Forefront Client Security Team Blog

FCSv1: In place OS upgrades from Win2k8 Core to Win2k8 R2 Core has an upgrade issue

2009-10-09T00:56:00Z

Issue:

Upgrade or uninstallation of Forefront Client Security (FCS) v1 is not possible, after an in place upgrade of Windows Server 2008 Core to Windows Server 2008 R2 Core.

Cause:

The Antimalware MSI’s used to install the AM engine for FCS use an application installer known as DFXAPP. The version of the installer used in the original FCS media and in subsequent updates to the AM MSI (QFE2, QFE4, QFE5, QFE6) has a hard coded version block that prevents this installer from running on Windows 7 and Windows Server 2008 R2. In most cases, there is an application compatibility ‘shim ‘ that works around this issue and allows the installation to succeed. However, this application compatibility infrastructure is not installed or supported on Windows Server 2008 R2 Core - and an installation error happens.

The scenario of concern is if:

· A customer has already installed FCSv1 on Windows Server 2008 Core;

· Then upgrades the operating system to Windows Server 2008 R2 Core,

The following is the result:

· You cannot uninstall FCSv1. (due to the lack of the DFXAPP infrastructure)

· You cannot upgrade the Antimalware QFE to future release. This because the upgrade occurs by performing an uninstall of the current Antimalware QFE. (again due to the lack of the DFXAPP infrastructure)

The specific error seen in the Antimalware log (FCSAM.log):

MSI (s) (CC:E0) [20:43:51:595]: Invoking remote custom action. DLL: C:\Windows\Installer\MSI18B5.tmp, Entrypoint: ProcessDriverPackages Action start 20:43:51: MsiProcessDrivers.

DIFXAPP: ENTER: ProcessDriverPackages()

DIFXAPP: ERROR - The operating system you are running on is not supported. Only Windows 2000, Windows XP, Windows Server 2003 and Windows codenamed Longhorn are supported.

Solution:

There are several workarounds that exist, but are very time consuming and error prone. We are working to create a simpler workaround that can be distributed to affected customers. If you find yourself in this situation, please open a case with your CSS representative via http://support.microsoft.com

Forefront Client Security v1.0 on Windows 7 and Windows Server 2008 R2

2009-09-05T00:15:00Z

Greetings!

You may have seen this by now, but I wanted to reiterate here:

Forefront Client Security (FCS) v1.0 is fully supported on Windows 7 and Windows Server 2008 R2 as of August 31, 2009.

With the release of new updates available through Windows Server Update Services (WSUS) or Microsoft Update, you'll be able to extend the protection of FCS v1.0 on Windows 7 and Windows Server 2008 R2 systems and incorporate security in their infrastructure upgrade plans. More information on updates needed for this support is provided in a knowledge base article here.

FCS v1.0 will be supported on all of the following versions of Windows 7: Windows 7 Business, Enterprise, Home, and Ultimate. FCS v1.0 will also be supported on Windows Server 2008 R2 Standard Server and Windows Server 2008 R2 Enterprise Server installation. For a full list of supported platforms, please visit http://technet.microsoft.com/en-us/library/bb404245.aspx.

Windows Server 2008 R2 Server Core installation is not supported at this time. However, it is planned to be supported with future updates.

Client Security slow logon issue

2009-08-13T19:43:31Z

After installing the most recent antimalware update (KB971026), some Client Security customers have reported that their managed Windows XP SP2 and SP3 clients take longer to logon after a reboot. Our support and sustained engineering teams have researched this issue and wanted to provide additional information and workarounds.

Cause

During the initialization of the antimalware service, FCS does the following:

1. Loads the kernel-mode mini-filter(mpfilter.sys) and starts filtering

2. Sets up communication port

3. Creates Engine configuration <-- delay occurs here

4. Creates On-Access worker threads

The problem arises when there is a delay in Step#3. In this situation the mini-filter begins filtering file I/O requests but there are no On-Access worker threads available yet to service the scanning requests. We have found that these delays typically come from network-based file exclusions being set via the Advanced Policy tab in the Client Security management console.

The delays occurs when the client receives the UNC paths (e.g. \\server\share) and they are converted to a device name that the mini-filter uses. During this conversion the FCS client accesses the path in the exclusion. Slow or ACCESS_DENIED responses to these network requests increases the time in Step#3 above and causes delays before the mini-filter requests can be handled (Step#4).

The result is that the file I/O in other processes, including those responsible for logon like Winlogon.exe, is queued until all the network requests for exclusions complete or for the duration of the mini-filter timeout. This issue became more visible in the most recent antimalware update (KB971026) because the mini-filter timeout was increased.

Workarounds

While Microsoft determines the long term solution to this problem, there is a recommended workaround: eliminate network-based file exclusions.

In most causes these exclusions were created to address the issue described in KB939361. This issue can now be corrected by using the DisableScanningNetworkFiles policy setting described in KB971026. Therefore, if you implement the DisableScanningNetworkFiles, you should be able to remove any network-based file exclusions from your Client Security policy settings (screenshot above). This should eliminate the device conversion delay and allow logons to complete in a more timely manner.

We will update this blog when more information about this issue is available.

Thanks,
Craig Wiand
Forefront Escalation Engineer

TechEd 2009

2009-05-08T23:21:00Z

Hey folks – we’ve got an exciting line up of sessions about FCS and Stirling that you will want to add to your TechEd schedule – come see the product group talk about our new exciting features!

I’ve listed all the sessions available for all Forefront products below. Come visit us at the product booths for more details, and to speak with the product group members!

Session number	Session title	Scheduled speakers
SIA204	Security Management and Protection: What's in Microsoft Forefront Client Security Version 2	Bashar Kachachi and Neha Sharma
SIA318	Protection: Next Generation of Messaging and Collaboration Protection	Mitch Hall and Mike Chan
SIA319	Protection: Targeting Spam with Forefront	John Gargiulo and Terry Zink
SIA321	Security Management: Integrated Enterprise Security with Microsoft Forefront Code Name "Stirling"	Chris Sfanos and Eric Fitzgerald
SIA01-TLC	Next Generation Messaging and Collaboration Protection Drilldown	Mike Chan/Mitch Hall/Terry Zink/John Gargiulo
SIA02-TLC	Advanced Deployment of Microsoft Forefront Code Name "Stirling"	Chris Sfanos and Neha Sharma

We’ve also got Hands on Labs (HOL) available for you to work with the Forefront products while you are at TechEd:

HOL number	HOL title
SIA11-HOL	Overview of Microsoft Forefront Code Name "Stirling" (Beta)
SIA12-HOL	Overview of Microsoft Forefront Unified Access Gateway
SIA13-HOL	Protecting Microsoft Exchange Server 2007 Against Malware and Spam with the Next Generation of Microsoft Forefront Security for Exchange Server (Beta)
SIA14-HOL	Protecting Against Malware and Inappropriate Content with the Next Generation of Microsoft Forefront Security for SharePoint (Beta)

Hope to see you there!

FCSNerds at it again...

2009-04-01T23:35:00Z

Hello folks!

I'm happy to share with you another wonderful post from our friends over at the FCS CSS Support team (FCSNerds). CraigW just posted some directions on how to slipstream a Client Security engine update into your SCCM or script-based initial Client Security client deployment, so that you are deploying the most up to date engine.

Take a look: http://blogs.technet.com/fcsnerds/archive/2009/04/01/slipstreaming-a-client-security-client-installation.aspx.

Happy reading and deploying!

More resources.....

2009-03-06T00:32:00Z

Hello FCS experts!

I'd like to introduce you to Kurt Falde's blog. Kurt is a CSS Security Engineer, and has some fantastic info, tips and tricks for FCS use and support.

Take a look - I think you'll find some great information....

Thanks!

Tamper protection from the Security Wizard

2009-01-30T01:59:00Z

Howdy everyone! Just wanted to post a quick Yay!! For Yaniv! – Yaniv once again has posted some great information about enhancing your Client Security environment. Please take a minute to read his post (http://blogs.microsoft.co.il/blogs/yanivf/archive/2009/01/09/temper-protection-in-forefront-client-security.aspx).

In his words:

"Every Anti-Virus has a mechanism called tamper protection that helps administrator keep users from mishandling there antivirus settings and services. Forefront Client Security only offers basic control over what the user can or cannot do with the FCS Client Console on his client machine. What the FCS System doesn’t provide is a built-in mechanism to protect FCS services from being stopped or prevent FCS from being removed by the user…."

Go read the rest of his post. Really. You’ll like it. And you’ll be glad you did.

Client pods…..

2008-11-14T20:05:00Z

The FCS Nerds have a great blog post describing how to relocate an FCS client to a new management group, or “pod”.

You can find the post here. Happy reading!

SCCM and WSUS announcements!

2008-10-20T17:59:00Z

Today we posted guidance on using an existing WSUS server from an SCCM deployment for FCS definition distribution. The complete guidance, Deploying FCS definition updates with a shared System Center Configuration Manager WSUS infrastructure (http://technet.microsoft.com/en-us/library/dd185652.aspx

), can be read on TechNet.

Refer to Supported configurations for using WSUS to distribute Forefront Client Security Definition updates within SCCM 2007 (http://support.microsoft.com/default.aspx/kb/958491) for supported FCS and Configuration Manager shared configurations.

Also, we are announcing support for definition distribution via WSUS 3.0 installed on an x64-based platform. To support this configuration, the FCS distribution component must not be installed on the x64-based WSUS 3.0 server, as WSUS 3.0 does not require the installation of the FCS distribution component. Existing FCS documentation will be updated accordingly.

Social Bookmarking??

2008-09-25T00:44:00Z

Hello FCS experts – and you know who you are. You are the ones who have figured out the tips and tricks for using FCS, and have found the most interesting and relevant TechNet information about FCS. The TechNet team wants to make it easier for experts like you to share their favorite TechNet articles and links, so they’ve release their v1 of social bookmarking.

And you can use it to share your best or favorite links on TechNet or MSDN with others.

Available in two flavors – TechNet (social.technet.microsoft.com) and MSDN (social.msdn.microsoft.com). Chris Slemp has a bunch of info on how to use this great new tool on his blog (http://blogs.msdn.com/cslemp/archive/2008/09/09/launched-social-bookmarking-v1-on-msdn-and-technet-video.aspx).

A tip: use the tags! It makes the relevant content easier to for others to find based on category…

Enjoy!

FCS SP1 releases!

2008-08-27T01:20:00Z

Today we are pleased to announce the availability of Forefront Client Security Service Pack 1 (SP1).

FCS SP1 adds support for:

Agent protection on Windows Server 2008 – both Server and Core.

Server role support on Windows Server 2008 (server only) for FCS server components.

FCS Enterprise Manager on Windows Server 2008 (server only).

To obtain FCS SP1, first install FCS. After successfully installing FCS, you will be offered SP1 via Microsoft Update. For more information, read the FCS SP1 Release Notes (http://go.microsoft.com/fwlink/?LinkID=126287) or see Microsoft Knowledge Base article 951951 (http://support.microsoft.com/default.aspx/kb/951951)

Tools anyone?

2008-08-11T18:29:00Z

Did you know that Microsoft has an open source hosting website? Codeplex (www.codeplex.com) is a Microsoft website that hosts customer-driven projects, and allows customer collaboration on these projects.

The cool thing about Codeplex is that it allows YOU, our customers, to share your FCS solutions. There’s a section for Forefront Client Security tools – you can reach it by entering Forefront in the search text box in the upper right of the Codeplex homepage, or go straight there by navigating to http://www.codeplex.com/fcscompete. The full list of available customer-driven tools is on the Releases tab, in the Releases list box on the right hand side.

Yaniv Feldman has posted a solution for updating FCS definitions using MOM 2005 tasks (http://www.codeplex.com/fcscompete/Release/ProjectReleases.aspx?ReleaseId=14225). You can read more about the tool and how to use it on Yaniv’s blog: http://blogs.microsoft.co.il/blogs/yanivf/archive/2008/06/09/forefront-client-security-remote-definitions-update-using-mom-tasks.aspx.

Johan Blom has also contributed a tool to the FCS Codeplex collection. Johan’s contribution sets scan exclusions for Exchange 2007 servers, making it easier to use FCS to protect your Exchange server. Johan’s project can be accessed on Codeplex here: http://www.codeplex.com/fcscompete/Release/ProjectReleases.aspx?ReleaseId=14026. You can read more about the tool and how to use it on Johan’s blog at http://www.msforefront.com/, and looking for the title “Scanning exclusions when running FCS on Exchange 2007 made easy”.

Have you posted an FCS tool to the FCS Codeplex collection? If so, send us an email using the feedback link in this blog to let us know!

Subject: Using Forefront Client Security and System Center Configuration Manager while Leveraging the Same WSUS Server Role

2008-08-06T01:47:00Z

Hello,

The Forefront and System Center teams recognize the importance of enabling customers to take advantage of both Forefront Client Security (FCS) and System Center Configuration Manager (SCCM) in their environments today. This is a request that we have received from the Microsoft field and customers around the world.

FCS and SCCM both rely on Windows Server Update Services (WSUS) as a key part of the overall Microsoft architecture. FCS is optimized for automatic signature distribution via WSUS. SCCM also uses the WSUS server role for key software distribution scenarios. This allows each product to do their own jobs effectively, and helps customers limit the infrastructure it may require for both solutions. Questions have arisen around support for the coexistence of FCS and SCCM in an enterprise, while still leveraging the same WSUS server role. There have been additional questions and feature requests regarding the automated deployment of FCS signature files through the SCCM console, using the SCCM client relationship.

We are in the process of writing a Knowledge Base article which will clarify the scenarios that are supported when using Forefront Client Security and System Center Configuration Manager. At the same time, we are updating the documents which were posted on Codeplex to provide guidance on what customers should do when configuring their environments under the supported scenarios included in the KB article. We are targeting the release of the KB article and prescriptive guidance by the end of August.

We really appreciate your patience while we put together the necessary documentation.

Best regards,

Forefront and System Center Teams

NAP and FCS

2008-06-19T00:41:00Z

For some more technical depth on the Solution Accelerators Forefront Integration Kit for Network Access Protection (NAP), I'd like to introduce Dan Griffin. The following blog post was written by him.

The purpose of this blog post is twofold. First, to briefly answer the following question: how does NAP (see the acronym reference at the bottom) implement sandboxing for non-compliant clients – in other words, how are unhealthy computers are kept separate from the healthy computers?

The second purpose is to answer this question: what does this have to do with the new Forefront/NAP integration kit from Solution Accelerators?

However, before I get to either point, or to the example in the next section, I need to provide some NAP guidance.

Namely, I’ve been asked to clarify that there are in fact five different enforcement methods supported by NAP: 802.1x, DHCP, IPsec, Terminal Server Gateway, and VPN. The example I’ll discuss is DHCP, but you should keep in mind that it suffers from some security shortcomings.

First, DHCP enforcement puts non-compliant client in a restricted network. However, that really only consists of a simple set of default routes, plus the lack of a default gateway. Thus, sophisticated users with administrative access may be able to bypass the restriction and route traffic into the compliant network.

Second, because of inherent limitations in the public DHCP standard, it doesn’t offer server authentication or message integrity. That is, someone with access to your LAN could maliciously modify DHCP traffic without the client or server being able to detect it.

Neither limitation exists in a NAP deployment over certificate-based IPsec, for example. The IPsec client and server are mutually authenticated and the network traffic is protected by encryption and cryptographic checksums.

However, for the purpose of learning about NAP, and for doing a proof-of-concept deployment in a lab, DHCP is tough to beat. It’s less complex to setup than the other scenarios and can thus be done more quickly. For instructions on doing so, see the step-by-step guide here.

That’s it for the introductory stuff – onward to the example.

FCS/NAP Architecture

Suppose, despite the caveats above, that the NAP enforcement scenario is DHCP. Client computers won't be given full access to the corporate network unless they are deemed compliant by NAP.

The first step is that the NAP agent on the client sends a Statement of Health (SoH) along with the request to the DHCP server. In the following diagram, the client could be either of the laptop-shaped images on the left-hand side. The server in this picture, at the bottom of the larger oval, is playing two roles: DHCP server as well as Network Policy Server, or NPS.

The DHCP server receives the DHCP request from the client, extracts the SoH, and relays it to the NPS to be evaluated. In this example, that's just a question of one service talking to another service on the same server.

If the SoH is considered to be compliant, then the DHCP server responds with an IP lease on the main, NAP-compliant, corporate network. If the SoH is not compliant, then the DHCP server grants the client an IP lease on the restricted, non-compliant, sandbox network.

So how does the new FCS/NAP solution play into this? It's a question of what information is included in the SoH, and how it's evaluated by the NPS. FCS/NAP consists of two plug-ins: a System Health Agent (SHA) for the client and a System Health Validator (SHV) for the server (NPS).

Data Flow

The client SHA adds Forefront-related information to the SoH to be evaluated by the SHV. Think of the SoH as a list of answers to preset questions. For example, one item is an answer to the question “Is the Forefront client currently running?” (That’s determined by the data path represented by arrow #2 in the following diagram.) Another is an answer to the question “Are the client’s virus signatures are up to date?” (See arrows #1 and #3.)

When the FCS/NAP SHV receives that SoH (arrow #5), it evaluates each of the answers against the health policy configured by the administrator. For example, if the answer to the question about whether Forefront is running is “No,” then the SHV checks whether the current policy indicates that Forefront must be running on healthy clients.

After evaluating each answer in the SoH in that way, there are two possible states the SHV can report to the NPS:

1. The client is healthy/compliant, or

2. The client is un-healthy/non-compliant.

In the latter case, for each non-compliant policy item, the SHV provides a message to explain to the user the reason, or reasons, why the machine is non-compliant. For example, “The Forefront client isn’t running,” and “The virus signatures are out of date,” etc. These messages are visible via built-in tools such as napstat.exe and netsh.exe.

Additional Configuration Considerations

There are a few NAP configuration scenarios that aren’t distinguished by these diagrams.

The first is NAP in “reporting” mode. In reporting mode, NAP doesn’t actually quarantine non-compliant clients; it simply reports on their health. This is a good configuration for customers who are evaluating or piloting NAP. Reporting mode doesn’t affect the SHV; it still works as described above.

The second scenario is NAP in enforcement mode. Non-compliant clients get quarantined.

Regardless of whether NAP is doing enforcement, there’s also the option of auto-remediation. How does this affect how the SHV behaves?

Without auto-remediation enabled, the SHV again behaves as described above. That is, each aspect of non-compliance is addressed with a string explaining what’s wrong.

However, with auto-remediation enabled, the SHV must place different information into the SoH response when the client is non-compliant. The auto-remediation response information consists of two things:

1. Different strings are used to distinguish between the scenarios in which the user is expected to take corrective action manually (“instructive”), versus the scenarios in which corrective action will be taken automatically by the SHA (“informative”). The latter is what auto-remediation is all about.

2. The SoH response must also include programmatic instructions from the SHV to the SHA about what specific auto-remediation actions to take. For example, if one of the required Forefront services isn’t running, and policy requires that it must be running, then the SHV will set the bit in the SoH bitmask instructing the SHA to attempt to automatically start the service.

Acronym Reference

· DHCP = Dynamic Host Configuration Protocol

· FCS = Forefront Client Security

· NAP = Network Access Protection

· NPS = Network Policy Server (the NAP server)

· SHA = System Health Agent (client-side NAP plug-in)

· SHV = System Health Validator (server-side NAP plug-in)

· SoH = Statement of Health (sent by the client)

More Information

For more information about FCS/NAP, please see:

· My blog

· The Solution Accelerators Security & Compliance blog

· The Forefront blog

· Forefront on TechNet

· The NAP blog

· NAP on TechNet

Bio

Dan Griffin is a software security consultant in Seattle, WA. He previously spent seven years at Microsoft on the Windows Security development team. Dan can be contacted at www.jwsecure.com.

Disclaimer

This posting is provided "AS IS" with no warranties, and confers no rights.

NAP Anyone?

2008-06-13T19:17:00Z

The Forefront Client Security team is pleased to announce the public availability of the Microsoft Forefront Integration Kit for Network Access Protection (NAP)!

NAP is a technology provided with Windows Server 2008, and works with Vista and Windows XP with Service Pack 3. With NAP, you can restrict network access based on the computer’s compliance with your corporate security policy. Computers out of compliance can be prevented from accessing the network until they have remediated the items out of compliance.

For more information about the Integration Kit, including features and customer stories, see the Solution Accelerators blog (http://blogs.technet.com/secguide/default.aspx), and the Solution Accelerators TechNet site (http://technet.microsoft.com/en-us/library/cc512112.aspx). To download the Integration Kit, see the Microsoft Download center.