Monday, October 10, 2011

Definition Update Automation with Configuration Manager

With System Center Configuration Manager (ConfigMgr) it's possible to install and use Forefront Endpoint Protection (FEP) 2010 also. Both products can be integrated so ConfigMgr will also handle Forefront Antivirus and Definition updates. Microsoft released some Forefront Endpoint Protection (FEP) 2010 Update Rollup 1 Tools also. These free downloads make it easier for Forefront Endpoint Protection 2010 Update Rollup 1 customers to use Group Policy for centralized management, provide optimized settings for various server roles, and diagnose and troubleshoot support issues. It can be downloaded here: http://www.microsoft.com/download/en/details.aspx?id=26613

The one I'm using is "Definition Update Automation Tool for Forefront Endpoint Protection 2010". This tool enables you to automate downloading and publication of FEP definition updates using the Configuration Manager 2007 Software Update feature. This is a command line tool that uses the Configuration Manager API to download new definitions from Microsoft Update, distribute them to the software update point, and publish the definitions to the endpoints. To automate the tool, you must add a Windows task to run it automatically at a scheduled interval. More information about "Definition Update Automation with Configuration Manager" can be found here: http://technet.microsoft.com/en-us/library/hh297450.aspx

Point is, it isn't working in my environment. It's true that new definitions are downloaded automatically in Deployment Packages. But distribute them and publish the definitions isn't working yet. This because Distribution Points are not updated after running the tool and new definitions are not added to Deployment Management. The command I'm using is: SoftwareUpdateAutomation.exe
  • /AssignmentName <AssignmentName>
  • /PackageName <PackageName>
  • /RefreshDP
  • /UpdateFilter "ArticleID=2461484 AND IsSuperseded=0 AND IsEnabled=1 AND IsExpired=0"
Anyone else has the same behaviour seen? I will post the results when it's working properly in my environment. To be continued till then..
at

4 comments:

  1. Jochen MeiselNovember 10, 2011 at 9:27 AM

    Hello Henk,
    we just stumbled across the same problem / error.
    First thing is that the parameter /refreshdp seems not to be existing any more. Maybe it never existed ;-)
    There only is the parameter /DisableRefreshDP - I bet that /refreshdp is the default behaviour.

    The second bug that we ran into: if you copied the code from the microsoft site, there are wrong quotes. Just replace them in notepad or something like that.
    After that everything should be fine.

    Just in case: if you keep everything in the defaults, means if you name both package name and assignment "FepDefinitionUpdates" then you don't need any parameters.

    Just give it a try ;-)

    ReplyDelete
  2. Henk HoogendoornNovember 28, 2011 at 9:32 AM

    Hello Jochen,
    Thanks for the explanation!
    I have solved the above issue and described it in another blogpost: http://henkhoogendoorn.blogspot.com/2011/10/definition-update-automation-with_12.html

    I have indeed copied the code from the website and ran into the quotes thing.

    In my opinion the /RefreshDP is needed only?
    Thanks for letting me know.

    ReplyDelete
  3. AnonymousOctober 29, 2012 at 11:22 AM

    Hi,

    Can you tell me what do I have to in the SCCM console to make it work?

    ReplyDelete
    Replies
    1. Henk HoogendoornFebruary 14, 2013 at 2:03 PM

      For SCCM 2007 SoftwareUpdateAutomation.exe (in a scheduled task) is needed. For SCCM 2012 Automatic Deployment Rules can be used, which is lot easier!

      Delete