MOM agent on the client after the agent has been redirected a service dependency on WMI must be recreated to ensure proper functioning of the MOM agent. To recreate this service dependency enter the following from a command prompt which sets it and then restarts the MOM service: sc config mom depend= rpcSs/eventLog/winmgmt & net stop mom & net start mom (note the space after the equal sign in necessary).

Advantages

· Changes made through UI wizards; no scripting required

· No gap in data reporting

· Does not require access to FCS CD media

· Works with multi-homed agents

Disadvantages

· Extremely time consuming and prone to error for a large number of clients

· Requires familiarity with the previous and new management server and group names

Command line invocation of the MOM agent

As mentioned above if you have a large number of clients using Add/Remove can be cumbersome. Luckily, the MOMAgent.msi file has documented command line parameters. You can use the command line installation options in exactly the same way that you would use the wizards. Additionally, since the MOM agent is already on the machine, we can invoke it using its local MSI package without requiring a copy of the FCS CD media, this is done using a GUID passed to MsiExec.exe.

If the management group will remain the same and only the server name is different you would use the ModifyConfigGroup operation like(bolded parameters should be changed to match your environment):

MsiExec.exe /I{F692770D-0E27-4D3F-8386-F04C6F434040} /norestart /qn /l*v "C:\MOMReinstall.log" CONFIG_GROUP=" SameManagementGroup "
CONFIG_GROUP_OPERATION="ModifyConfigGroup" MANAGEMENT_SERVER="newserver.corp.com" AM_CONTROL="Full" REQUIRE_AUTH_COMMN=1 REINSTALL="ALL"

If the new server the client will report to has a different management group name you would use an AddConfigGroup operation and then a RemoveConfigGroup operation:

MsiExec.exe /I{F692770D-0E27-4D3F-8386-F04C6F434040} /norestart /qn /l*v "C:\MOMAdd.log" CONFIG_GROUP="NewManagementGroup" CONFIG_GROUP_OPERATION="AddConfigGroup" MANAGEMENT_SERVER="newserver.corp.com" AM_CONTROL="Full" REQUIRE_AUTH_COMMN=1 REINSTALL="ALL"

MsiExec.exe /I{F692770D-0E27-4D3F-8386-F04C6F434040} /norestart /qn /l*v "C:\MOMRemove.log" CONFIG_GROUP="OldManagementGroup" CONFIG_GROUP_OPERATION="RemoveConfigGroup" MANAGEMENT_SERVER="oldserver.corp.com" AM_CONTROL="Full" REQUIRE_AUTH_COMMN=1 REINSTALL="ALL"

Since this activity will modify/reinstall the MOM agent on the client after the change has been made a service dependency on WMI must be recreated to ensure proper functioning of the MOM agent. To recreate this service dependency use the following from a command prompt which sets it and then restarts the MOM service: sc config mom depend= rpcSs/eventLog/winmgmt & net stop mom & net start mom (note the space after the equal sign in necessary).

Advantages

· Can be automated and widely deployed to change a large number of clients

· No gap in data reporting

· Does not require access to FCS CD media

· Works with multi-homed agents

Disadvantages

· Requires some scripting or batch file creation

· Requires a method of deploying the command line invocations

· Requires familiarity with the previous and new management server and group names

Removing the FCS MOM agent and rerunning clientsetup.exe

As you may have seen from the first option, you can remove the MOM agent by going into Add/Remove Programs, locate Microsoft Operations Manager 2005 Agent, and choosing Change. Click, Next on the welcome screen and then choose the “Remove management group” option and ensure that old management group is chosen in the dropdown list. The machine now has no agent. Then you can use the FCS CD media and run \client\clientsetup.exe (or \client\x64\clientsetup.exe if x64 platform). Rerunning clientsetup.exe will cause clientsetup.exe to read the new policy settings which contain the new MOM server and group name and it will install a new MOM agent appropriately. If you do not have FCS policy deployed you can call clientsetup.exe /MS newserver.corp.com /CG NewManagementGroup

Since clientsetup.exe is used to install the MOM agent it will properly set a service dependency on WMI without additional steps.

Advantages

· Changes made through UI wizards and commands; no scripting required

· Typically does not require familiarity with the previous and new management server and group names

· Works with multi-homed agents

Disadvantages

· Requires access to FCS CD media

· Gap in reporting between uninstallation and reinstallation

· Maybe time consuming for a large number of clients

Removing the entire MOM agent and rerunning WSUS deployment

Basically this is the similar to the above, in that the MOM agent is removed. If you are looking to push this out you can combine it with the command line option like:

MsiExec.exe /qn /x{F692770D-0E27-4D3F-8386-F04C6F434040}

Then instead of manually installing the FCS agent from the media you can approve it on your WSUS/Distribution server and allow it to be redeployed automatically. The detection logic of the FCS deployment package checks for the presence of all three client components(antimalware, security assessment, and MOM agents). Since the MOM agent will be missing it will redeploy the package and reinstall only the MOM agent using the new settings deployed via policy. For more information on how to configure WSUS client deployment see the FCS deployment guide.

Note that you can force automatic detection and installation by configuring the FCS client installation package with a WSUS deadline for a date in the past and then, after uninstalling the MOM agent, do a “wuauclt /detectnow” from the command line. This should force a detection cycle and the deadline should cause the package to be installed immediately.

Since clientsetup.exe is used to install the MOM agent it will properly set a service dependency on WMI without additional steps.

This technique should not be used with a multi-home MOM agent(an agent also reporting to a traditional MOM 2005 infrastructure). As described above, it requires that the MOM agent is completely removed to meet the WSUS deployment logic. After the command above uninstalls the entire MOM agent, the FCS client is reinstalled but not the traditional MOM configuration.

Advantages

· Typically does not require familiarity with the previous and new management server and group names

· Can be automated and widely deployed to change a large number of clients

· Does not require access to FCS CD media

Disadvantages

· Should not be used with multi-homed agents

· Gap in reporting between uninstallation and reinstallation

· Requires some scripting or batch file creation

· Requires a method of deploying the command line invocations

Multi-homing via MOM Administration console Install/Uninstall Agent Wizard

Built into MOM 2005 is a Install/Uninstall Agent Wizard. This wizard can be invoked as either the server action account or a user account and it will try to remotely install or uninstall a MOM agent for the management group and server from which the wizard is run. The wizard and steps are documented in the MOM Deployment Guide. The steps are:

1. From a MOM admin console in the new deployment, run the Install Agent Wizard to add the new client machine(s). Upon success the machine will be multi-homed to both installations.

2. From a MOM admin console in the old deployment, run the Uninstall Agent Wizard to remove the client machine(s).

On the surface this looks like the easiest and most desirable method, but in reality probably has the highest failure rate. Reasons for this include:

· The installation wizard is server->client, therefore if any firewalls exist over the MOM/SMB/RPC ports this will fail. The required firewall configuration it enable this is described in:

The Microsoft Operations Manager 2005 agent does not install on computers that are running Windows XP with Service Pack 2 (SP2) and Windows Server 2003 with Service Pack 1 (SP1)

http://support.microsoft.com/default.aspx?scid=kb;EN-US;885726

· Using the wizards requires that the machines be online at the time the wizard(or the resulting computer discovery action) is run to use a specified account

· An account must be used in both wizards with admin permissions on the client, usually this means all domains are trusted

Advantages

· Typically does not require familiarity with the previous and new management server and group names

· Can be automated and widely deployed to change a large number of clients

· Does not require access to FCS CD media

· No gap in data reporting

· No scripting required

Disadvantages

· Error prone and potentially problematic to implement

· May require changes to the firewall configuration of the client machines

Thanks,
Craig Wiand
Forefront Client Security Escalation Engineer

What Does CSS Need to Help Troubleshoot an FCS Issue?

2008-10-22T21:43:00Z

Are you suspecting an Infection in your network?

If you suspect an Infection in your network and if you could find the infected file please upload the sample to the link https://www.microsoft.com/security/portal/submit.aspx

Only one file can be submitted at one time and the size of that file is limited to 10 megabytes. Compress the file and password protect the file with the password "infected" (without quotes).

If you want to submit more than one file for analysis, please compress the files into a single archive and password protect the files with the password "infected" (without quotes).

In the comments field please provide any information about the Infection.

Microsoft Malware Protection Center will send you the results of the analysis on the submission.

FCS customers please contact Microsoft Customer Service and Support to raise an incident and follow the below steps.

You can also try these steps,

· Run a Full Scan in the infected machine with the recent signature updates.

· Try to isolate the machine from the network to avoid spreading the infection.

Are you facing an issue while installing Forefront Client Security?

Check the Prerequisites

· http://technet.microsoft.com/en-us/library/bb404270.aspx

If you still experience issues after reviewing the Prerequisites, please contact Microsoft Customer Service and Support to raise an incident and follow the below steps

Server installation issues: Gather and provide the engineer with the topology you are attempting to install and computer and account information (see deployment guides)

Example:

Item	Description	Your Notes
Management server	Server name
Collection server	Server name
Collection database	Server name and SQL Server instance name (if it's not the default)
Reporting server	Server name
Reporting Database	Server name and SQL Server instance name
Distribution Server	Server name
DAS Account	Domain user account required
DTS Account	Domain user account required (Recommendation: re-use DAS account)
Reporting Account	Domain user account required (Recommendation: re-use DAS account).
Action Account	Domain user account required (Recommendation: re-use DAS account)
Management Group Name	Defined during Client Security setup
Reporting Server URL	Defined during SQL Server 2005 setup (Default:http://reportingservername/ReportServer)
Report Manager URL	Defined during SQL Server 2005 setup (Default: http://reportingservername/Reports)
Size of Collection Database	Defined during Client Security setup
Size of Reporting Database	Defined during Client Security setup
WSUS Management URL	Created when installing WSUS
WSUS Client Configuration URL	Created when installing WSUS

Collect the failed setup log from the below location and share it with the Engineer who is contacting you

For Server role installation:

<Install drive>\Program files\Microsoft Forefront\Client Security\Server\Logs\Server_date.log

For Client installation:

%Program Files%\Microsoft Forefront\Client Security\Client\Logs

If your Forefront Clients are not getting the signature updates

Please execute the CSS Sec MPS report from the Link in the distribution Server http://www.codeplex.com/SECTools/Release/ProjectReleases.aspx?ReleaseId=15744

(If it’s a Single server topology run it in the FCS Server)

Also execute the CSS Sec MPS report from the Link in a client machine http://www.codeplex.com/SECTools/Release/ProjectReleases.aspx?ReleaseId=15744

and when Microsoft Engineer has contacted you request him/her for the Workspace to upload the output of the MPS Report.

For other Issues faced in Forefront Client Security

Execute the CSS Sec MPS report from the Link

http://www.codeplex.com/SECTools/Release/ProjectReleases.aspx?ReleaseId=15744

· Run this in all the Forefront Client Security Server Roles.

· If it’s a Single Server topology execute this in FCS Server.

· To Run this Script you need to login with Administrator ID.

· This Script will not take more than 5 to 15 minutes.

· This Script is transparent and utilizes less processor time and memory.

· Gather and provide the engineer with the topology you are attempting to install along with computer and account information (See Deployment Guides)

When Microsoft Engineer has contacted you request him/her for the Workspace to upload the output of the MPS Report.

What will the CSSSEC MPS Report log from your machine?

Information on IIS:

IIS Anonymous (IUSR) User Information

IIS Metadata and Module Information (MBSchema.xml, MetaBase.xml, sysinfo xml).

IIS Configurations and logs.

Windows update related Information:

WinHTTP Proxy Settings.

BITS (Service and Queued job Status)

Missing Security update Information.

FCS Information:

FCS Anti malware support Logs.

FCS Security State Assessment Information.

FCS Account Information.

FCS Client setup files.

FCS Database Information.

Profile settings of FCS Console.

Checks the Status for Forefront client dependency services.

MOM and reporting Services Information:

MOM Management Pack Information.

MOM *.mc8 Log Files.

MOM Configuration (Onepoint database size and permissions, System Center Reporting database Size and Permissions)

SQL reporting Services Information and logs.

Other Information:

Dcom Information.

Event Logs (Application, System and Security Event logs)

Schedule task Information.

Version of Windows OS.

Version and Symbol Information of Executables.

NTFS Information

Group Policy Information.

Disk Quota Information.

MS Office Information.

Hardware Information of the Local machine.

ISA Server Information.

Security center Configuration (Anti Virus, Firewall, Automatic Updates)

For More Information please read the readme file from the link: http://www.codeplex.com/SECTools/Release/ProjectReleases.aspx?ReleaseId=15744

Thanks

Swami

CSS Security Team

Event 3002 with error 0x8007139f from FCSAMRtp when RTP security agent unchecked

2008-10-09T20:47:00Z

On a system running the FCS Client, you may run into the event listed below which occurs on the local system and may cause an Alert to fire on the FCS Console.

This issue can occur when the client system has had a Real-time protection Security Agent de-selected in the FCS Client UI.

For example, if you do the following and restart the system or restart the Microsoft Forefront Client Security AntiMalware Service you will receive the event.

1. Go to Tools/Options in the FCS Client UI
2. Uncheck any of the security agents under "Use real-time protection"
3. Restart the AM service or reboot the system

The following event is logged -

Event Type: Error
Event Source: FCSAMRtp
Event Category: None
Event ID: 3002
Date:  9/20/2008
Time:  7:00:38 PM
User:  N/A
Computer: FCS Client
Description:
Microsoft Forefront Client Security Real-Time Protection agent has encountered an error and failed.
  User: Domain\administrator
  Agent: Application Execution
  Error Code: 0x8007139f
  Error description: The group or resource is not in the correct state to perform the requested operation.

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.

This error can be ignored if one of the Security Agents provided by Real-time protection have been intentionally disabled.

Thanks and please post any comments or questions.

Shain Wray

Security Technical Lead