Forefront Server Security Management Console Forum

Forefront Protection for Exchange Server Console link Missing

Wed, 25 Nov 2009 10:59:35 Z

I have installed Forefron 2010 and the console link is missing from the Microsoft Forefront Server Protection Group in All Programs. All I see is the readme link and link to Management Shell

Filling an already defined object from XML file through XSD file

Thu, 19 Nov 2009 13:35:10 Z

Hello every body,

Iam generating an xsd file using an object(class).Based on xsd file i got an xml file with data as an input.
i need to fill the class from an XML file using XSD file.Can any body help how to achive this.

Thanks,
Swetha

Install/launch issue with Forefront Security Server Management Console

Wed, 11 Nov 2009 16:07:56 Z

I install the program fine but get an error stating that a security exception has been called when i try launching the program.

It states the site does not "allow partially trusted callers"?

Does anyone know of a fix for this?

FSSMC with different forest

Thu, 12 Nov 2009 15:30:29 Z

Hello,

I have two domains on two different forest with a one way trust relationship ( Domain B trust Domain A)

Domain A where my console is installed
Domain B where my Exchange server and Antigen 9 are installed as well
The Antigen Agent has been deployed successfully
No I try to deploy a template but it doesn't works
The error on server of domain B is

Thu Nov 12 16:22:24 2009 ERROR SybSyncGetFile("file://\\<server>\SybariRedistribution$\packages\1\template.adb", "C:\WINDOWS\Temp\SybariTemp\template.adb") reports error (0x00000005) Access is denied. Failed to access: \\<server>\SybariRedistribution$\packages\1\template.adb

On server of Domain B I'm able to open UNC to server of Domain A where console is installed

All advices are welcome :-)

Regards

Where are the data files for the Engine updates held in FSSMC???

Wed, 11 Nov 2009 17:23:52 Z

Does FSSMC hold the engine updates in the SQL instance or does it hold it on the local server?

In other words, do I need to worry about my local server drives filling up quickly over time or do I just need to make sure I have enough room on SQL?

Thanks,

Brandon

I do not want to cache specific website

Thu, 29 Oct 2009 05:53:18 Z

Hi,

I'm using ISA 2006 with 2 NIC, 1 is going to ISP and the other 1 is going to LAN (user). But I encounter 2 issues:

1st- I can not access http://maps.google.com . I got this error code:

Error Code: 500 Internal Server Error. The request was rejected by the HTTP filter. Contact your ISA Server administrator. (12217)
IP Address: 209.85.231.99
Date: 10/29/2009 4:51:59 AM [GMT]
Server: GW01
Source: web filter

I try to uncheck HTTP webfilter it works but caching does't work (cache hit ratio=0). Is there any other way?

2nd- Some website are using HTTP with authentcation are cache. How can i configure a specific website not to be cache or filter?

Please help.

Thanks

Forefront TMG schedule half-hour increment

Thu, 29 Oct 2009 12:28:09 Z

How to set half hours increments in forefront TMG Schedule?

ISA2006

Wed, 21 Oct 2009 08:45:39 Z

how to bypass as400 application via isa2006 server ?

Forefront Client Security

Mon, 19 Oct 2009 01:38:20 Z

Hi there,
It seems Microsoft Told in a blog post that FCS is supported in Win2008R2 and win7, which is not true.
I've tried to install on my server and got errors with Microsoft Operation Manager 2005, which raised a wird error.... dont no why, or what it is because the log page presents an html table with empty values.

1st error was in the assesment, telling that i need more space on disc, which i have 250gb free for that.
2nd error was what i told.... MOMServer error code is about prerequesites, but dont know which one i fail, cause theres nothing there....

So is there anyone knowing how to work around this?

Marco Enxuto, Lisbon, Amadora, Portugal

ISA 2006 Routing Problem

Wed, 14 Oct 2009 08:12:55 Z

Have ancountered a problem with routing traffic from ISA 2006 (LocalHost) to Publish Server. Example: Exchange 2007 forwards traffic to a Public IP address, this intern is NATTED from our ISP to ISA's external NIC (Exchange is able to send External and Internal Outbound mail but unable to recieve External Inbound Mail). I can see the traffic hitting the box but am unable to forwards the traffic from the Local Host to the Published Server (Sitting behind ISA), This problem is persistant with all existing NAT translations that existed on our Linux Firewall. This problem also occurs when traffic cannot be routed from the LocalHost ISA to our Internal Web Server.

Your urgent assistance is need to resolve this problem.

FSSMC shows all cluster nodes as passive

Tue, 01 Sep 2009 07:06:04 Z

Hi all,

I have installed FSSMC to managed our 2 exchange clusters. One of the clusters seems to be having some issues with FSSMC all nodes show up as passive with the same server on each node.

This is reporting wrongly on the engine versions report and is also stopping me from running the signature updates job on each of these nodes.

Is there a possibility to schedule the retrieval of data in quarantine manager?

Tue, 06 Oct 2009 07:42:14 Z

For our montly reports I have created a SQL query that collects the quarantine data from the SybariEnterpriseManager database. Only problem I have at this moment is that I'm not able to schedule the retrieval of quarantine data from the antigen servers to the FSSMC database. This is a manual job in the console. Maybe I have overlooked something but I can't find this option in FSSMC.
Mayby there is a possibility to script something to schedule the retrieval? Anybody any ideas?

Pushing forefront out onto Windows server 2008 R2

Sat, 10 Oct 2009 17:33:48 Z

I recently tried to push forefront out onto a server running windows server 2008 R2. It would not load forefront. I was wondering what I need to do to my main server (running windows server 2003) that pushes out forefront. To enable forefront to be used on my new server. BTW I use forefront and push it out to other computers on my network running Vista….

How To Do a Script to Remove / Install MOM Agent

Thu, 24 Sep 2009 15:57:26 Z

Hi,

I have 200 workstations with a MOM Agent installation being pointed to a server who is no longer a Forefront Management Server.

What I am trying to do is:
1 - Add the firewall port exception to allow the server to communicate with the MOM agents
2 - Remove the MOM Agent
3 - Install it again with other parameters (these being X:\InstalationCD\CLIENT\CLIENTSETUP.EXE /MS (our new management server hostname) /CG (our new configuration server hostname)

I have gone as far as this in a batch script:

netsh firewall add portopening all 1270 "MOM Communication" -> Opens firewall port 1270 which is used for MOM Communication
net use q: \\192.168.10.17\E -> Map Network Drive where installation CD is located
Q:\InstalationCD\CLIENT\CLIENTSETUP.EXE /MS CERBERUS /CG CERBERUS -> Forefront Installation
net use q: /delete /y -> Delete Mapped Network Drive
pause -> pauses command prompt to check results of batch script

However, I get an access denied message unless the user logging in is a local administrator.

I see 3 possible workarounds for this:

1 - Check if the user is in the local administrators, add the user in local administrators group if it's not there and then remove it if it added the user.
2 - Do the above, but with 2 VB Scripts included (one to add the user and one to remove it after), running the batch script in between.
3 - To do everything above all in a VB Script, it would allow distribution via GPO which would be much more suitable but I'm just looking for a solution now.

Is there such a script or another possible workaround?

Error installed AEM

Thu, 01 Oct 2009 09:57:36 Z

Hi all, i try to installa AEM into a windows 2003 server with sql 2005 but at the end i receive this error message:
ERROR 1001. ERROR EXECUTING SQL SCRIPT -> MUST DECLARE THE SCALAR VARIABLE @MACHINEID.
Into SQL i set SQL 2000 COMPATIBILITY.
Can you help me?
Many thanks

ForeFront Server on a Windows 2008 64 bit server running SQL Server 2008?

Sat, 03 Oct 2009 09:59:24 Z

When trying to install on a server that already has SQL Server 2008, I get an error to the effect that SQL Server 2005 SP1 Reporting Services cannot be found.

If I also install SQL Server 2005 Express edition with reporting services on the server, will everything have a happy ending?

Any caveats?

Forefront Server Security Management Console on a backup server: "Password mismatch between the Primary and Backup Servers"

Mon, 07 Sep 2009 02:23:24 Z

Can anyone give some guidence on a issue we're having with trying to setup FSSMC with Primary and Backup Servers?

On the Backup server we get the "Password mismatch between the Primary and Backup Servers" error which is covered by the follwoing kb article: http://support.microsoft.com/kb/946342.

The problem is that the language locales match and are both English. The only thing I can think is that the server language is set to English (NZ) and the SQL instance on that server is set to English (US). These settings are the same on both Primary and Backup servers.

The one thing that stands out is the default Collation setting for the SQL instance is Latin1_General_CP1_CI_AS and the databases are set to SQL_Latin1_General_CP1_CI_AS. I've seen in a Stirling forum that this was an issue and it was recommended that the SQL instance was created with the SQL_Latin1_General_CP1_CI_AS collation set.

Anyone hit this issue?

FSSMC - How do I change the Replication Password

Tue, 22 Sep 2009 13:28:19 Z

Hi
I've setting up a Backup FSSMC server, but keep getting prompted that the passwords on the Primary and Backup server don't match.

How do I change the password on the Primary Server?

Thanks

Engine versions report

Thu, 24 Sep 2009 13:35:15 Z

Hi all,

Environment:- FSSMC on a server, Exchange 2003 in clustered environment, antigen 9.0 sp1

When we run the engin versions report out clustered servers do not report on the antigen worm engine in the engine versions report. they just show "0". the report is correct and upto date for the bridgehead servers with update from the 16th September showing.
I have re-pushed the agents out to the clusted nodes but without any luck.

Does anyone have any ideas of what may be causing this or how to resolve it?

TIA

Andy

Forefront on x64 file server?

Mon, 21 Sep 2009 09:22:48 Z

MS recommends installing an AV on all server products. Forefront has server flavours for select services (SharePoint, Exchange...). Which MS AV for file servers, Hyper-V servers, AD DS servers? Is it Forefront Client Security? Will it work on 64 bit Server OS's (I thought I just read they were not supported), if not what will?

Apply / Templates through FSSMC

Tue, 20 May 2008 19:11:28 Z

When I deployed templates to Forefront Security for SharePoint (FSSP) through FSSMC, the settings are not loaded. I need to click on "Load From Template" button on FSSP to apply them.

Do you know, how to load templates settings without click on "Load From Template" button?

Thank's

How often Microsoft publishes updates for FCS?

Fri, 11 Sep 2009 11:04:33 Z

Greetings!
Does anybody knows, how often Microsoft publishes updates for Forefront Client Security?

template updates

Wed, 09 Sep 2009 10:43:29 Z

I have setup FSSMC to manage our antigen sp1 servers and all seems to be ok.

My problem is that when I push out a filter list update the templete on each server updates automatically but it takes a little while for the actual smtp scan job to update with the changes. If I run "antigenstarter tcfl" on the server the smtp scan job updates immeadiately.

How is this update controlled automatically and can I configure the delay before each check/update

TIA

Andy

FSSMC says updates have failed, but Antigen 9 is already up to date

Tue, 28 Jul 2009 08:39:20 Z

Maybe this is by design, i don't know. Maybe i configured something incorrect. We deployed FSSMC. It downloads the updates from the antigen download site and then distributes them to the Antigen 9 installations. Updates are done succesfully. The versions on the FSSMC, Antigen and the internet are the same. But, when I check the alert logs, I get these alerts:

exchsrvr01 28-7-2009 10:16:23 Server exchsrvr01 FAILED to update engine Microsoft AV
exchsrvr01 28-7-2009 10:06:21 Server exchsrvr01 FAILED to update engine Antigen Worm List
exchsrvr01 28-7-2009 10:05:21 Server exchsrvr01 FAILED to update engine CA Vet
exchsrvr01 28-7-2009 10:03:27 Server exchsrvr01 FAILED to update engine Sophos Anti-Virus
exchsrvr01 28-7-2009 10:02:26 Server exchsrvr01 FAILED to update engine Norman Data Defense

These alerts repeat themself every hour which makes sense because updates are downloaded and distributed in FSSMC every hour.

Antigen 9.0 does not have scheduled updates. Anyone an idea why this is happening?

How IIS queries are handled for FSSMC jobs

Mon, 31 Aug 2009 17:09:14 Z

Submitted by Paul Gruner - Microsoft

Symptoms

=============================

When sending web-based reports in Microsoft Forefront Server Security Management Console (FSSMC), you might receive following error: The GenerateAndSendReport function returned an error.

Cause

=============================

When creating the first job in FSSMC, IIS is queried to check if authentication is enabled for FSSMC.

There are two possibilities:

1) If authentication is enabled, we set the default URL used for all web-based reports to https://localhost/FSSMConsole/

2) If authentication is not enabled, we set the default URL used for all web-based reports http://localhost/FSSMConsole/

Any following jobs created in FSSMC, will use this default URL. FSSMC does not query IIS anymore in order to verify if any changes to the security settings have been implemented.

Resolution

=============================

The default URL for web-based reports is stored in SQL. The value containing the default URL is called SemURL, the database is called SybariEnterpriseManager and the table is called dbo.sdSettings.

There are two established workarounds:

1) Install Microsoft SQL Server Management Studio Express (SSMSE), and edit the SemURL value directly in the dbo.sdSettings table in SQL. In order to access this table, you can download a free copy of SSMSE from following location: http://www.microsoft.com/downloads/details.aspx?familyid=C243A5AE-4BD1-4E3D-94B8-5A0F62BF7796&displaylang=en

2) After making changes to the FSSMC security settings in IIS, delete all existing jobs and recreate them. This will force FSSMC to query the security settings of IIS again, upon the creation of the first job.

Repro Steps

=============================

- Disable authentication in IIS for FSSMC

- Create the first job in FSSMC

- Enable authentication in IIS for FSSMC

- Create a second job in FSSMC and send a web-based report for this job.

More Information

=============================

This is a known issue and won't be fixed in a future release.

References

=============================

Microsoft Forefront Server Security Management Console Version: 10.5.1241.0

FSSMC signature update locations

Fri, 28 Aug 2009 12:12:22 Z

Hi all

We have just upgrade to FSSMC to allow us to manage out exchange 2003 clusters that are running antigen 9 with sp1.

I am having a problem with the scanner updates in that when they are downloaded it seems to be putting them in the wrong path. When looking in the event viewer Antigen is looking for the manifest.cab file in C:\Program Files\Microsoft Forefront Security\Server\Server Management\Services\Redistribution\Cache\x86\<enginename>\package but when I download the updates it puts them in C:\Program Files\Microsoft Forefront Security\Server\Server Management\Services\Redistribution\Cache\x86\<enginename>\<0908270004>\x86\Microsoft\Package.

How do I change this so that the automatic updates will work

TIA

Andy

SQL Express Edition on FSSMC primary server?

Tue, 18 Aug 2009 16:51:48 Z

Hi,

Just a quick question, is it possible to use SQL server 2005 Express Edition on FSSMC primary server, or we have to setup a seperate SQL server?

Thanks in advance!

Sharepoint multi-tier setup: 2 FE and 1 APP server

Tue, 25 Aug 2009 19:14:40 Z

I have two FE MOSS servers and one APP server. What is the best procedure for setting upr FSS.

Should FSS be installed on both FE's? That would make sense to me, but SP is smart enough to know this?
Does the APP server need a copy. I wouldn't think so.
Can you use two seperate installs of the FSS for each server and manage through a remote admin OR is it best to setup the FSS Management Console?

Rede wireless Acesso MAC

Sun, 16 Aug 2009 03:03:41 Z

Pessoal, tenho uma duvida, eu mando sinal via radio pra uns amigos meus, mais eles ta usando p2p e ta caindo a rede
eu sei bloquear o p2p pelo ISA server na boa, mas o problema é que eu gostaria de pode liberar a mac deles pelo servidor e não pelo AP
Por que pelo ap tem que fica reiniciando toda hora, eu gostaria de saber se o ISA tem essa função, liberar sómente as MAC cadastrada pra navegar

Problem accessing Quarantine manager

Thu, 08 May 2008 22:51:50 Z

I have been working with the FSSMC and Forefront for Sharepoint over the past few days. I have managed to get most of the things working, but I'm having trouble with the Quarantine manager. If I use the same user account that installed FSSMC, the Quarantine manager loads fine and I can do whatever I need (pull data, remove info, etc). Unfortunately, if I try to do this using my own account, it gives me a .NET error (I'll post it at the end since it is a big one). My account has domain admin access, dbo access to the SQL databases (on a seperate SQL 2005 server), and is setup as a user in FSSMC. Since it works as the account I used to install FSSMC, it has to be a rights issue somewhere. Anybody run into this before or have an idea as to how I fix this?

Server Error in '/FSSMConsole' Application.

There is no row at position 0.

Description: An unhandled exception occurred during the execution of the current web request. Please review the stack trace for more information about the error and where it originated in the code.

Exception Details: System.IndexOutOfRangeException: There is no row at position 0.

Source Error:

An unhandled exception was generated during the execution of the current web request. Information regarding the origin and location of the exception can be identified using the exception stack trace below.

Stack Trace:

[IndexOutOfRangeException: There is no row at position 0.]
   System.Runtime.Remoting.Proxies.RealProxy.HandleReturnMessage(IMessage reqMsg, IMessage retMsg) +1734594
   System.Runtime.Remoting.Proxies.RealProxy.PrivateInvoke(MessageData& msgData, Int32 type) +826
   Microsoft.FFSMC.Services.QuarantineManagement.GetQuarUserMachines(String strDomain, String strUser) +0
   Microsoft.SEM.Services.LocalQuarantineManagement.GetQuarUserMachines(String strDomain, String strUser) +79
   Microsoft.SEM.SEMConsole.AntQuarMgt.PopulateComboBox() +208
   Microsoft.SEM.SEMConsole.AntQuarMgt.Page_Load(Object sender, EventArgs e) +3679
   System.Web.UI.Control.OnLoad(EventArgs e) +99
   System.Web.UI.Control.LoadRecursive() +47
   System.Web.UI.Page.ProcessRequestMain(Boolean includeStagesBeforeAsyncPoint, Boolean includeStagesAfterAsyncPoint) +1061

Version Information: Microsoft .NET Framework Version:2.0.50727.832; ASP.NET Version:2.0.50727.832

Question on deploying FSSMC

Wed, 22 Jul 2009 19:37:57 Z

I was wondering what ports are used to allow traffic to flow between the FSSMC and remote servers. My company has a servers running in separate domains that our main domain forest. I would like to add these servers to the FSSMC and deploy the agent for reporting functions. Where they are now, the FSSMC does not recognize the servers and I cannot add them to the FSSMC

Are there specific ports that the FSSMC uses when adding servers and/or deploying the agent?

FSSMC update for Forefront for Exchange SP2

Tue, 07 Jul 2009 15:50:06 Z

Is there update for FSSMC that will have the added virus engines? If not how do we get the update definitions to the Exchagne servers with the update job?

Cannot deploy agents.. RPC server unavailable.

Fri, 24 Jul 2009 09:13:50 Z

Hi all,
i cannot deploy agents... it tells me: "RPC server unavailable" in the FSSMC....

on te client in the windows firewall logs i don't have any "DROP" so all connections are accepted.
i can see the shares from the FSSMC.
Remote Registry service is started on the client server.

What could it be?

Thanks in Advance.

Diego Castelli

EDGE Server Communication with Forefront

Thu, 23 Jul 2009 15:08:21 Z

I will install an EDGE server in my DMZ and the Exchange 2007 Org will be managed by FrontBridge for outside spam filtering and additionally Forefront for internal server and client security. What i can't find is the port(s) used by EDGE to report back to the Forefront reporting/management console etc. This must exist as it must be possible to view what the EDGE is doing via Forefront as it has an agent installed.

Any ideas?

Thanks in advance.

MOM.Datawarehousing.DTSPackageGenerator.exe fails daily on schdule task and manual ones.

Wed, 13 May 2009 18:05:19 Z

I have been receiving this error on our Forefront sever for a couple of months now. I have tried ever solution out on the web and nothing seems to help. I have run MOM.Datawarehousing.DTSPackageGenerator.exe /latency:XX many times and not really sure if this is working anymore. If someone has cracked the code on this, could you please help? I have posted my eventlog property on this error.

Thanks in advance.

Log Name:      Application
Source:        MOM.Datawarehousing.DTSPackageGenerator.exe
Date:          5/13/2009 1:49:21 PM
Event ID:      1001
Task Category: None
Level:         Error
Keywords:      Classic
User:          N/A
Computer:      FOREFRONTWH01.polk.edu
Description:
Step StepInvokeInnerPackage failed.
Step Error Source: Microsoft OLE DB Provider for SQL Server
Step Error Description: (1:SC_Inner_DTS_Package) SubStep 'DTSStep_ExecuteSQLTask_SC_EventFact_View_1_Insert' failed with the following error:
Transaction (Process ID 79) was deadlocked on lock resources with another process and has been chosen as the deadlock victim. Rerun the transaction.
Execution was canceled by user.
Step Error Code: -2147220441
Step Error Help File:
Step Error Help Context ID:0
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
<System>
    <Provider Name="MOM.Datawarehousing.DTSPackageGenerator.exe" />
    <EventID Qualifiers="0">1001</EventID>
    <Level>2</Level>
    <Task>0</Task>
    <Keywords>0x80000000000000</Keywords>
    <TimeCreated SystemTime="2009-05-13T17:49:21.000Z" />
    <EventRecordID>29605</EventRecordID>
    <Channel>Application</Channel>
    <Computer>FOREFRONTWH01.polk.edu</Computer>
    <Security />
</System>
<EventData>
    <Data>Step StepInvokeInnerPackage failed.
Step Error Source: Microsoft OLE DB Provider for SQL Server
Step Error Description: (1:SC_Inner_DTS_Package) SubStep 'DTSStep_ExecuteSQLTask_SC_EventFact_View_1_Insert' failed with the following error:
Transaction (Process ID 79) was deadlocked on lock resources with another process and has been chosen as the deadlock victim. Rerun the transaction.
Execution was canceled by user.
Step Error Code: -2147220441
Step Error Help File:
Step Error Help Context ID:0</Data>
</EventData>
</Event>

Block specific users from specific URLs in ISA 2004

Thu, 05 Mar 2009 06:17:44 Z

Using ISA 2004 (Standard, shipped with SBS 2003 R2), I'd like to block specific users from specific Web sites. I can define URL sets, and create a rule with the default action of Deny that has the URL set as the To destination, and the URLs are blocked for all users. When I add a user set to the Users tab, as the Condition for the rule, the URLs are still blocked for all users not the specified user set. The From/Listener is the predefined Internal network.

fssmc exchange product activation job expires forefront for exchange

Wed, 18 Mar 2009 13:43:39 Z

Hi,

When I Create a Product Activation Job via FSSMC and fill in the required license key and the product license information and run the job agains the Exchange Servers I receive an error message when I conect with Forefront Security Admin for Exchange that the subscription has expired.

If I look at the about info in FSA then the subscription is expired on 26 oktober 1857 (if you deploy it a later time a different date is present).

If I manually enter the information via FSA then everything works as expected.

FSSMC Exchange 2007 SP1 rollup 2
FSSA Exchange 2007 SP1 rollup 3

Anyone seen this before and has a fix for this?

Why can't I turn on Microsoft Forefront Client Security?

Sun, 22 Mar 2009 03:24:18 Z

When I go to Windows Security Center, only 3 out of 4 security essentials are turned on. Firewall, Automatic Updating, and Other security settings are always on, as well as Windows Defender under Spyware and malware protection. But my computer warns me that my virus protection, Microsoft Forefront Client Security, is turned off. When I click Turn on now, it leads me to a page that says no unwanted or harmful software detected. Is there a way to just turn it on and leave it on? If it says it's off can I get a virus?

How to set ISA 2006 policy to communicate with APC powerchute network shutdown?

Wed, 20 May 2009 20:04:54 Z

I have Windows Server 2003 Ent R2 SP2 with ISA 2006 Ent.
I will install APC 5000VA with NMC and PowerChute Network Shutdown on ISA 2006 server.

How can I set the ISA policy to communicate with APC that APC PCNS can shutdown ISA server?

ForeFront Architecture Pushing Updates

Sun, 24 May 2009 07:30:33 Z

Which is better WSUS or SMS?

Regards,

Mohammed