using System Center 2012 Configuration Manager - Part 6. Adding the Endpoint Protection role, configure Alerts and custom Antimalware Policies.

[Dan Mahler]

My installation/migration from SCCM 2007 to 2012 is progressing well thanks to your guides. Thanks again!

 

I had the MOM based Forefront server running for several years and have accumulated a small group of policies with exclusions in each.

 

Can these policies be migrated from Forefront in any way or do they have to be recreated.

 

I have found no details regarding this topic by searching the WEB.

 

Thanks!

 

DWM

[BIGpete]

Since SCCM 2012 SP1 came out the "Client Settings" have changed with the endpoint protection options. The default option seams to be that it won't install the System Center Endpoint Protection unless it is during maintenance hours. It can easily be adjusted:

 

 

Just a heads up for anyone that has issues with SCEP not installing after the client installs.

[anyweb]

good point, i'll update the documentation to reflect this,

as a side note did you have any maintenance windows configured ?

[BIGpete]

good point, i'll update the documentation to reflect this,

as a side note did you have any maintenance windows configured ?

 

We did have maintenance windows configured for the client machines and eventually it should have installed but it stumped me for a little while until I looked into it further.

[at3davis]

I am new to this Forum so please forgive me if I'm in the wrong place, but I think I have an issue with either endpoint setup on the SCCM server or SUP. I have followed the guides up through Part 5. Enable the Endpoint Protection Role and configure settings. The Software Update Point seems to be working. I can perform a "Synchronize Software Updates" from the Software Library successfully. I can see the updates listed under All Software Updates, but when it comes to distributing the Endpoint Package/definition updates I don't have the "Sources\WSUS...\EndpointProtection" folder. I setup the "sources" share as the instructions say, and I setup WSUS to use "sources", but where is the endpoint protection client? I feel like I've missed a core step somewhere.

 

Thanks in advance!

[anyweb]

below is a quote from the guide you linked to (it was written for the release candidate version of CM12), did you do the below or not ?

 

For Deployment Package we are creating a new one so give it a suitable name like Endpoint Protection Definition Updates and point it to a previously created folder

Note: Make sure that \\sccm\sources\updates\Endpoint (or whatever path you choose) exists otherwise the wizard will fail below when it tries to Download as the Network Path won't exist. In addition Everytime this ADR runs it will want to create a new deployment package as specified above, we do not want this to happen so after running the ADR once, retire it and create a new ADR except this time point the deployment package to the packaged which is now created called Endpoint Protection Definition Updates.

[at3davis]

Yes and no... I read it. I understood it to mean that it should already exist. I've been searching for a reason why mine doesn't exist. I thought it should have been created with a software sync since that step was just before it. Are you saying that I should create this folder so the script will store it there?

[anyweb]

Are you saying that I should create this folder so the script will store it there?

 

yup, as per

 

point it to a previously created folder

 

and

 

Note: Make sure that \\sccm\sources\updates\Endpoint (or whatever path you choose) exists otherwise the wizard will fail below when it tries to Download as the Network Path won't exist.

[at3davis]

You da man! Thanks for clearing that up. I just ran back through it, and created it as you said to.

 

One more question, the collections that we created for desktops, laptops, servers, etc. I created them. The instructions say create them with empty memberships, and then populate them how we want to, either direct or query.

 

After searching around a bit, I have tried using the following query to populate the desktop and laptop collection. I get nothing though. Any ideas what I may be doing wrong? Does the config manager client need to be installed in order to populate these fields in the DB?

 

select SMS_R_SYSTEM.ResourceID,SMS_R_SYSTEM.ResourceType,SMS_R_SYSTEM.Name,SMS_R_SYSTEM.SMSUniqueIdentifier,SMS_R_SYSTEM.ResourceDomainORWorkgroup,SMS_R_SYSTEM.Client from SMS_R_System inner join SMS_G_System_SYSTEM_ENCLOSURE on SMS_G_System_SYSTEM_ENCLOSURE.ResourceID = SMS_R_System.ResourceId where SMS_G_System_SYSTEM_ENCLOSURE.ChassisTypes in ("3","4","5","6","7","15","16")

 

Scott

[anyweb]

i've tested that query on a test collection here limited to All Systems and it works fine, did you choose Update Membership on the collection you created and then refreshed your view ?

 

cheers

niall