Bug in SCEP 2012 Client 4.10.205

[Peter33]

Hi guys,

 

be aware of a bug in the SCEP 2012 Client 4.10.205.

A race condition during the update my result in broken SCEP Client, which will not load any signature updates or report back to Config Manager after that. 10% of our Clients and Servers are affected by this.

The Workaround is to block the 4.10. update in the ADR/Update Group and to install SCEP 4.9 (use a regular package with the SCEPinstall /forceclean Switch).

 

There will be a new 4.10. update. Unfortunately MS Support was not able to tell when.

 

btw. Reports are useless to identify affected clients. Rather use a collection view in the console and opt in 'Endpoint Protection Last Update Time'.

[anyweb]

hi Peter,

is Microsoft aware of this ?

[Peter33]

Yes, this is an open premier support case. Our Datacenter guys have been in contact with Microsoft the whole week to identify the source of the problem. I am expecting this to be fixed next week (fingers crossed).

[Kevin79]

install SCEP 4.9 (use a regular package with the SCEPinstall /forceclean Switch).

Is the command just scepinstall.exe /forceclean? From what I've found (https://technet.microsoft.com/en-us/library/gg398035.aspx) /forceclean isn't an available option.

[Peter33]

The command line is "SCEPInstall.exe /forceclean /s /q". The switch is not documented.

 

No news on the topic itself. Just implemented a fallback update by a tasksequnce installing the full updates, which i am using for OS Deployment, on clients with definition files older than 2 days. For detection i am using compliance rules checking the creation date of the definition file on the file system. I also implemented it for the Windows Defender, to be on te safe side.

$sigfile = (Get-ItemProperty -Path "HKLM:\SOFTWARE\Microsoft\Microsoft Antimalware\Signature Updates").SignatureLocation + "\mpavdlta.vdm"
$sigdate = (Get-ItemProperty -Path $sigfile).CreationTime
$now = Get-Date
$sigdiff = (NEW-TIMESPAN –Start $sigdate –End $now).Days
return($sigdiff)

$sigfile = (Get-ItemProperty -Path "HKLM:\SOFTWARE\Microsoft\Windows Defender\Signature Updates").SignatureLocation + "\mpavdlta.vdm"
$sigdate = (Get-ItemProperty -Path $sigfile).CreationTime
$now = Get-Date
$sigdiff = (NEW-TIMESPAN –Start $sigdate –End $now).Days
return($sigdiff)