In of this series we got our AD and SCCM servers ready, and then we installed System Center 2012 Configuration Manager as a standalone Primary site. In we configured the SCCM server further by adding some Windows Server roles necessary for the following Configuration Manager 2012 functionality, Software Update Point (SUP) and Operating System Deployment. In we configured the server further by Enabling some Discovery methods and creating Boundary's and Boundary Groups. In we configured Client Settings, Added roles and Distributed the Configmgr Client to our Computers within the LAB, now we will enable the Endpoint Protection Role and configure Endpoint Protection settings and we will target All Windows 7 Computers with these settings and policies. Note: In we selected Definition Updates in the Classifications screen to support Endpoint Protection as part of the SUP role setup, if you havn't completed that part then do so now before continuing.

To install the Endpoint Protection Role, launch the Configuration Manager console, click Administration. Point Of Grace A Christmas Story Raritan. In the Administration workspace, expand Site Configuration, click Servers and Site System Roles, right click the server and click Add site system roles. Check the role Endpoint Protection Point. The System Center Configuration Manager (SCCM) client policy can be used to install System Center Endpoint Protection (SCEP) in supported OSes prior to Windows 10, or to enable Windows Defender on Windows 10. The SCEP installer can also uninstall prior AV products if that activity is enabled in the.

Below is an Introduction to Endpoint Protection in Configuration Manager, for more info see the following on Technet - When you use Endpoint Protection with Configuration Manager, you benefit from the following: • You can configure antimalware policies and Windows Firewall settings to selected groups of computers, by using custom antimalware policies and client settings. • You can use Configuration Manager software updates to download the latest antimalware definition files to keep client computers up-to-date. • You can send email notifications, use in-console monitoring, and view reports to keep administrative users informed when malware is detected on client computers. Endpoint Protection installs its own client, which is in addition to the Configuration Manager client.

The Endpoint Protection client has the following capabilities: • Malware and Spyware detection and remediation. • Rootkit detection and remediation. • Critical vulnerability assessment and automatic definition and engine updates.

• Integrated Windows Firewall management. • Network vulnerability detection via Network Inspection System. Recommended Reading:- Prerequisites for Endpoint Protection in Configuration Manager - Best Practices for Endpoint Protection in Configuration Manager - Administrator Workflow for Endpoint Protection in Configuration Manager - Step 1. Configure the Endpoint Protection Role Perform the following on the SCCM server as SMSadmin Note: The Endpoint Protection point site system role must be installed before you can use Endpoint Protection or before you can set EndPoint Protection client settings. It must be installed on one site system server only and it must be installed at the top of the hierarchy on a central administration site or a standalone primary site. In the configmgr console, click on Administration, expand Overview and expand Site Configuration, select Servers and Site System Roles and click on Home in the Ribbon and click on Add Site System Roles.

When the wizard appears click next Select the Endpoint Protection Point role and click next Read and then accept the License Agreement terms Next you get some choices about Microsoft Active Protection service, you can opt in, or opt out, let's select Basic Membership. Click next at the summary and review the status on the completion screen. Within a few minutes you'll see the Endpoint Protection client appear in the System Tray of your ConfigMgr Server (this is normal behaviour and is expected, you must have the SCEP client installed on your ConfigMgr Server hosting the Endpoint Protection role).

Note: you can review the EPSetup.log on the server to monitor role installation progress. Configure alerts for Endpoint Protection Perform the following on the SCCM server as SMSadmin Note: Alerts inform the administrator when specific events have occurred, such as a malware infection. Alerts can be displayed in the Configuration Manager console, through reports, or optionally can be emailed to specified users. You can configure in System Center 2012 Configuration Manager to notify administrative users when specific security events occur in your hierarchy.

Notifications display in the Endpoint Protection dashboard in the Configuration Manager console, in reports, and you can configure them to be emailed to specified recipients. Configure Email Notification (Optional) If you have access to an SMTP server then you can optionally configure Email Notification Alerts. In the configmgr console, click on Administration, expand Overview and expand Site Configuration, select Sites and click on Settings in the ribbon and click on Configure Site Components and select Email Notification. Enter your desired settings for SMTP and click Apply.

Note that you can test your SMTP settings also. Configure Alerts for Collections Next let's configure Alerts for a Collection, but first let's create a collection called All Windows 7 Computers (in a LAB this is fine for what we want to do, in Production you should create EndPoint Protection specific Collections). Note:- You cannot configure alerts for User Collections.Click on Assets and Complicance in the console,click on Device Collections and in the ribbon click on Create Device Collection. Call the collection All Windows 7 Computers and limit it to All Systems click next, choose Query Rule from the drop down menu and fill in a Query like so (edit query statement, criteria, show query language and replace the code with the below) select * from SMS_R_System where SMS_R_System.OperatingSystemNameandVersion like '%Workstation 6.1%' set the schedule as follows (it's a LAB) click next through the wizard, the collection is now created. In Assets and Compliance select Devices and choose Device Collections, select the All Windows 7 Computers collection (we have no computers in this collection yet but we will have soon), choose properties Click on the Alerts tab and place a checkmark in View this collection in the Endpoint Protection Dashboard click on Add and select all the options click ok and leave the other Alert settings as they are Step 3. Configure the SUP Products to Sync and Perform a Sync Perform the following on the SCCM server as SMSadmin Click on Administration, expand Overview and expand Site Configuration, select Sites and click on Settings in the ribbon and click on Configure Site Components and select Software Update Point. In the Products tab ensure that the product Forefront Endpoint Protection 2010 check box is selected.

Change the Sync Schedule to 1 days Click on Software Library, Software Updates, right click on All Software Updates and choose Synchronize Software Updates answer Yes to the Sync at this point you can review the Wsyncmgr.log in CMtrace Step 4. Manage Endpoint Protection client on client computers • Select True if you want to manage existing Endpoint Protection clients on computers in your hierarchy. • Select this option if you have already installed the Endpoint Protection client and want to manage it with Configuration Manager. • You should also select this option if you want to create a script to uninstall an existing antimalware solution, install the Endpoint Protection client and deploy this script using a Configuration Manager application or package and program. Install Endpoint Protection client on client computers • Select True to install and enable the Endpoint Protection client on client computers where it is not already installed. Automatically remove previously installed antimalware software before Endpoint Protection is installed • Select True to uninstall existing antimalware software. Note Endpoint Protection uninstalls the following antimalware software only: All current Microsoft antimalware products except for Windows InTune and Microsoft Security Essentials Symantec AntiVirus Corporate Edition version 10 Symantec Endpoint Protection version 11 Symantec Endpoint Protection Small Business Edition version 12 Mcafee VirusScan Enterprise version 8 Trend Micro OfficeScan Suppress any required computer restart after the Endpoint Protection client installed • Select True to suppress a computer restart if it is required after the Endpoint Protection client installs.

Allowed period of time users can postpone a required restart to complete the Endpoint Protection installation (hours) • Specify the number of hours that users can postpone a computer restart if this is required after the Endpoint Protection client installs. Disable alternate sources (such as Windows Update, Microsoft Windows Server Update Services or UNC shares) for the initial definition update on client computers • Select True if you want to allow only Configuration Manager to install the initial definition update on client computers. This setting can be helpful to avoid unnecessary network connections and reduce network bandwidth during the initial installation of the definition update. In the Configuration Manager console, click Administration, click Client Settings and on the Home tab in the Create group, click Create Custom Client Device Settings.

Hi together, i got problems with the automatic deployment rule. I get the error code 0X87D20417 with the following information: automatic deployment rule download failed. When i start the download of a forefront update manualy i works great and places the update in the selected folder.

Can anyone give my a little bit help. In the ruleengine.log i got the following error: Failed to download the update from internet. Error = 5 and in the next line Failed to download contentID 16791605 for UpdateID 16792808. Error code = 5. Hi together, i got problems with the automatic deployment rule.

I get the error code 0X87D20417 with the following information: automatic deployment rule download failed. When i start the download of a forefront update manualy i works great and places the update in the selected folder. Can anyone give my a little bit help. In the ruleengine.log i got the following error: Failed to download the update from internet. Error = 5 and in the next line Failed to download contentID 16791605 for UpdateID 16792808.

Error code = 5. Brgds, Jan I've got the same problem but in my situation even manual initiated download gives me 'Access Denied' so if you have any solution for this please let me know. I dont see how this product is anywhere near ready for production - how do we roll this out when the product is gold? It looks like its an all-or-nothing piece. I'd love to be able to test it on 10% of our machines to make sure it can uninstall current products with success and then kick it out - how would one do this? What do you mean all or nothing?

If you don't want the SCEP agent installed then configure the Default client agent settings and your heirarchy will get no SCEP agent, if you want 10% of your computers to get it then configure custom client settings for that collection and they'll get the SCEP agent, you can then configure custom antimalware policies for those 10%. I've only gotten automated definition updates working by selecting WSUS as a source and specifying that source in Group Policy; leaving only 'Configuration Manager' enabled consistently gives me quick 'you're out of date' responses when I click the Update button. I do have the automatic deployment rule set up and it did download updates to the share I specified -- following the example in Step 4 to the letter except calling the folder 'Forefront' instead of 'Endpoint.' Am I missing a permission or some other setting here? The logs on the FEP client don't tell me anything. The FEP client had Windows Update and the MS Malware Center as sources (HKLM Software Policies Microsoft Microsoft Antimalware Signature Updates FallbackOrder).

This changed to 'InternalDefinitionUpdateServer' when I turned on both Config Manager and WSUS as sources. What's the point of having System Center download and approve the updates when WSUS can auto-approve the definition updates as well, and auto-update from System Center seems to do nothing? Well it's working fine for me in my lab so I'm guessing you have misconfigured something, or forgotten to do an important step, can you disable your wsus group policy and double check all the steps in this part, it should work.

Thanks for responding, but I had tried disabling my WSUS-related group policy objects for the container where my test PCs are and I get the same result. I did gupdate /force and checked the Policy reg key to make sure the changes took effect. I'll keep checking.

Are there any logs that I've missed that are related to this? Matrix Screensaver Trace Program San Diego. The System event log tells me about setting changes, and it reports update sources that fail (like Windows Update and MSMC) when they're enabled.

This is the third time, actually, that I've gotten through to this step. Twice I've gotten this result; the third time I messed up something on SQL and broke it completely but I know what happened there. Speaking of SQL, I have a different problem but I'll raise that in Part 1.

When you run a RSOP on that machine, does it still say something about the update location? Also what update location is show in the windowsupdate.log? Resultant set of policy? Isn't this tool included in Group Policy Management (Group Policy Results)? I usually use GPO modelling because the Group Policy Results wizard usually fails due to my client firewall settings.

But fair enough; thanks for the reminders of where to look. I'll update this post once I've rebuilt my System Center (4th time) and tried again.

In the container I put my client PCs in, I blocked inheritence and added only minimal GPOs (like default domain policy) to ensure I wasn't inheriting my production WSUS settings. The modelling didn't turn up any WSUS settings. WU would (and did) fail at that point because the client PCs and users in my test don't have internet access. Is the System Center client supposed to replace (or enhance) the WSUS client then?

More to come after I finish this rebuild, so no need to reply until I do. When you run a RSOP on that machine, does it still say something about the update location? Also what update location is show in the windowsupdate.log?

I'll delete the last post and replace it with this one. RSoP shows me a WSUS source of my System Center server, and no other Windows Update settings. When I compare this with the GPO Modelling output, the WSUS source is the only setting difference, and if I recall properly, this doesn't take any effect unless 'Configure Automatic Updates' is also enabled.

So it seems the SC client is changing the WU source server but not enabling it. I've attached an attempt at checking for definition updates from windowsupdate.log. It does not reference my System Center server at all, except at the very beginning when it refers to policy changes.

I did set 'Configure Automatic Updates' by hand in this instance, to see what would happen. It appears WU (and the Forefront client by extension) is ignoring the WU setting and trying to go straight to Microsoft for its updates. I suppose I could approve these updates through WSUS instead of System Center, set up an auto-approve schedule in WSUS, and use System Center to manage the clients only. That runs contrary to how this instruction set is supposed to work though. (Update) The log shows it can't get a certain.cab file from Microsoft. This WU / SC client does not (nor should it) have internet access.

I thought this was what WU self-update was for.