Red X will not go away!
- Good day!
Forefront Managed Systems
Full Scans once a week. No Quick Scans.
No End User Access (locked down)
Fully Managed by System Admin
Virus detected- Icon turned from green check mark to Red X.
Red X will not clear up. Been about a week now.
Anything I can do besides editing the Policy and giving End Users access to Forefront settings?
I was under the assumption this would automatically clear up (automatically Smart-Clean).
Regards-
Andrew
All Replies
Thank you for your post.
According to your description, I understand that the Red X live in the system tray. If anything misunderstand, please let me know.
The red x means that Forefront Client Security has detected your system being infected by some sort of malware. If you have action access, you can click on the icon and choose “Take recommended action” from the menu. If no access, you will have to edit the policy to allow you to open the client GUI. After redeploy the policy and run gpupdate /force on the client computer.
Regards,
Nick Gu - MSFT- Proposed As Answer byNick Gu - MSFTMSFT, ModeratorFriday, August 21, 2009 10:03 AM
- Nick-thanks for the response.
Let me clarify.
I have managed Forefront installed. The default Forefront Policy is fully managed by the System Admin (no end user access at all).
If forefront detects Malware, the Green check Mark becomes a Red X.
From my knowledge, Forefront Client Security immediately suspends the infected file, then after a few minutes, it automatically takes recommended action.
For an Enterprise with 2000+ Computers, editing and redloying the Forefront Policy to allow the 'End User' to Smart Clean is not a good alternative. Hi,
Thank you for your update.
Yes, you are right. Forefront Client Security immediately suspends the infected file then after 10 minutes (non configurable time) it automatically takes recommended action. You should confirm whether the policy has deployed successfully. Please run gpupdate /force on the client computer.
Regards,
Nick Gu - MSFT- Thanks for your response.
I checked and double checked the policy and it did apply successfully. This only happens to a handful of clients.
I ended up modifying the security group that the pc's were in so I could smart clean, but this cannot be a good alternative in the future (espeially if this affects numerous clients).
Is MSFT aware of this "bug"?
