Microsoft Forefront Server Protection Blog

Important Changes to Forefront Product Roadmaps

tonytrivi_MSFT — Thu, 15 Nov 2012 17:22:00 GMT

The latest release of Office 365 marks the beginning of some changes for products under the Forefront brand. The roadmap for these products is changing to ensure that Microsoft customers continue to receive the best deployment of security and protection solutions for their applications as new versions are developed and released. Customers can read a detailed summary of changes on the Server & Cloud blog at Important Changes to Forefront Product Roadmaps.

Some noteworthy changes to the Forefront Product Roadmaps are as follows:

Forefront Online Protection for Exchange will be renamed Exchange Online Protection in its next release.
Any further release of the following Forefront Products will be discontinued, and will no longer be available for purchase after December 1, 2012: Forefront Protection 2010 for Exchange Server (FPE), Forefront Protection 2010 for SharePoint (FPSP), Forefront Security for Office Communications Server (FSOCS)

It is worth noting that Microsoft will continue providing maintenance and support for these discontinued products for some time. Most Online Service Subscriptions will continue to receive support through 2015, and Perpetual Server Licensees can expect to receive support through 2020.

Amy Doran, Technical Writer, Forefront for Office User Assistance

Update Rollup 1 for Exchange 2010 Service Pack 2

tonytrivi_MSFT — Wed, 29 Feb 2012 19:15:00 GMT

On the Exchange Team blog they recently released an annoucement, Released: Update Rollup 1 for Exchange 2010 Service Pack 2, regarding Update Rollup 1 for Exchange 2010 SP2. I wanted to call out the included note for Forefront Protection for Exchange customers who will be applying the rollup to their Exchange servers:

Note for Forefront Protection for Exchange users For those of you running Forefront Protection for Exchange, be sure you perform these important steps from the command line in the Forefront directory before and after this rollup's installation process. Without these steps, Exchange services for Information Store and Transport will not start after you apply this update. Before installing the update, disable ForeFront by using this command: fscutility /disable. After installing the update, re-enable ForeFront by running fscutility /enable.

Hotfix Rollup 4 for Microsoft Forefront Protection for Exchange is Available

tonytrivi_MSFT — Tue, 06 Dec 2011 17:29:00 GMT

On behalf of the ECS team at Microsoft, I am pleased to announce the release of Hotfix Rollup 4 for Forefront Protection 2010 for Exchange Server.

On December 5th Microsoft shipped Hotfix Rollup 4 for Forefront Protection 2010 for Exchange Server (FPE). For a complete list of fixes included in this rollup, along with directions for download, please see our Knowledge Base article: Hotfix Rollup 4 for Microsoft Forefront Protection for Exchange.

As the installer runs, server service restarts may be necessary, so please plan accordingly when applying this hotfix rollup.

Rob McCarthy, Sr. Support Engineer

Forefront Protection 2010 for Exchange Server - Frequently Asked Questions

tonytrivi_MSFT — Wed, 30 Nov 2011 23:57:00 GMT

With the variety of Forefront configuration options available, often our users have questions about how our products work together to form a comprehensive server protection solution. Microsoft’s Forefront Protection 2010 for Exchange Server engineers recently sat down to answer some of the most frequently asked questions about FPE. If you are interested in finding out more about FPE and Edge transport integration, reporting, policies, or spam quarantine access rights, head over to the updated Forefront Protection 2010 for Exchange Server (FPE 2010) FAQ on the TechNet wiki. You will find answers not only to users’ scenario questions but also a high-level overview of the Forefront Protection 2010 for Exchange Server product.

After looking through the FAQ, let us know what you think by leaving a comment on the wiki page or this blog post. Do you have questions we didn’t cover in the FAQ? Check out the full list of help documents in the TechNet FPE 2010 library at Microsoft Forefront Protection 2010 for Exchange Server.

Timothy Rich - Technical Writer for Office User Assistance

Forefront Protection Server Management Console FAQs and Best Practices

tonytrivi_MSFT — Tue, 01 Nov 2011 23:52:30 GMT

We recently added a topic to the TechNet Wiki called Forefront Protection Server Management Console FAQs and Best Practices. We wanted to make available this troubleshooting and best practices content for our customers using FPSMC, which allows you to manage multiple instances of Forefront Protection 2010 for Exchange Server. We hope you find it helpful. If you are a member of the TechNet wiki community, feel free to add your own FPSMC tips and tricks.

New Forefront Protection 2010 for Exchange Server Content - Planning and Architecture

tonytrivi_MSFT — Thu, 05 May 2011 17:02:30 GMT

We have updated the Protecting your Exchange servers section of the Forefront Protection 2010 for Exchange Server (FPE) Planning and Architecture documentation to give you more information about how the product can protect your organization from messaging threats. Specifically, the Understanding spam processing section discusses how the product’s spam filtering layers (connection filtering, SMTP filtering, and content filtering) work, including more “under the hood” details about how specific types of spam are detected and removed.

We hope you find this new content to be helpful as you configure FPE to protect your Exchange messaging environment.

Tony Trivison - Forefront for Office User Assistance

Forefront Protection 2010 for SharePoint Performance Data

tonytrivi_MSFT — Thu, 28 Apr 2011 20:41:51 GMT

Hi all,

I wanted to point Forefront Protection 2010 for SharePoint (FPSP) customers to a TechNet Wiki article that was recently written. The purpose of this article is to provide performance data that shows FPSP’s enhanced performance over the previous version of the product, Forefront Security for SharePoint (FSSP). It also describes the overall system performance overhead in adding FPSP to your SharePoint environment, and provides configuration options for further improving system performance if you so desire.

Forefront Protection 2010 for SharePoint Performance Data

Thanks for reading.

Scott Floman
Forefront for Office UA

Hotfix Rollup 3 for Microsoft Forefront Protection for Exchange is Available

tonytrivi_MSFT — Tue, 19 Apr 2011 23:02:39 GMT

On behalf of the security team at Microsoft, I am pleased to announce the release of Hotfix Rollup 3 for Forefront Protection 2010 for Exchange.

On April 18th Microsoft shipped Hotfix Rollup 3 for Forefront Protection for Exchange (FPE) to provide a series of product enhancements and new features. For a complete list of the new features and enhancements included in this rollup, along with directions for download, please see our Knowledge Base article: Description of Hotfix Rollup 3 for Microsoft Forefront Protection for Exchange.

As the installer runs, server service restarts may be necessary, so please plan accordingly when applying this hotfix rollup.

Rob McCarthy, Sr. Support Engineer

Hotfix Rollup 3 for Microsoft Forefront Security for Office Communications Server is Available

tonytrivi_MSFT — Tue, 19 Apr 2011 22:59:00 GMT

On behalf of the security team at Microsoft, I am pleased to announce the release of Hotfix Rollup 3 for Microsoft Forefront Security for Office Communications Server.

On April 18th Microsoft shipped Hotfix Rollup 3 for Microsoft Forefront Security for Office Communications Server (FSOCS) to provide a series of product enhancements. For a complete list of the enhancements included in this rollup, along with directions for download, please see our Knowledge Base article: Description of Hotfix Rollup 3 for Microsoft Forefront Security for Office Communications Server.

As the installer runs, server service restarts may be necessary, so please plan accordingly when applying this hotfix rollup.

Rob McCarthy, Sr. Support Engineer

Wikipedia Entries for Forefront Server Protection and FOPE

tonytrivi_MSFT — Wed, 02 Feb 2011 21:15:00 GMT

Hi All,

Just wanted to call to your attention that Wikipedia entries have been posted for the following Microsoft Forefront products:

Feel free to improve and expand upon this content.

Thanks,
Scott Floman
Technical Writer – Forefront for Office

New Certificate Required For Antigen 9 Installations on Windows Server 2000

tonytrivi_MSFT — Thu, 20 Jan 2011 00:43:00 GMT

As of January 18, 2011, Microsoft will be signing antivirus engines used by Antigen with a new certificate in order to continue to ensure secure and reliable virus-engine updates. This will require a new certificate implementation on any Windows 2000 server running Antigen 9.0.

Please see the following Knowledge Base article for clear and detailed instructions on implementing this new certificate: As of 18th January 2011, a new certificate is required to continue updating virus engines for Antigen 9 installed on Windows Server 2000

Rob McCarthy, Sr. Support Engineer

Hotfix Rollup 1 for Forefront Protection 2010 for SharePoint is Available

tonytrivi_MSFT — Thu, 20 Jan 2011 00:35:00 GMT

On behalf of the security team at Microsoft, I am pleased to announce the release of Hotfix Rollup 1 for Microsoft Forefront Protection 2010 for SharePoint.

On January 17th Microsoft shipped Hotfix Rollup 1 for Forefront Protection 2010 for SharePoint (FPSP) to provide a series of product enhancements and new features. For a complete list of the new features and enhancements included in this rollup, along with directions for download, please see the Knowledge Base article: Description of Hotfix Rollup 1 for Forefront Protection for SharePoint

As the installer runs, Server service restarts may be necessary, so please plan accordingly when applying this hotfix rollup.

Rob McCarthy, Sr. Support Engineer

Forefront Protection Server Management Console 2010 has been released!

M LaFantano - MSFT — Fri, 17 Dec 2010 19:04:14 GMT

On behalf of the Forefront Server Protection team at Microsoft, I am pleased to announce the release of Forefront Protection Server Management Console 2010 (FPSMC).

On December 17th, 2010 Microsoft shipped the Forefront Protection Server Management Console (FPSMC) to provide centralized management for the Forefront Protection 2010 for Exchange Server and Forefront Protection 2010 for SharePoint servers in your environment. FPSMC provides multi-server management through a browser-based interface, and supports the following features:

· Signature redistribution

· Policy (configuration) deployment

· Centralized incident, spam, and engine version reporting

· Centralized quarantine management

· Auto discovery of new servers

· Integration with Forefront Online Protection for Exchange

For a complete list of features included in this free release, along with directions for download and installation, please go to: http://www.microsoft.com/downloads/details.aspx?FamilyID=31f66155-50f0-4665-adc0-de94da027ed7

Andrew Schiano

Software Development Engineer in Test

RELEASE ANNOUNCEMENT FOR HOTFIX ROLLUP 2 FOR FOREFRONT SECURITY FOR OFFICE COMMUNICATIONS SERVER

M LaFantano - MSFT — Wed, 15 Dec 2010 23:10:00 GMT

On behalf of the Security team at Microsoft, I am please to announce the release of Hotfix Rollup 2 for Microsoft's Forefront Security for Office Communications Server.

On December 15th, Microsoft shipped Hotfix Rollup 2 for Forefront Security for Office Communications Server (FSOCS) to provide a series of product enhancements and new features.

For a complete list of the new features and enhancements included in this rollup, along with directions for download, please see the following Knowledge Base article: http://support.microsoft.com/kb/2482040

As the installer runs, server service restarts may be necessary, so please plan accordingly when applying this Hotfix Rollup.

Regards,

Robert McCarthy

CSS Microsoft Security

Forefront Protection Server Management Console 2010 Release Date

M LaFantano - MSFT — Tue, 07 Dec 2010 22:55:54 GMT

We would like to announce that the Forefront Protection Server Management Console 2010 (FPSMC) is currently scheduled to be available as a free download on December 17, 2010. Using a browser-based user interface, FPSMC allows administrators to centrally manage deployments of Forefront Protection 2010 for Exchange Server and Forefront Protection 2010 for SharePoint within their enterprise.

For more information on FPSMC, please see our previous update:

http://blogs.technet.com/b/fss/archive/2010/10/25/forefront-protection-server-management-console-2010-update.aspx

Andrew Schiano

Software Development Engineer in Test

Please let us know about how you use email security solutions in your workplace

M LaFantano - MSFT — Mon, 06 Dec 2010 16:49:00 GMT

Hello everyone,

The Microsoft Forefront team is currently conducting a survey and would like to hear your opinions about email security, especially how you use email security solutions in your organization. We would appreciate it if you would take the time to respond to this survey. This information will help us improve Forefront Protection for Exchange.

Please consider taking a few minutes at this time to complete the survey. This survey should take about 10 -15 minutes to complete.

To participate, please click here.

Carolyn Liu
Senior Program Manager, Forefront Server Protection

RELEASE ANNOUNCEMENT FOR HOTFIX ROLLUP 2 for FOREFRONT PROTECTION FOR EXCHANGE

M LaFantano - MSFT — Mon, 29 Nov 2010 20:54:00 GMT

On behalf of the Security team at Microsoft, I am pleased to announce the release of Hotfix Rollup 2 for Microsoft’s Forefront Protection 2010 for Exchange.

On November 30th Microsoft shipped Hotfix Rollup 2 for Forefront Protection 2010 for Exchange to provide a series of product enhancements and new features.

For a complete list of the new features and enhancements included in this rollup, along with directions for download, please see the following Knowledge Base article: .http://support.microsoft.com/kb/2420647.

As the installer runs, server service restarts may be necessary so please plan accordingly when applying this Hotfix Rollup.

Regards,

Robert McCarthy
CSS Microsoft Security

Forefront Protection Server Management Console 2010 Update

M LaFantano - MSFT — Mon, 25 Oct 2010 20:29:37 GMT

My name is Andrew Schiano, and I work in Test for the Forefront Protection team. I would like to tell you a little bit about the soon-to-be released Forefront Protection Server Management Console 2010 (FPSMC). FPSMC provides centralized management for the Forefront Protection 2010 for Exchange (FPE) and Forefront Protection 2010 for SharePoint (FPSP) servers in your environment. FPSMC is expected to be available as a free download in Q4 2010.

FPSMC provides multi-server management through a browser-based interface, and supports the following features:

Signature redistribution

The signature redistribution job is used to deploy antivirus signature updates to the FPE/FPSP servers in an environment. The most efficient way to update engine signatures on all your servers is to create a redistribution job to download them to the FPSMC server. The FPSMC server is then used as the retrieval point for all the other servers in the environment.

Policy (configuration) deployment

FPSMC supports deploying a centralized set of configuration settings to one or more FPE or FPSP servers in your environment. This is accomplished by configuring one of your FPE/FPSP servers to the desired configuration and then exporting these settings in xml format. The xml file is then imported into FPSMC, which can deploy these same settings to your other FPE/FPSP servers.

Patch deployment

FPSMC supports deploying FPE and FPSP roll ups and service packs. Patch packages can either be .MSP or .EXE file types.

Centralized incident reporting

The Incident Detection report presents data about the number of malware incidents and filter matches over a period of time on one or more managed servers. This includes the five most common malware types detected in your organization and the most recent detection date and time.

Centralized spam reporting

The Spam Detection report presents data about the number of spam messages blocked by FPE. This includes a pie-chart breakdown by filter type and a line graph showing the number of spam messages detected over time.

Centralized engine versions reporting

The Engine and Definition Versions report presents data about the antivirus engine versions and definitions on selected servers running FPE and FPSP. This report compares the current engine versions of the managed servers to determine which, if any, of your signatures are out of date.

Quarantine management

FPSMC supports retrieving quarantine data from managed Forefront Protection servers for local analysis and management, including delivering Exchange quarantine and restoring SharePoint quarantine.

Integration with Forefront Online Protection for Exchange (FOPE).

If you are using FOPE in your organization, you can use FPSMC to access the FOPE Administration Center to monitor your email flow. FPSMC provides access to the FOPE home page, quarantine, reports, and mail tracing facilities.

Auto discovery of servers

On a nightly basis, FPSMC will automatically detect new FPE and FPSP servers that have been added to your network.

Exchange Clusters -- CCR, SCC, and DAG
FPSMC supports clustered Exchange servers, including E14 Database Availability Groups.

FPSMC will initially be available in English. Localized versions in all 11 languages (Chinese-Simplified, Chinese-Traditional, English, French, German, Italian, Japanese, Korean, Portuguese-Brazil, Russian, and Spanish) will be released at a later date (to be announced).

Thank you for your time, and I hope you found this article helpful.

Andrew Schiano

Software Development Engineer in Test

Hotfix rollup 3 for Forefront Security for Exchange Server SP2 and hotfix rollup 3 for Forefront Security for SharePoint SP3 are now available

M LaFantano - MSFT — Fri, 08 Oct 2010 19:19:00 GMT

On behalf of the Forefront Server Protection team at Microsoft, I am pleased to announce the release of Forefront Security for Exchange Server (FSE) SP2 Rollup 3 and Forefront Security for SharePoint (FSSP) SP3 Rollup 3.

On October 8th, 2010 Microsoft shipped both builds to address a performance issue with version 8 of the Kaspersky antivirus engine.

For a detailed description of the updates please see the following Knowledge Base articles:

Forefront Security for Exchange Server SP2 RU3: http://support.microsoft.com/kb/2420644
Forefront Security for SharePoint SP3 RU3: http://support.microsoft.com/kb/2422053

As the installer runs, server service restarts may be necessary, so please plan accordingly when applying this hotfix rollup.

Regards,

Robert McCarthy
Sr. Support Engineer
Microsoft Security

Information about the new antivirus engine for Forefront and Antigen products

M LaFantano - MSFT — Wed, 29 Sep 2010 18:41:00 GMT

Microsoft is upgrading the multi-engine protection in all Forefront server security products to support a newer version of the antivirus engine. The newer version will provide customers with improved scanning times and reduced signature file size. The new engine replaces the older engine.

This new engine publishes update files in a subdirectory – the first engine in the Forefront engine mix to do so. In order to accommodate this new publishing model, Microsoft is releasing a series of roll-ups that will:

• Include the new antivirus engine

• Ensure that any engine that publishes update files in a subdirectory will update correctly

Customers must install the rollups by Jan. 31, 2011.

Krishnan Venkatasubramanian

Senior Program Manager, Forefront Server Protection

Forefront Server Protection RSS feeds are now available!

M LaFantano - MSFT — Thu, 23 Sep 2010 13:39:00 GMT

Hello,

I’d like to take a moment and encourage each of you to check out Microsoft’s latest efforts to save you support costs and time.

Introducing Forefront Server RSS feeds: Forefront Server RSS Feeds

By subscribing to our Forefront Server RSS feed, you allow Microsoft to give you the answers without having to ask the questions. Our goal is to provide insight into the top Forefront Server solutions as early as possible while saving you the time, resources, and effort of opening a support case. Our Solution Center list page ( Solution Centers ) provides an RSS icon in the upper right hand corner of your browser that points to the feed subscription page as well.

Empower yourself! Subscribe, ask questions, and provide feedback!

And remember, the bad guys never sleep and are busy developing new ways to wreak havoc on your network. Forefront developers work tirelessly to give you the latest means to defend against these attacks. Make sure you are incorporating these shields into your environment with the latest updates for Forefront Server products: Forefront Server Product Updates.

Rob McCarthy

Sr. Support Engineer
CSS Security

Problems downloading updates for the antivirus engine after installing FSSMC Hotfix Rollup 5 and FSE Service Pack 2 Rollup 2

M LaFantano - MSFT — Wed, 15 Sep 2010 16:51:00 GMT

Some customers have reported problems downloading updates for the antivirus engine after installing the Forefront Server Security Management Console (FSSMC) Hotfix Rollup 5 and the Forefront Security for Exchange Server (FSE) Service Pack 2 Rollup 2.

The basic symptom is that antivirus engine updates fail. If you are experiencing this problem, please refer to the Microsoft support KB article #2410444 for information on how to resolve the problem. The KB will guide you through steps that will enable FSE to use the previous version of the antivirus engine and updates until a permanent fix is created.

If you continue having problems after trying the measures in the KB article, you should contact CSS for additional help.

Michel LaFantano

BPSG iX

Information about the virus Worm:Win32/VB.WF

M LaFantano - MSFT — Fri, 10 Sep 2010 22:55:34 GMT

Customers have been asking about how to best defend against the new e-mail virus Worm:Win32/VB.WF. This virus uses a link in the message body that looks like a link to a PDF file but is actually a link to a *.scr file. When you click the link, it begins sending e-mails using the GAL or contacts. (Information about the virus can be found on the Microsoft Malware Protection Center.)

If you are using the Cloudmark antispam engine in Forefront Protection 2010 for Exchange Server (FPE) or Antigen 9.2 AND your engine updates are up-to-date, your environment should be protected from this virus. If you are using Forefront Security for Exchange Server (FSE) or are not using the antispam features in FPE or Antigen, you can block these virus e-mails in several ways:

1. During the Transport scan (Messages in Transport):

· Subject line filtering on FPE (FSE doesn’t provide subject line filtering on the Transport Scan Job. This also assumes the messages do not contain an AV stamp.) The subject line of the e-mail is typically “Here you have”. You should create a subject line filter to block/delete messages using this subject line.

· Exchange Transport rules. You can use Exchange transport rules to block messages based on their subject line.

2. During the Mailbox scan (Messages in transit at the Store level via the Realtime scan job as well as cleaning up what’s already in the Store via the Scheduled scan job.)

· Use FPE and/or FSE Realtime and Scheduled Scan subject line filters.

· Use the Exchange PowerShell command: Get-TransportServer | Get-Queue | get-message | where{$_.MessageSubject -eq "Here you have"} | remove-message

For more information about using subject line filtering to stop this worm, please refer to this TechNet wiki article:

http://social.technet.microsoft.com/wiki/contents/articles/worm-win32-vb-wf-email-virus-defending-with-forefront-security-forefront-protection-antigen.aspx

Note: If you are using FPE, be sure to disable the “Scan only messages with attachments” option, which is enabled by default, so that it will actually scan and remove these e-mails as they do not contain attachments and will be overlooked if this option is not disabled. You should also be aware of the “Scan only messages received in the last” configuration if you plan on running these scans this weekend. By default, the Scheduled scan will only scan messages received within the past 2 days and may miss these messages depending on when you run or schedule the scan.

Michel LaFantano
BPSG iX

Forefront Server Security Management Console (FSSMC) Hotfix Rollup 5 is now available

M LaFantano - MSFT — Fri, 27 Aug 2010 14:18:00 GMT

On behalf of the Forefront Server Security team at Microsoft, I am pleased to announce the release of Hotfix Rollup 5 for the Forefront Server Security Management Console (FSSMC)!

Microsoft shipped Hotfix Rollup 5 for the FSSMC on August 26th, 2010.

For a complete list of the new features and fixes included in this rollup along with directions for download, please see the following Knowledge Base article: http://support.microsoft.com/kb/2302023

· Description of Hotfix Rollup 5 for Forefront Server Security Management Console:

As the installer runs, server service restarts may be necessary so please plan accordingly when applying this Hotfix Rollup.

Regards,

Robert McCarthy
Microsoft Security

Hotfix Rollup 3 for Antigen 9 for Exchange Service Pack 2 is Now Available

M LaFantano - MSFT — Fri, 27 Aug 2010 14:15:00 GMT

On behalf of the Forefront Server Security team at Microsoft, I am pleased to announce the release of Hotfix Rollup 3 for Antigen 9 for Exchange, Service Pack 2!

On August 27th 2010 Microsoft shipped Hotfix Rollup 3 for Antigen 9 for Exchange, Service Pack 2.

For a complete list of the new features and fixes included in this rollup along with directions for download, please see the following Knowledge Base article:
http://support.microsoft.com/kb/2302001

Description of Hotfix Rollup 3 for Antigen 9 for Exchange, Service Pack 2:

As the installer runs, server service restarts may be necessary so please plan accordingly when applying this Hotfix Rollup.

Regards,

Robert McCarthy
Microsoft Security