using System Center 2012 Configuration Manager - Part 6. Adding the Endpoint Protection role, configure Alerts and custom Antimalware Policies.

[hollisorama]

There are settings in the ADR (any deployment really) that allow you to specify things like going to Microsoft Update or sharing content with clients in the same subnet

[SCCM_Is_A_Beast]

Hi and firstly thankyou for your great guides they are very much appreciated.

 

I have installed config manager 2012 r2 as a primary site and successfully install the client and endpoint protectiion to client machines. I have created the sup and update endpoint def files ok. I have created the adr for deploying def updates as per your guides.

 

The issue i am having is with Endpoint clients receiving updates from configuration manager. Updating from Windows updates works fine.

 

Here is the info from mpcmdrun.log

 

MpCmdRun: Command Line: "c:\Program Files\Microsoft Security Client\MpCmdRun.exe" SignaturesUpdateService -ManagedUpdate

Start Time: ‎Fri ‎Nov ‎08 ‎2013 14:35:34

Start: Signatures Update Service

Update Started

Update failed with hr: 0x80070490

Update completed with hr: 0x80070490

End: Signatures Update Service

MpCmdRun: End Time: ‎Fri ‎Nov ‎08 ‎2013 14:35:35

Any help greatly appreciated

Thanks

[supports2l]

Using SCCM 2012 R2, the After running the ADR once, retire it by right clicking on the rule and select Disable (or delete) and create a new ADR except this time point the deployment package to the package which is now created called Endpoint Protection Definition Updates. part isn't necessary anymore as MS added a "Deployment Package" tab to the ADR properties window!

[anyweb]

Using SCCM 2012 R2, the After running the ADR once, retire it by right clicking on the rule and select Disable (or delete) and create a new ADR except this time point the deployment package to the package which is now created called Endpoint Protection Definition Updates. part isn't necessary anymore as MS added a "Deployment Package" tab to the ADR properties window!

 

 

when the guide was written (RTM) there was no such option. But I will amend it for everyones benefit.

[kopusx]

Endpoint is triggered by CCMTask Execute

I am getting an error that says WMI not ready on the EndpointprotectionAgent.log, where else can I look to get more details on this error?

[sanja]

del

[broonster]

Can you clarify the relationship between an ADR and a custom malware policy, specifically the "defintion Updates" section of the custom policy. For example if the the ADR only runs once a day and a PC is not turned on during that time when does it download the latest signatures? Is it when it is turned on and the SMS service starts up or is it based on the "Check for Endpoint Protection Defintions" settings in the custom policy?

[Peter van der Woude]

The ADR has nothing to do with when the client scans for available updates. Those are two separate things. When the client scans, depends on the (custom) policy settings.

[broonster]

The ADR has nothing to do with when the client scans for available updates. Those are two separate things. When the client scans, depends on the (custom) policy settings.

 

So if you deploy signatures via an ADR and the PC isn't on at that time does it use the configured schedule for the "Software Updates Deployment Evaluation Cycle" action to go looking for updates or does it use the Custom Malware policy settings? Or does it use both?

[broonster]

*Bump*