EndpointProtectionAgent.log Error

Question

Hello,

In the EndpointProtectionAgent.log I have a repetitive error:

Defender detected 2/19/2023 10:09:00 PM 11160 (0x2B98)

Create Process Command line: "C:\Program Files\Windows Defender\ConfigSecurityPolicy.exe" "C:\Windows\CCM\EPAMPolicy.xml". 2/19/2023 10:09:00 PM 11160 (0x2B98)

Failed to create process C:\Program Files\Windows Defender\ConfigSecurityPolicy.exe with error = 0x80070002. 2/19/2023 10:09:00 PM 11160 (0x2B98)

Failed to apply policy with error 0x80070002, retry number : 1 after 60 second. 2/19/2023 10:09:00 PM 11160 (0x2B98)

---

Where to look for details and resolution?

Thanks,

Dom

Answer 1

Hi @Duchemin, Dominique,

Thanks for your feedback. We're glad that the question is fixed now. It's appreciated that you could click "Accept Answer" to the helpful reply, this will help other users to search for useful information more quickly. Here's a short summary for the problem.

Problem/Symptom:
Endpoint Protection does not work on a few servers after installed and get repetitive error.

Solution/Workaround:

Uninstall and reinstalling Endpoint Protection and it worked. 

Thanks again for your time! Have a nice day!

Best regards,
Cherry

Answer 2

Hello,

1. Yes Endpoint is working as just a few servers are failing 10-15 from 1500+
2. No it never worked on this server After uninstalling everything and reinstalling it worked this time..

Thanks,

Dom

Answer 3

Hi @Duchemin, Dominique, 

1, Please help confirm that if you have enabled the Endpoint Protection use Custom Device Settings.

For more details, please refer to this link:

Install Endpoint Protection Role In SCCM - An Easy Guide (prajwaldesai.com)

Note: Microsoft provides third-party contact information to help you understand the problem. This contact information may change without notice. Microsoft does not guarantee the accuracy of this third-party contact information.

2, Did Endpoint Protection work fine before that? If above operations you have already performed, please upload the full EndpointProtectionAgent.log for our reference.

Looking forward to your reply.

Best regards,
Cherry

Answer 4

Hello,

I was able to run the command manually:

C:\Users\xxxxxx>"C:\Program Files\Windows Defender\ConfigSecurityPolicy.exe" "C:\Windows\CCM\EPAMPolicy.xml"

Microsoft Security Client successfully applied policy: "Default Client Antimalware Policy

ISS - Servers - SCEP - YYYY".

Any clue why it is not reporting to the Console? the installation of System Center Endpoint Protection & Windows Feature were done on 11/28/2022.

Thanks,

Dom