This typically occurs when a client update occurs.

Example with the recent update KB979536

  • KB is approved for install on WSUS.
  • FCS Client makes WUA API call to detect/download/install any FCS updates (this includes both signatures and client updates).
  • The user for this process is not the logged on user.
  • The update for the client is downloaded and installed in the context of the system account, as part of the install the service is stopped and the process associated with the tray icon is terminated (msascui.exe).  The system account does not have a good method of spawning msascui.exe back into the logged on user(s) desktop session(s) and thus you end up with no GUI icon after an upgrade.

Things to be aware of:

  • The client is still protected, the FCSAM service will still be running and if you have it configured RTP is enabled and protecting the system.
  • You can restart the user process msascui.exe by clicking on Start>All Programs>Microsoft Forefront>Forefront Client Security.
  • The next time the user logs off/on the user process will be restarted normally as well.
  • Check for MsMpEng.exe in Task Manager under the Processes tab, this will confirm FCS is still running despite the missing icon from the system tray.