locked
Forefront Error Code: 0x8007139f RRS feed

  • Question

  • Hello,

    We just completed our first installation of Forefront security clients with the management console and deployment policies. It all seems to be working well but the client has reported this error message below to us. We cant seem to find any solution or recommendations, please help.

     

    Event Type: Error
    Event Source: FCSAMRtp
    Event Category: None
    Event ID: 3002
    Date:  2/12/2008
    Time:  3:37:03 PM
    User:  N/A
    Computer: WELLS
    Description:
    Microsoft Forefront Client Security Real-Time Protection agent has encountered an error and failed.
      User: CLIENTSDOMAIN\USER_LOGIN

      Agent: On Access
      Error Code: 0x8007139f
      Error description: The group or resource is not in the correct state to perform the requested operation.

    For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.

     

    Tuesday, February 12, 2008 10:07 PM

All replies

  • on how many clients have you encountered this problem with?

    in what sitauations?

    can you run mpcmdrun -trace and upload the logs here ?

    Wednesday, February 13, 2008 1:35 AM
  • The client did not report this happening on multiple computers. The situation is, he gets mom and other alerts emailed to him. I am pretty sure he recieved this message in his email. there is no particular situation so I dont know what you mean by this....  "The error says,Microsoft Forefront Client Security Real-Time Protection agent has encountered an error and failed" So I guess that is the situation.

     

    -When I ran mpcmdrun -trace on my own computer it claimed to write a log file to a /support folder... The trace was stopped and the folder or file both did not exist... Sorry, I am very new to running these apps, I must be missing something.  

     

     

    Does anyone know what "Forefront Error Code: 0x8007139f" typically or generally mean? Some kind of clue as the the general source of the issue would be awesome...

     

     

     

     

    Wednesday, February 13, 2008 8:26 PM
  • hey mario,

     

    are the problematic machines XP machines ? if so, this might be a case of KB914882. When the Client Security agent is installed, a Windows XP hotfix (KB914882) is installed prior to the agent component. This is a required hotfix for Client
    Security to run on Windows XP SP2. However, clientsetup.exe does not restart the client system, which is required by the hotfix.

     

    if this is a case, this error can occur beacuse the machine is still pending for restart after the installation of the hotfix and this can also cause definition updates not to be downloaded to the client (until restart).

     

    hope this one will help.

     

    Wednesday, February 13, 2008 9:18 PM
  • Problem is not on a client machine. Problem in on servers when I log into the server. So far it happens when I authenticate as myself or as Administrator.

     

    Server is in all occations Windows Server 2003. They have been rebooted a few times already and problem remains. Problem occurs whether or not the login is done on the console or remotely.

     

    The events do come via e-mail but they originate in the specific server's Event Log.

    Thursday, February 14, 2008 2:10 AM
  •  

    I suggest you open a case on your premium support if you have...

    After reviewing the case and checking my sources, the only thing I can think of is trying to run MpCmdRun.exe -trace on the machine while trying to login through terminal services to the servers. this should cause the problematic bahavior and write detailed logs that can help solve this problem.

    The data will be stored in the support directory as a file having the current timestamp in its name and bearing
    the extension BIN.

    if you can upload it somewhere on the net, I can try and help anaylize it.

    Sunday, February 17, 2008 8:58 PM
  • I am not sure I fully understand when you refer to the "machine". I assume you mean the client. For example, I ran MpCmdRun.exe -trace on my laptop (the client) and I connected using the normal Remote Desktop. After that, I logged off, stop the tracing, and I now have a BIN file. However, if this equivalent to what you were suggesting? Was I supposed to run the tool in the server? Please let me know, as I can upload the BIN file to one of our servers and allow you to download it. For that, I would ask you to contact me via e-mail, if that is okay with you. Thank you for your help.

     

    • Proposed as answer by Gorazd Taciga Monday, July 27, 2009 8:07 AM
    Monday, February 25, 2008 4:04 AM
  • Leo, you appear to be describing an issue that is different from what Mario (The thread originator) is describing, which is a client issue.
    Please start a new thread with your issue and describe it fully.

    -Eddie
    Wednesday, July 29, 2009 4:43 PM