Yesterday I posted a blog because the "Definition Update Automation Tool for Forefront Endpoint Protection 2010" wasn't working in my environment. Have a look at Definition Update Automation with Configuration Manager for that one. Today I succeeded to automatically receive new definitions and publish them. In this blog I will post my results and a few good tips and tricks also.
I configured a scheduled task with the following settings:
Run the task with the SYSTEM account and with highest privileges. Configure it for Windows 7 (when needed).
Run the task every hour a day so updates will be downloaded and publish almost immediately when released.
Start a program with the default settings described in "Definition Update Automation with Configuration Manager" http://technet.microsoft.com/en-us/library/hh297450.aspx
The task will run fine after that. Just make sure the tool is placed in the right folder and user account choosen has enough rights.
Existing Forefront clients will be automatically updated to the new definition version. This when deploying a new Forefront client also.
It's possible to consult reports for actual information. There are a few reports beneath the Forefront pane and more eventually beneath reporting services.
My personal favorite is report 389 "FEP information for a specific computer". That way it's possible to see Forefront install, policy and update information in one overview.
When adding the Forefront client in a task sequence this tick must be cleared. Otherwise it's not possible to select the program in a task sequence.
After that, the program is selectable but will not install during a task sequence. This because the script cannot be used during a task sequence install.
Just create a new package and program for that with the following settings: "FEPinstall.exe /q /s /policy <path>\<policy-export>.xml". Be sure that the Network access account AND client computers has access to the source folder. That way Forefront client install by task sequence is possible with the exported policy added.
A few sites with good information on Forefront deployment and troubleshooting issues:
Errors When Using the FEP 2010 Definition Update Automation Tool
http://blogs.technet.com/b/clientsecurity/archive/2011/07/18/errors-when-using-the-fep-2010-definition-update-automation-tool.aspx
Installing the Forefront Endpoint Protection 2010 client and OSD
http://ccmexec.com/2011/02/installing-the-forefront-endpoint-protection-2010-client-and-osd/
Invalid argument format (index 7) "AND", arguments are supposed to start with a / (SoftwareUpdateAutomation.exe)
http://social.technet.microsoft.com/Forums/en-US/FCSNext/thread/ca500b36-c667-4030-85f9-ebd0defbdaf7/
Definition update automation tool
http://social.technet.microsoft.com/Forums/en-US/FCSNext/thread/9105024f-3a61-4fe0-bc88-803b502881a8/
With System Center Configuration Manager (ConfigMgr) it's possible to install and use Forefront Endpoint Protection (FEP) 2010 also. Both products can be integrated so ConfigMgr will also handle Forefront Antivirus and Definition updates. Microsoft released some Forefront Endpoint Protection (FEP) 2010 Update Rollup 1 Tools also. These free downloads make it easier for Forefront Endpoint Protection 2010 Update Rollup 1 customers to use Group Policy for centralized management, provide optimized settings for various server roles, and diagnose and troubleshoot support issues. It can be downloaded here: http://www.microsoft.com/download/en/details.aspx?id=26613
The one I'm using is "Definition Update Automation Tool for Forefront Endpoint Protection 2010". This tool enables you to automate downloading and publication of FEP definition updates using the Configuration Manager 2007 Software Update feature. This is a command line tool that uses the Configuration Manager API to download new definitions from Microsoft Update, distribute them to the software update point, and publish the definitions to the endpoints. To automate the tool, you must add a Windows task to run it automatically at a scheduled interval. More information about "Definition Update Automation with Configuration Manager" can be found here: http://technet.microsoft.com/en-us/library/hh297450.aspx
Point is, it isn't working in my environment. It's true that new definitions are downloaded automatically in Deployment Packages. But distribute them and publish the definitions isn't working yet. This because Distribution Points are not updated after running the tool and new definitions are not added to Deployment Management. The command I'm using is: SoftwareUpdateAutomation.exe
- /AssignmentName <AssignmentName>
- /PackageName <PackageName>
- /RefreshDP
- /UpdateFilter "ArticleID=2461484 AND IsSuperseded=0 AND IsEnabled=1 AND IsExpired=0"
Anyone else has the same behaviour seen? I will post the results when it's working properly in my environment. To be continued till then..
With System Center Configuration Manager (ConfigMgr) it's possible to install and use Forefront Endpoint Protection (FEP) 2010 also. Both products can be integrated so ConfigMgr will also handle Forefront Antivirus and Definition updates. In this blog I will describe the installation of Forefront and configuring policies.
Before FEP 2010 can be installed some prerequisites are needed on the ConfigMgr server. These are:
When installing choose the following options:
- Select "FEP 2010 Update Rollup 1"
- Welcome to FEP 2010 Server Setup Wizard: Fill in name and organization
- MS Software License Terms: "I accept the software license terms"
Based on type of installation there's the choice between Basic topology (with remote reporting database), Advanced topology & ConfigMgr console extension.
- Installation Options: Advanced topology (Select All)
- FEP 2010 Server Database Configuration: FEPDB_<sitecode>
- Reporting Configuration: MS FEP 2010 Reporting Database settings: FEPDW_<sitecode>
- Reporting Configuration: SQL Reporting Services execution account (domain user account)
- Updates and Customer Experience Options (enable/disable)
- Microsoft SpyNet Policy Configuration (enable/disable)
- Specifify Installation Location
- Prerequisites Verification: All verifications passed
- Setup Summary and Complete
After that an Forefront Endpoint Protection pane is visible in the ConfigMgr console.
The following functionality is added in the ConfigMgr console now:
- Collections > FEP Collections
- Definition Status
- Deployment Status
- Operations
- Policy Distribution Status
- Protection Status
- Security Status
- Software Distribution > Packages
- FEP – Deployment
- FEP – Operations
- FEP – Policies
- Software Distribution > Advertisements
- FEP Operations
- FEP Policies
- Software Updates > Update Repository
- Definition Updates > Microsoft > FEP 2010
- Reporting > Reports/Reporting Services
- FEP: FEP information for a specific computer
- FEP – Deployment: Computers with a specific deployment state
- FEP – Deployment: Deployment for a specific collection
- FEP – Deployment: Deployment Overview
- FEP – Policy: Policy Distribution for a specific collection
- FEP – Policy: Computers with a specific policy distribution state
- FEP – Policy: Policy Distribution Overview
- Desired Configuration Management
- Configuration Baselines
- Configuration Items
- Forefront Endpoint Protection node
- Policies > Default Server Policy
- Policies > Default Desktop Policy
- Alerts > Malware Detection Alerts
- Alerts > Malware Outbreak Alert
- Alerts > Repeated Malware Detection Alerts
- Alerts > Multiple Malware Detection Alerts
- Reports > Antimalware Activity Report
- Reports > Antimalware Protection Summary Report
- Reports > Computer List Reports
Microsoft Forefront Endpoint Protection 2010 Update Rollup 1 includes the Definition Update Automation tool. This tool enables you to use System Center Configuration Manager 2007 software update points to distribute FEP definition updates to your client computers.
To configure your environment to use the Definition Update Automation tool, you must first download the tool (fepsuasetup.cab) and copy it to the appropriate location on your Configuration Manager site server. It can be download here: http://technet.microsoft.com/en-us/library/hh297450.aspx
There are also Microsoft Forefront Endpoint Protection (FEP) 2010 Update Rollup 1 Tools available. These free downloads make it easier for Forefront Endpoint Protection 2010 Update Rollup 1 customers to use Group Policy for centralized management, provide optimized settings for various server roles, and diagnose and troubleshoot support issues. They can be download here: http://www.microsoft.com/download/en/details.aspx?id=26613
As you can see many new functionality comes available in ConfigMgr. Now it's time to configure policies and create update packages. More about that in the next blogpost.
With System Center Configuration Manager (ConfigMgr) 2007 there is many functionality available by default. With ConfigMgr 2012 this becomes even better, even MORE functionality will be in it. With both solutions there is the possibility to extend ConfigMgr with additional functionality. In this blog I will describe the most important ones.
Microsoft Deployment Toolkit (MDT) 2010: Adding new Task Sequences, new options in Task Sequences, new Boot images and all build-in scripts in ConfigMgr. Have a look at this blogpost(s) for more information about this:
http://henkhoogendoorn.blogspot.com/2010/12/mdt-integration-in-configmgr-2007.html
http://henkhoogendoorn.blogspot.com/2011/06/microsoft-deployment-toolkit-mdt-2010.html
Application Virtualization (App-V): Adding App-V streaming functionality in ConfigMgr, so no App-V Management and/or Streaming server is needed anymore. Just publish and update App-V packages from within the ConfigMgr console! Have a look at this blogpost(s) for more information:
http://henkhoogendoorn.blogspot.com/2010/12/configmgr-2007-with-app-v-integration.html
http://henkhoogendoorn.blogspot.com/2011/06/configmgr-2012-beta-2-with-app-v.html
ForeFront Endpoint Protection (FEP) 2010: It is possible to fully manage ForeFront from within the ConfigMgr console. Just deploy the ForeFront clients and manage policies with ConfigMgr. Definition files can be downloaded with WSUS integration in ConfigMgr. More about that on TechNet: http://technet.microsoft.com/en-us/library/cc161958.aspx
User State Migration Tool (USMT) 4.0: With USMT it is possible to store files and/or settings during OS deployment migrations. With hard-link migration it is possible to migrate user accounts, files and settings in less time using megabytes of disk space instead of gigabytes. More about that can be found here: http://technet.microsoft.com/en-us/library/dd560752(WS.10).aspx
Windows Server Updates Services (WSUS): Manage Software updates in ConfigMgr instead of WSUS, with even more control during installation. That way all management can be done in one single console, and additional ConfigMgr functionality as Maintenance Windows can be used. Have a look at this blogpost for this:
http://henkhoogendoorn.blogspot.com/2011/04/patch-management-in-configmgr-2012-beta.html
System Center Updates Publisher (SCUP) 2011: When ConfigMgr and WSUS is used (both together), SCUP can be installed for non-Windows patches. That way patches from HP, Dell, Adobe and Java (for example) can be managed and deployed in WSUS integration in ConfigMgr! How to setup, is explained here: http://blogs.technet.com/b/jasonlewis/archive/2007/11/30/how-to-setup-scup-and-configmgr-2007-to-deploy-custom-updates.aspx
System Center Configuration Manager 2007 Toolkit V2: The Configuration Manager 2007 Toolkit V2 contains 11 downloadable tools to help you manage and troubleshoot Configuration Manager 2007. It can be downloaded here: http://www.microsoft.com/download/en/details.aspx?id=9257
Right Click Tools or SCCM Console Extensions: The Right Click Tools or SCCM Console Extensions installation adds additional functionaly for server and client management. It becomes very handy during management and troubleshooting. More information can be found here:
http://myitforum.com/cs2/blogs/rhouchins/archive/2008/04/09/sccm-right-click-tools.aspx
http://myitforum.com/cs2/blogs/direland/pages/sccm-console-extensions.aspx
System Center Client Center: This tool is designed for IT Professionals to troubleshoot SMS/SCCM Client related Issues. The SCCM Client Center provides a quick and easy overview of client settings, including running services and SCCM settings in a good easy to use, user interface. Download it here:
http://sourceforge.net/projects/smsclictr/
With these tools more possiblities becomes available in ConfigMgr. Hopefully you have experienced new ideas with these products, and maybe more enthousiastic now to extend ConfigMgr functionality! Stay tuned for more later.
