Forefront Client Security - General Forum

Forefront Client Security - x64 and Clusters

Fri, 13 Nov 2009 03:48:45 Z

So, we are going to be installing Forefront Client Security and we have chosen a six-server topology, the goal being to utilize our existing SQL Server infrastructure to house the Collection and Reporting databases. I keep seeing references to and have been told, nothing Forefront can resides on a cluster or x64. SQL Server can run on x64 and is cluster aware, so the only way this makes any sense is if something else (service or executable) would need to be installed on the DB server as well. Can someone shed some light on this?

FCS Updates via WSUS (KB915597) takes ~115Mb each

Thu, 26 Nov 2009 10:44:41 Z

Hello,

one update consists of two mpaam-fe.exe (~45Mb each), two mpam-fe_bd.exe (~14Mb each) and lot of deltas.

I understand all walkaround of full base and deltas, but I don't understand - WHY MY WSUS SERVER HAVE TO DOWNLOAD FULL DEFINITION FILES SEVERAL TIMES A DAY????????? I even can't calculate total month traffic...

I think there are some ways to keep daily updates in small size - for example FCS may use two different updates - one for full definition files (AND UPDATE IT ONCE A MONTH) and another one for deltas...

Deploy definition updates automatically with SCCM 2007

Wed, 25 Nov 2009 12:48:44 Z

Hello:
I've been reading some posts, and they're clearly explaining that is not possible to send definition updates automatically with SCCM or in the schedule needed for the antivirus.
So, those post are old and I need an update of this statement.
Could you tell me if it's possible to distribute automatically definition updates with SCCM 2007?
Thanks in advance,

Forefront Client Security - KB915597

Mon, 23 Nov 2009 20:02:40 Z

I have setup the Forefront Client Security with WSUS 3.0 about 3 months ago and it was working perfectly. I have a total of 1700 computers and of those computers about 200 have Forefront Client installed. I am in the process of installing Forefront to replace our current AV. In WSUS, i have it set to automatically approve definition updates for ForeFront. GPO Policy is set for all computers to point to WSUS Server. Also have the Forefront Policy setup and deployed.

Just recently, computers WITHOUT Forefront Client Installed is receiving a notification to install Definitions for Forefront Client Security - KB915597 thru Automatic Updates. From what i can see, this didn't start happening until the release of Forefront Client Security - KB915597 (Definition 1.69.1007.0) and has been happening ever since.

So i am looking to see why or what has changed to start causing computers to attempt to install this definition update when it DOES NOT have Forefront Cleint installed on it?

Currently running Forefront Client Security on a windows 2003 server
WSUS 3.0 Service Pack 2 on Windows Server 2003 x64
Clients running XP Pro w/ Service pack 3

FCS: Single Label Domain

Sun, 29 Nov 2009 09:31:56 Z

Is FCS supported in a Single Label Domain?

I've problems when I deploy FCS policy from FCS console....

SCCM & FCS: Download FCS updates from Internet

Fri, 27 Nov 2009 20:25:56 Z

Is it posibble to use SCCM to deploy not FCS updates and configure FCS client to download updates from Internet?

whatis this 0x80070502 error

Wed, 25 Nov 2009 22:37:16 Z

every time i try the windows update i get this on the same updat 0x80070502 and then says creating error log what is thisthis is on a security update which is a high priory update please help

Forefront and SCCM for dummies :)

Tue, 10 Nov 2009 15:46:54 Z

Hi, we have a running SCCM site, but we're not happy with our current malware solution and was thinking of trying out Forefront.

Does anyone have a dummies guide on how to setup Forefront, and how to get it to interact with SCCM?

Thanks in advance for any pointers :)

About permission in xp

Tue, 24 Nov 2009 08:39:35 Z

environment:XP, in local account "root", which is administrator
i set the permisson in regedit
permission: ONLY root in that permisson, which is full control
no any accont in there eg: SYSTEM, Administrator, all of that has been remove
now, my XP can't enter the safe/ normally go into windows
when computer compelet load the bar, than the computer reboot autoly, there is loops
The question is: can use the cmd to edit the permission? or any idea to solve this problem without reinstall

What is e7l6s24y4.exe?

Tue, 24 Nov 2009 04:12:43 Z

I recently seem to have removed a persistent infection of trojan 'backdoor.hupigon' using avg9.0 & malwarebytes malware scanner. after reinstalling avg & updating it, its id protection module was again disabled as before & i cannot enable it again. I then noticed e7l6s24y4.exe in c:\documents&settings\user1 folder. googling it led to prevx site where it is classed as a malware downloader, but running prevx3.0 free scan results in my pc being called 'clean'. is this exe file a problem or not?

Cost/Licensing for Forefront Security

Tue, 24 Nov 2009 16:31:00 Z

Does anyone know the cost if there is one for the Forefront Platform? Costs for licensing?

Thanks!

SQL 2005 with SP3/ Forefront Client Security Setup States Not Installed

Tue, 17 Nov 2009 15:27:11 Z

I am trying to install Forefront Client Security on Windows 2008 Server. I have installed all prerequistes according to http://technet.microsoft.com/en-us/library/cc901471.aspx. I have installed SQL 2005, I installed SP1 and tested and then installed sp3 and tryed again with the same results. The Resulte is Reporting Services 2005 SP1 is not installed. I can connect to \\servername\ReportServer and I get an answer stating Microsoft SQL Server Reporting Services Version 9.00.4035.00. The is the version for SQL 2005 SP3.

This message is only a warning and I am allwed to move foward. I click next and the install errors out on the first section of the install, Install the Collection Database.

Help Please

Thanks
Steve

mgt comsole

Mon, 23 Nov 2009 19:21:26 Z

can U tell me if I need the mgt console for client secuirty to work?

FCS deletes Offices files on opening?

Thu, 05 Nov 2009 21:55:29 Z

Hi,

today we found out that sometimes Office docx files are deleted on opening. It does not matter if they are stored locally or on a server share. When the user opens the file a .temp file is created and the original file is deleted. If the user closes the document without making changes, there is no warning that the file does not exist any more. If the user makes changes and tries to safe the file he is asked for filename and location.

This does not happen always but it is reproducible. We are not even sure that FCS causes this serious problem, we are just evaluating possibilities. Has anybody ever heard of a behaviour like this?

The configuration is: Windows 7 client, FCS and filter pack installed.

Regards,
Dagmar

Forefront Client Security to Forefront Endpoint Protection client management

Fri, 20 Nov 2009 18:16:07 Z

Can anyone tell me or point me in the direction of information about how FCS and FEP will handle client management?

For example: I have a FEP management server (should come out before the clients) can I use it to manage my FCS clients?, or I have a FCS management server can I use that to monitor and update a new FEP clients?

Compare forefront to symantec 12

Fri, 20 Nov 2009 13:13:19 Z

Hi,

We need tro decide whether wa want to renew our "Symantec Endpoint Protection Small Business Edition V12 Basic" or go for Forefront...

How do they compare? Forefront looks like a mission to master?

Thanks

Forefront Installation problems

Fri, 20 Nov 2009 16:27:58 Z

We have problems with Forefront Client installation in one computer, we activate the installer throw Console mode but not working, not started the installer or service; and the same installer works fine in another computers. please help

Including FCS and MOM Agent in WDS Image

Thu, 17 Jul 2008 01:05:42 Z

I was wondering if anyone could explain what the results would be in including the FCS client and MOM agent in a WDS image. I've done some looking but have not found any "best practices" in doing so. I'm basically concerned with how MOM would view the agents or if it would see them at all. Any comments or experience with this would be greatly appreciated!

Thanks,
Jeff

The Microsoft Forefront Client Security Antimalware Service service terminated unexpectedly.

Tue, 17 Nov 2009 15:25:00 Z

This is happening on several xp sp3 systems in our domain. Is anybody else having this issue? 2003 servers are not involved this is just happening on 32bit XP sp3 systems.

Forefront Client Security Deployment Tool

Mon, 16 Jun 2008 22:14:26 Z

After a lot of work, I am very pleased to finally announce the release of "Forefront Client Security Deployment Tool". FCS Deployment Tool is a free toolkit provides additional deployment capabilities in addition to those which are available with the RTM Version of FCS . This tool gives network and security administrators the ability to scan their network and/or AD, discover existing installed Anti-Virus solutions (currently supporting Mcafee, Symantec and Trend-Micro) that are already installed on their clients, uninstall existing AV solution and install FCS Client – all in one.

Nothing much to add, just that the Downloads of the Complete Toolkit and the User Guide are available at Codeplex via of the following link:

http://www.codeplex.com/fcscompete/Release/ProjectReleases.aspx?ReleaseId=14440

Always appreciate any feedback.

Was this post helpful? click Yes above.

Deploy Forefront Client Automatically

Mon, 16 Nov 2009 15:21:31 Z

Hi,

I recently install Forefront server, i can push MOM agent and i can download updates from microsoft using WSUS. I'v been conducting research on how to deploy forefront to clients automatically, pls can any one help give me guidelines step-wise.

Thx.

How clean FCS a infected file?

Tue, 17 Nov 2009 12:27:57 Z

Hi,

In my organization are many *.rtf files (over 2000). I`m very worried because if a virus infect this files i`m not sure how FCS clean this files. In my policies i turned off the option delete files in quarentine.
Therefore, what are the actions that FCS will take?
1. Put this files in quarantine.
2. Delete this files.
3. Others

Thanks.
Regards.

Force multiple machines to unmanaged mode

Thu, 12 Nov 2009 16:29:42 Z

Hi,

I will force multiple machines to unmanaged mode, and before delete it. The reason to do this is because this machines are shutdown and I cant contact whit this. The problem is that, in administrator console i cant do.
How i can force multiple machines to unmanaged computer group?
Anyone help me¿?

Best regards.

Thanks for all.

Forefront Endpoint Protection 2010 - NO MOM at all?

Thu, 12 Nov 2009 12:23:43 Z

Hi, I would like to know if Forefront Endpoint Protection 2010 will NOT contain any MOM/SCOM components any more? if so, will it leverage any SCCM component?

thanks!

microsoft forefront security managment console

Fri, 13 Nov 2009 05:05:09 Z

Hi Experts,

my company want to raise a token for web support of microsoft forefront client security console. we have EA licence of this product.

what is the requirement for that.......
and waht is the proccess i have to follow....

Thanks in advance ....

Balwan Singh

EBS 2008 Licence Question

Fri, 13 Nov 2009 13:56:10 Z

Hi,

I have a question regarding Licence for forfront security on Essential Business Server 2008, I know that there is a one year licence is included in EBS 2008, but my question is: when this one year is start? from the time that you install the EBS 2008? or from the time that we enter the Licence for EBS 2008? becuse we did install the EBS 2008 6 month ago for the test only, then we enter the same servers just 2 weeks ago (with the same install EBS) to production enviorment, and add our licences 2 weeks ago, that is why I want too know when this one year start?

Thanks,

Shahin

Shahin

Forefront won't run, "service not registered" error

Tue, 10 Nov 2009 20:48:03 Z

There is a PC at my office, that when logging in, complains that the Forefront service is not registered. In looking at the list of services, and comparing it to another PC that is working, the "Microsoft Forefront Client Security Antimalware Service" is missing from the list of services. I know that Forefront was working previously on this PC, in looking through event logs, it seems around 11/4, it started giving errors when attempting to update the Antimalware definitions.

I've tried to uninstall Forefront from this PC, to allow it to be re-installed by the Group Policy, the uninstall failed, and reported a "fatal error."

I would like to try to avoid a format and re-install of this PC, if at all possible.

Thank you,
Jason A

MsMpEng.exe - application error

Mon, 09 Nov 2009 14:39:39 Z

Error message concerning "memory could not be read". Also I'm having lots of problems with "scan terminated unexpectedly" on several of our systems. I've uninstalled forefront then reinstalled it manually. Is anybody else haveing these problems?

FCS Update Patch Size

Wed, 11 Nov 2009 12:24:23 Z

Hye, What is the average size of the update patch of FCS everytime it updates???

Multihomed MOM problem

Mon, 01 Dec 2008 10:50:21 Z

Hi Guys

I understand that you can multihome the MOM agents when deploying FCS. We have servers that are already running MOM. I am now testing deploying Forefront to these servers. The deployment is done by WSUS.
The deployment works fine. However in the Operator console of my Forefront server I get the following to events:

1. The incoming agent queue is full
2. The ougoing agent queue is full

And then it shows the managment group name of the actual MOM server on the network in the details instead of the default ForefrontClientSecurity group that I chose.

This also results in my deployment reports showing that these servers have no policies which cant actaully be right cause they needed a forefront policy to install forefront in the first place.

Any Ideas?

Forefront Licence for running within Windows XP Mode on Windows 7?

Sat, 24 Oct 2009 13:32:50 Z

I've read it's good practice to secure a virtual PC as thorough as a normal PC.
So it seems obvious to install a forefront client on a virtual PC running in Windows XP mode on Windows 7.
Do I need 1 or 2 licences per workstation? Or is it just overkill to install this client on the virtual PC?

Thanks for your replies.

Errors in MOM console every now and then

Thu, 29 Oct 2009 15:00:55 Z

Im getting these errors every now and then on the MOM console for ForeFront clients. Does anyone know where i start on figuring this one out?

1. The response processor failed to execute a response. The response returned the error message: Not enough storage is available to complete this operation.

2. The response processor failed to execute a response. The response returned the error message: Interface not registered

Thanks for the help.

Forefront client security does not update its definitions

Wed, 04 Nov 2009 16:17:09 Z

Hi, I have forefront client security on my workstations, working with mom and updating via WSUS. The issue is that some client computers stopped receiving updates since 9/23/09 and other since 10/13/09. I checked some resources and they said to verifiy that a registry key is properly configured. The key tells Forefront to go look for updates or not. It was fine so I tried next step: To check if WSUS was working. I ran gpresult and the update policy was properly configured and checked the policy using GPMC and everything worked well. The next step was to check if the computers were not receiving other updates, but for my surprise, they do were, I visited Microsoft update and the only updates availables for were the ones for forefront. It's weird because I have 105 clients and only 28 were having troubles, and all in the same or similar dates. I had the same issue about 6 motnhs ago but I just manually uptaded them and well... didn't wanna make a report about that, but now's the second time that happens so I was wondering if you can help me

Best regards

sharepoint novice

what does this mean?

Sun, 01 Nov 2009 23:21:43 Z

The UMDF Host Process ({0a6530e8-5677-4e27-90ca-c0191be70915}) has loaded module C:\Windows\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.0.6002.18005_none_9e50b396ca17ae07\gdiplus.dll while loading drivers for device WPDBUSENUMROOT\UMB\2&37C186B&1&STORAGE#VOLUME#1&19F7E59C&0&_??_USBSTOR#DISK&VEN_NOVATEL&PROD_MMC_STORAGE&REV_2.31#7&33658255&0&091076321001000&0#.

FCS 2008R2 support

Thu, 29 Oct 2009 23:29:18 Z

I was interested in Forefront but wanted to know if Microsoft is going to release FCS with support of 2008R2?

Definition download address?

Thu, 29 Oct 2009 15:50:15 Z

Hi, I was wondering what address the client points to when downloading definitions/updates? I have a few kiosk computers with the client installed but we have blocked all websites on the machines so the client isn't updating definitions. Thank you!

SQL Cluster

Wed, 28 Oct 2009 18:58:56 Z

Hello everyone, thanks in advance for any help. I just wanted to make sure I was reading the FCS 2007 documentation correctly. Am I correct in reading that FCS 2007 does not support the backend databse to be a sql 2005 cluster and it also does not support 2005 msde? Basically it only supports a single server install of sql.

Also I posted this in the next gen forefront client security forum but that forum appears to be pretty dead. If this is actually the case, does anyone know if 2010 will support a clustered sql environment?

Thanks again
Mike

Why is MsMpEng.exe using so much CPU?

Wed, 06 May 2009 11:52:20 Z

It's always running high on CPU when any process is using CPU.
It really lags my Windows XP systems.

Are there any ways of optimizing MsMpEng, which I understand is Microsoft Malware Protection.
I run version 1.5.1958 on ForeFront Client Security on updated Windows XP Pro systems (all updates)

Forefront Client Security all on 1 server.

Thu, 29 Oct 2009 19:38:25 Z

In forefront Cliensecurity console when i go to scan now, quick scan it comes back with the following error.

Could not start the scan for all managed computers, retreiving the COM class factory for remote component with CLSID {8FB7B313-C81A-11D2-8D40-0090270D2552} from machine VM-Forefront failed due to the following error: 80080005.

I haved looked up resources and have tried eveything.

No Forefront Policies can be deployed

Wed, 28 Oct 2009 22:50:14 Z

I made a change to a Forefront policy today, right clicked and pressed deploy, and get this message:
The policy cannot be deployed

Further details:
Exception has been thrown by the target of an invocation.
Exception has been thrown by the target of an invocation.
Exception has been thrown by the target of an invocation.
Error HRESULT E_FAIL has been returned from a call to a COM component

I cannot make a change and deploy any policies or create any new ones and deploy those either.
Forefront is at SP1, SQL is 2005 SP3 with latest updates.

I rebooted and got this message when I try to deploy:
The policy cannot be deployed

Further details:
Unable to open existing group policy object
The specified domain either does not exist or could not be contacted. (Exception from HRESULT: 0x8007054B

I can reach any of our domain controllers from the forefront server with dsa.msc
I can ping them
I verified our PDC emulator health
I checked that the netlogon service running from both the dc and the forefront server.
There are no error messages concerning this in the event logs

Is this a bug?