Stuff n Things : FCS

Some Interesting FCS SQL Queries

kfalde — Sat, 09 May 2009 00:39:31 GMT

With a recent case I have an issue where the client count of managed computers in MOM admin console was quite different then that in the FCS console so I was trying to find out exactly which computers were not in FCS so I could troubleshoot some of those more effectively. The first thing I checked was looking at Agent-Managed Systems in MOM admin just to make sure these were not computers that had not been checking in for a while (they weren’t all had heartbeats within last day or two) as I know we drop off computers from our total count in the FCS console that have not checked in in 30 days. Since this was not the case I was pointed out that it may be an issue with clients having the MOM agent but not actually having SSA or AM installed on them or corrupted in some way. Unfortunately I didn’t know a good way to check on this in MOM so I had to do some digging around to create some queries to make this happen, below are the results I have:

This one is the easiest but just dumps a list of all computers in MOM, make sure you select to use the OnePoint db when you start a New Query in SQL Server Management Studio

Select Name from Computer

This next one selects all the computers that have FCS installed on them

select Computer as FCSCLIENTS from computertocomputerruleview where [Rule] like '%Microsoft Forefront Client Security Agents%' order by FCSCLIENTS

This one does a subquery of total computers against computers that have FCS on them to give us a list of computers that for some reason do not have FCS on them.

select distinct Name as MISSINGFCS from Computer where Name not in (Select Computer from computertocomputerruleview where [Rule] like '%Microsoft Forefront Client Security Agents%')

Hopefully this helps someone else as well.. I’ll hopefully add to this over time if I find anything more that’s useful.

Update 7/10/09 Adding some more based on a request from a blog reader. Customer looking for a way to list all detection events. You could actually play around with this some as this View does have events from other sources as well as FCSAM.

SELECT [LoggedOn]
      ,[LoggedOnDomain]
      ,[Source]
      ,[Evtime]
      ,[Eventno]
      ,[Evttext]
FROM [OnePoint].[dbo].[EventView] where source like '%FCSAM%'
and ([Eventno]='1006' or [Eventno]='1007' or [Eventno]='3004' or [Eventno]='3005') order by [Evtime]

You could also do some filtering by date by adding an extra “and ([Evtime]>='2009-06-10' and [Evtime]<='2009-06-13')” statement to this before the order by statement.

Just as an FYI tables/views/db schema of FCS/MOM are not documented/supported in any way so if any of these break with some update :) :) that’s life.

Changes to Microsoft Anti-Malware

kfalde — Wed, 19 Nov 2008 20:14:00 GMT

This doesn’t really affect the FCS world but it is an interesting development. https://www.microsoft.com/presspass/features/2008/Nov08/11-18AmyBarzdukasQandA.mspx apparently we are going to begin to offer a no-cost anti-malware solution in 2nd half of 2008. This is going to be more targeted at the end-user market it appears from the look of it. Check out the article for an interesting read.

FCS .adm settings

kfalde — Fri, 14 Nov 2008 19:50:00 GMT

I’m not really advocating using this and I can’t take credit for this as it was posted on the FCS forums by a “lofty10”. However I do know that many people are looking for something like this to manage FCS clients that do not have an FCS server infrastructure for whatever reason. Just remember that you get no reporting whatsoever doing this but you can at least control some scan/update intervals and exclusions. I have the .adm located on my SkyDrive at the following link.

FCS Intervals

kfalde — Fri, 17 Oct 2008 21:22:00 GMT

So you've seen the following options with your FCS settings and are wondering how do these work???

Malware Scanning

"Run a Quick Scan at set interval (hours):"

Security state assessment

"Scan at set interval (hours):"

Malware Definition Updates

"Check for updates at set interval (hours):"

We had a customer recently ask about this as they were having systems miss their scheduled scans for too many times which eventually causes the client to return the wonderful Orange Box with regards to haven't had a scan in more then 10 days. Initially it appeared that their scheduled scan was set to 5am or something of that like and the systems in question (mostly laptops) were turned off during this time period. Based on this we recommended setting a quick scan interval which the customer did however they were still having problems with missing scans. When we checked into the interval being used the customer had set it to 24 hours for quick scans...

So here's the problem and how it works. When the FCS client/service starts it basically creates a timer object which says right now is time 0 and at "interval" hours from now I will run whatever it is that needs to run Quick Scan/SSA Scan/Definition Update. The problem here is that when systems are turned off this timer object goes away and is basically restarted when the system restarts. So in our customers case the systems in question were being turned off at night and the 24 hour interval was never reached and the scan never performed. Based on the users computing habits we have basically recommended that the interval be set to something around 5-6 hours so that it will hopefully run at least 1x during the work day while the system is on but not multiple times so to not cause performance issues while the user is working.

Another side note of interest is that if your system hibernated between the intervals it should not reset the timer from what we have seen and the scan should still occur. Supposedly if your system is hibernated/in sleep mode it should also try to scan when you resume however I have not been able to test that yet to confirm (if anyone has a laptop and wants to try let me know your results).

FCS and System Center Essentials

kfalde — Thu, 09 Oct 2008 01:16:00 GMT

Just found this posting on the SCE forums regarding integration of SCE and FCS:

http://forums.microsoft.com/TechNet/ShowPost.aspx?PostID=1797488&SiteID=17 is the link, The text is below from the forum posting:

Question 16: Can I use Essentials 2007 and Forefront Client Security to manage the same computers?

Yes. Please read through these configuration steps to understand how to use both products in the same environment.

Setup

Base requirements:

· Essentials 2007 must be installed on x86 hardware.

· Forefront Client Security must be installed in the 2 machine (or more) supported configuration from their guide, where the SCE server is the distribution server component. No other FCS workload is supported on the Essentials server.

· All FCS managed machines must be SCE managed machines

Configuration notes:

· If the FCS distribution server is installed on to Essentials 2007, it will alter the subscription and approval settings already configured. The administrator will need to re-run the Update Management Wizard again to apply custom settings. It is important that the “Definitions” classification and the “Forefront” product remain subscribed and declared in the auto-approval settings.

· If Essentials is installed on to the Distribution server running FCS, the same classification and product settings need to be applied.

· The Essentials 2007 default client and server scan times fall 1-2 hours after the FCS scan, which may leave managed machines up to 22 hours stale. We recommend using Group Policy to set the client scan time to 4:00 AM, and the Server Sync time to 1:00AM.

Operation

It is important to note that the purchased limits of the FCS solution must remain within the purchased limits of the Essentials solution.

FCS SP1

kfalde — Fri, 29 Aug 2008 22:35:00 GMT

So Forefront Client Security SP1 is out now. To download it go to the Microsoft Update Catalog http://catalog.update.microsoft.com/v7/site/home.aspx and search for "Forefront Client Security SP1" this will allow you to download it.

Here is the KB http://support.microsoft.com/default.aspx/kb/951951

Here are the release notes http://technet.microsoft.com/en-us/library/cc901470.aspx