Forefront Client Security - Security State Assessment Forum

I need to exclude some checks reported by the Security State Assessment check.

Thu, 12 Nov 2009 11:34:36 Z

I work in an organisation with approx 5000+ clients. We are in the process of migrating to Microsoft Forefront from McAfee. When I run the 'Security State Assessment Summary', there are a few checks which I would like to disregard. For example, each client machine has a built in Admin/special account logins which are set to never expire. These are bing flagged by the vulnerability report. Also, certain generic 'autologon' machines are being flagged that we have setup.

Is there a way to exclude these and other checks from the SSA scan?

Unnecessary Local Administrator Check

Thu, 09 Jul 2009 22:35:18 Z

Several of the workstations in my network are reporting back as "medium" because they are failing the "number of uncessary Local Administrators" check, with a value of "2".

In each case, the default Administrator account is disabled. We've created a default user account to be a local admin account on each workstation (so that we can script the password change every 3 months) and those two are the only accounts (other than the standard Domain Admins account).

The clients are all Vista x64 boxes, with the latest service patch. FCS has been patched up fully, and works fine.

Do I need to re-enable the local admin accounts and get rid of the default user account? I'm not sure why that's any tighter, security-wise, especially since the local administrator account can't be locked out.

Thoughts?

Autologon is not configured, but a plaintext password might be exposed on this computer.

Fri, 07 Aug 2009 22:39:57 Z

I have a lot of computers showing up under the Autologon Vulnerability report, none of them actually have autologon enabled. But they show this error - Autologon is not configured, but a plaintext password might be exposed on this computer.

I clicked the more link on the report and it pointed me to an article on turning off the autologon. But says nothing about how to resolve this issue.

Any ideas? It's making my numbers for vulnerabilities higher than it needs to be.

thanks

Microsoft Forefront Client Security Antimalware Service not installed

Tue, 27 Oct 2009 02:37:14 Z

After install FF I cannot find Microsoft Forefront Client Security Antimalware Service!

Every time system boot will show error : application failed initialize...

Uninstall it and install again. The service still not installed?

Why?

Agent Helper.exe

Fri, 23 Oct 2009 14:00:17 Z

Is this Resource Kit utility supposed to be able to run on the version of MOM that comes with Forefront?

Shares Check - no reports ?

Wed, 18 Feb 2009 13:19:26 Z

Hello All,
I'm looking through my Security State Assessment reports, but can't see the Shares Checks for any of my machines. any ideas what I should do to make them visible?

I'm running FCS SP1

thanks
Howard

How do I get MSAT. I can't find I valid link to download from Microsoft

Mon, 12 Oct 2009 22:50:40 Z

I want to download the MSAT to test it out, but I can't find a good link to get the download. Can someone give me a correct link.
Thanks.

If I am in the wrong group tell me what groups I should post in.

Link1: https://partner.microsoft.com/40081388?msp_id=msat

Link2: http://technet.microsoft.com/en-us/security/cc185712.aspx

MSAT

Tue, 13 Oct 2009 17:47:04 Z

The link for MSAT does not work. Where can I get the app?

Update forefront vulnerability engine

Wed, 30 Sep 2009 12:46:38 Z

Forefront Vulnerabilities Engine Deployment Status shows that my machines have old engines. After installing Definition Update for Microsoft Forefront Client Security (Security State Assessment 1.0.1710.103 Full) I still have the engines with an old version.

I read some articles how to manually update the engine but this have not worked. Can this be done automatically some how?

Now I have copied the manifest file from the C:\Program Files\Microsoft Forefront\Client Security\Client\SSA\Updates\Patch-1.0.1710.103 folder

I also copied the dlls to the C:\Program Files\Microsoft Forefront\Client Security\Client\SSA folder.

Then I restarted the server and editted the registry HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Microsoft Forefront\Client Security\1.0\SSA and changed the WorkingManifestVersion to 1.0.1710.103

This however is not something I want to do on 200 machines....

Can not install Security state assessment version 1.0.1710.103 on Vista

Fri, 28 Aug 2009 00:45:51 Z

Hi,
i've tried many times to install this update but still got the error code 80070003. With the help I followed the instruction by deleting all the update log. But still after it won't install. Please help me out with this situation. Thanks

Security State Assessment Service policy applied with errors

Fri, 21 Aug 2009 13:56:42 Z

I intsalled Forefront Client Security on Windows Server 2008 R2 RTM using the /NOMOM switch because this is a standalone intallation. Each time the Security State Assessment Service (FcsSas) starts, it records event 10006 (Forefront Client Security State Assessment Service policy applied with errors. Reverted to the following settings: Schedule Type: Interval Time: 12 Parameter: ).

There is no option in the FSC console to run a Security State Assessment scan.

Is this behavior expected? Are Security State Assessment scans available only in a managed environment?

Thanks.

32 bit or 64 bit

Sun, 14 Jun 2009 11:29:02 Z

How can I find out if my computer will work with 32 or 64 bit? can anyone inform pse? I downloded 64 bit but I'm not sure. Tks.

Forefront Client Security State Assessment Service

Fri, 27 Mar 2009 16:36:54 Z

Hi!

I have this error when I try to install the FCSSA in a Windows 2000 Server:

MSI (s) (94:1C) [10:08:55:135]: Executing op: ComponentUnregister(ComponentId={B7296B3B-7EED-4BED-A7A0-B15277D85ECD},ProductKey={E8B56B38-A826-11DB-8C83-0011430C73A4},BinaryType=0,)
MSI (s) (94:1C) [10:08:55:151]: Executing op: ComponentUnregister(ComponentId={2DDC2983-09EF-4C0E-BA73-D6BA29B923CE},ProductKey={E8B56B38-A826-11DB-8C83-0011430C73A4},BinaryType=0,)
MSI (s) (94:1C) [10:08:55:151]: Executing op: End(Checksum=0,ProgressTotalHDWord=0,ProgressTotalLDWord=0)
MSI (s) (94:1C) [10:08:55:151]: Error in rollback skipped. Return: 5
MSI (s) (94:1C) [10:08:55:151]: Unlocking Server
MSI (s) (94:1C) [10:08:55:151]: PROPERTY CHANGE: Deleting UpdateStarted property. Its current value is '1'.
MSI (s) (94:1C) [10:08:55:167]: Note: 1: 1708
MSI (s) (94:1C) [10:08:55:167]: Producto: Microsoft Forefront Client Security State Assessment Service -- Error en la operación de instalación.

MSI (s) (94:1C) [10:08:55:167]: Cleaning up uninstalled install packages, if any exist
MSI (s) (94:1C) [10:08:55:167]: MainEngineThread is returning 1603
MSI (s) (94:64) [10:08:55:167]: Destroying RemoteAPI object.
MSI (s) (94:B0) [10:08:55:167]: Custom Action Manager thread ending.
MSI (c) (AC:FC) [10:08:55:182]: Decrementing counter to disable shutdown. If counter >= 0, shutdown will be denied. Counter after decrement: -1
MSI (c) (AC:FC) [10:08:55:182]: MainEngineThread is returning 1603
=== Verbose logging stopped: 27/03/2009 10:08:55 ===

Can anybody help me with this, please!!??

Thanks a lot!!

Prevent Security State Assessment "Succesful scan" events while still reporting the results of the scan

Wed, 24 Jun 2009 20:11:57 Z

Is there a way to prevent Security State Assessment "Succesful scan" events while still reporting the results of the scan.

question regarding windows password scheme

Sat, 16 May 2009 02:11:03 Z

Hi guys,

Im interested in learning security stuff, Im just wondering, how windows saves our password in the system?
in some other websites, it says that windows doesnt use salt to the password scheme? and I cant find the answer as well. hope you guys can tell me this stuff.
I know that windows uses the NThash for the password. but then the idea of salt is also good to enhance the security. why why why windows doesnt use it???

Thanks guys

chi em

Fri, 27 Mar 2009 19:41:51 Z

Anh Tuan

Cannot start Firewall

Fri, 06 Mar 2009 17:17:36 Z

Hello
I cannot restart the firewall. The message says the Firewall doesn't use the recommended parameters. When I click update th parameters now then I get the message the parameters cannot be displayed because the associated servcice is not running. Would you like to restarty the Firewall.
When I click yes I get again the message the firewall cannot be started.

I am running Vista pro on my Netbook.

Thanks for your help

Superpapi

I am lost... what does it mean "No threads found for user?"

Thu, 11 Dec 2008 19:39:17 Z

I am lost... what does it mean "No threads found for user?"

Want to allow only Aim Messanger for in ISA server

Tue, 30 Sep 2008 19:59:57 Z

Hi Everyone !!

I have ISA server 2006, In my Network every sites are restricted as per the policy. Now I have the requirement to Enable AIM Chat for all the users.

Please suggest the procedure ..........

Regards,
Ashwini

Know more about Messaging :-)

SSA causing File Server to hang

Tue, 21 Oct 2008 12:33:31 Z

After working with Microsoft Premier support on an issue of a File server hanging every day around the same time for a few minutes we have discovered the problem appears to be SSA. As soon as I disabled it we have no longer had the hangs. We were having them every day around the same time in the morning and occassionally 12 hours later which was the interval SSA was being performed at.

False Virus Alarm

Thu, 21 Aug 2008 14:22:02 Z

Hello,

This is Cristina from Customer Service Department of Interactive Networks. Our company develops instant messaging software and we have recently received a report from one of our customers about a false virus detected by Forefront Client Security software in one of our files.
The name of the file is "bircd.exe" and it is part of the IRC component integrated in one of our chat modules.
I have been trying to reach Forefront Client Security support people but it was not possible, I have just received automatic replies.
Our customers need a quick solution since they are no longer able to use our product because of this false alarm.
Who should I contact to help me out with this?

Thank you.

Cristina
Interactive Networks Inc.
crodriguez@interactiveni.com

Scheduling of SSA scans

Mon, 08 Sep 2008 17:57:10 Z

Is there a way to change the schedule of when the SSA scan occurs on an unmanaged client?
We are working on the management server, but everything is not in place for it yet. I have several users who report slow downs and each time I've looked it is during an SSA scan. I'd like to be able to change what time it runs to the wee hours of the morning so as to not disturb my users.

Thanks.

FCS Install; Reports database is removed by upgrading SQL 2005 with SP2 - On 2008 Server.

Tue, 16 Sep 2008 18:14:21 Z

Hi I am testing FCS on WIN 2008 in a test environment prior to deploying;

I am unable to install FCS after upgrading SQL 2005 with SP2 (The reports Database disappears) and FCS fails when it tries to authenticate to the Reports Database & will not let me proceed

Can anyone help?

Thanks

Andy

ISA 2004 Error Code 403 forbidden

Wed, 25 Jun 2008 23:59:10 Z

Hi! I’m Hobert from the Philippines and I am new in handling ISA Server 2004. I am seeking for an advice for the error that all the clients are receiving. When they click for a browser, more often it gives the ERROR CODE 403 FORBIDDEN. THE ISA SERVER DENIED THE SPECIFIED UNIFORM LOCATOR (URL) (12202). By the way, our ISA server is a member of the domain, and is configured as Edge Firewall.

Error with Deploy Policy on Microsoft ForeFront Client Security

Wed, 28 May 2008 14:20:16 Z

Hi, I have this error when I try to deploy policy on Microsoft ForeFront Client Security:

Microsoft Forefront Client Security:

=========================

The policy cannont be deployed.

Futher details:
Unable to create new group policy object.
The specified domain either does not exist or could not be contacted. (Exeption from HRESULT: 0x8007054B)

Could you help me?

This forum is moving the week of 5/27

Tue, 13 May 2008 14:21:35 Z

Microsoft has created a new forums platform (MSDN | TechNet | Expression | Microsoft) with increased performance, stability, and an improved user experience. During the week of 5/27 this forum will be moving to the new platform. To make sure this is a smooth transition, we want everyone using this forum to have a chance to try out the new forums in advance, and give feedback. We’ve created a Sandbox forum, where you can create threads and try out functionality, and a suggestions forum where you can give us your feedback. Please take some time to go to the new forums today and let us know what you think.

On the day the forum moves to the new platform, a post will be made letting you know the process has been started, and the forum will be locked to new posts. Once the process is complete, a final post to the forum will be made letting you know the forum has moved.

1. All posts in the forum will be preserved

2. Any points you’ve received for replies will move with you (on a per forum basis)

3. Any bookmarks to this forum or threads within this forum will redirect to their new location

4. Your “My Threads” will be preserved on the new platform

The only thing you’ll need to do after migration is set Windows Live Alerts for any threads you were tracking.

If you have feedback, let us know in the suggestions forum or contact me directly at Andrew.Brenner at Microsoft.com

Thanks,

-Andrew

Variable Password Expiration Time

Fri, 25 Apr 2008 13:19:37 Z

Is there a way to make the time it takes for a password to expire variable in SQL Server?

I'm working on a project that has different requirements for password expiration depending on the type of user. For example, a normal end user logging in can follow standard system policy for expiration (30 days). However, a system user (aka service account or application user) only needs to change once a year.

And since changing the password that application uses to login requires updating the connections managed in the application server, changing it is a pain. So I don't want to force the app users to follow the more strict policy. Is there a way to make the expiration variable by user?

change ssa reporting

Thu, 15 Nov 2007 09:25:57 Z

Is it possible to change what the SSA checks & reports on? I want it to ignore certain checks but cannot find where i can do that from.

Thanks

Kass

password expiration control

Sat, 13 Oct 2007 02:14:08 Z

for those systems that us a name change for the admin account I'm receiving alerts for password expiration. it would be great if thier was a way to exclude certain accounts from the check by adding to the pool of system service accounts.

mean of forefront client security

Sat, 10 Mar 2007 10:21:58 Z

this is pesonal data security with the help of that...

knowing that get that with intract with client offering

SSA scan behavior

Mon, 05 Mar 2007 23:35:35 Z

Hi!

I just tried to edit the Vulnerability manifest to destroy the file signature. I wanted to find out the behavior of SSA if the manifest was tampered with in any way

I ran a Quick scan of the computer and the SSA simply does not run. I would have liked the SSA to overwrite the corrupt manifest file with a valid one. (reapply the definition update from WSUS?).

This way i can "turn off" the SSA scanning just by corrupting a file. right?

/johan