SCEP GUI Missing

TomaszW-0873 131

I have installed SCEP Client on a server (Windows 2022) and it looks like everything goes well, but I can't see the client GUI on the server.

Reza-Ameri 16,841 Reputation points

2022-06-20T15:17:31.13+00:00

Are you seeing it in the list of installed programs?
Try open programs and features and select to enable Windows Defender Features and GUI.
TomaszW-0873 131 Reputation points

2022-06-20T15:27:32+00:00

Yes, it is installed and I can't see an option to enable GUI for Windows Defender. Only Windows Defender itself.
TomaszW-0873 131 Reputation points

2022-06-20T17:13:59.927+00:00
When I try to do it via Powershell I have an error:
Install-WindowsFeature : ArgumentNotValid: The role, role service, or feature name is not valid: 'Windows-Defender-GUI'
. The name was not found.
At line:1 char:1

Install-WindowsFeature -Name Windows-Defender-GUI

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

CategoryInfo : InvalidArgument: (Windows-Defender-GUI:String) [Install-WindowsFeature], Exception

FullyQualifiedErrorId : NameDoesNotExist,Microsoft.Windows.ServerManager.Commands.AddWindowsFeatureCommand

I am using Windows 2019 Datacenter and 2022 Datacenter
Rita Hu -MSFT 9,626 Reputation points

2022-06-21T08:29:18.3+00:00

@TomaszW-0873
Thanks for your posting on Q&A.

Beginning with Windows 10 and Windows Server 2016 computers, Microsoft Defender Antivirus is already installed. So the Windows Defender Features has been enabled in Windows Sevrer 2022 by default. So there is no needed to reinstall it again. Please following the below screenshot and check whether the Endpoint Protection agent has been installed or not:

Related link for reference:
https://social.technet.microsoft.com/Forums/windows/en-US/810ff718-a24c-4af9-bad4-0ae5391a08cf/deployed-scep-but-nothing-to-indicate-it-was-deployed?forum=ConfigMgrCompliance

Best regards,
Rita

If the answer is the right solution, please click "Accept Answer" and kindly upvote it. If you have extra questions about this answer, please click "Comment".
Note: Please follow the steps in our documentation to enable e-mail notifications if you want to receive the related email notification for this thread.
TomaszW-0873 131 Reputation points

2022-06-23T15:03:23.147+00:00

Thanks. I will check. When I send a request to do a full scan from the SCCM console, I see no reaction in the defender GUI on the client machine.
Rita Hu -MSFT 9,626 Reputation points

2022-06-28T02:52:36.127+00:00

OK. Please inform me if there are any updates or questions of the case. Also it is recommended to check the EndpointProtectionAgent.log log on the affected device and collect more information.

looking forward to your feedback.

Best regards,
Rita

2 answers

TomaszW-0873 131 Reputation points

2022-07-01T16:01:39.49+00:00

I scheduled quick scan and I got the following results in the log file:

<![LOG[Starting quick scan action...]LOG]!><time="17:59:02.810-120" date="07-01-2022" component="EndpointProtectionAgent" context="" type="1" thread="1516" file="epclientaction.cpp:129">
<![LOG[Defender detected]LOG]!><time="17:59:02.810-120" date="07-01-2022" component="EndpointProtectionAgent" context="" type="1" thread="1516" file="epagentutil.cpp:1427">
<![LOG[Create Process Command line: "C:\Program Files\Windows Defender\MpCmdRun.exe" -Scan -ScanType 1.]LOG]!><time="17:59:02.810-120" date="07-01-2022" component="EndpointProtectionAgent" context="" type="1" thread="1516" file="epagentutil.cpp:695">
<![LOG[Trigger the application C:\Program Files\Windows Defender\MpCmdRun.exe starting successfully.]LOG]!><time="17:59:02.885-120" date="07-01-2022" component="EndpointProtectionAgent" context="" type="1" thread="1516" file="epagentutil.cpp:163">
<![LOG[Send State Message with topic type = 2003, state id = 3, and message = <INSTANCE><PROPERTY NAME="ProcessTime" TYPE="datetime"><VALUE>2022-07-01T15:59:02.810Z</VALUE></PROPERTY><PROPERTY NAME="ErrorCode" TYPE="int32"><VALUE>0</VALUE></PROPERTY><PROPERTY NAME="Error" TYPE="string"><VALUE></VALUE></PROPERTY></INSTANCE>]LOG]!><time="17:59:02.996-120" date="07-01-2022" component="EndpointProtectionAgent" context="" type="1" thread="1516" file="epclientaction.cpp:94">
Please sign in to rate this answer.
Rita Hu -MSFT 9,626 Reputation points

2022-07-11T07:16:57.44+00:00

Sorry for the late reply.

It seems that there are nothing wrong in the log files. Sorry for double confirm. May I know whether the devices shown as Endpoint Protection Deployment Information/Deployment State managed on the MECM console? Would you mind sharing the EndpointProtectionAgent.log in the affected device for reference? Note that cover your personal information while you provide the log file.

We could also run the rsop command on the affected device to confirm whether the device have applied the group policy. Note that the group policy are all local group policies which got from MECM.

Best regards,
Rita
Sign in to comment
CAM 41 Reputation points

2022-08-05T03:46:35.36+00:00

I am having this same issue as well.. SCEP is ont he list of installed application, but I cannot open the GUI.

Here is the log from EPAgent.log

<![LOG[Failed to check enrollment url, 0x00000001:]LOG]!><time="04:04:06.795-60" date="08-05-2022" component="EndpointProtectionAgent" context="" type="2" thread="4548" file="mdmreglib.cpp:1219">
<![LOG[Endpoint protection workload is NOT migrated to Intune. SCCM will apply policy.]LOG]!><time="04:04:06.795-60" date="08-05-2022" component="EndpointProtectionAgent" context="" type="1" thread="4548" file="epagentutil.cpp:1367">
<![LOG[Failed to get EP event code under registry key SOFTWARE\Microsoft\CCM\EPAgent]LOG]!><time="04:04:06.795-60" date="08-05-2022" component="EndpointProtectionAgent" context="" type="2" thread="4548" file="epagentimpl.cpp:1742">
<![LOG[Failed to get EP event message under registry key SOFTWARE\Microsoft\CCM\EPAgent]LOG]!><time="04:04:06.795-60" date="08-05-2022" component="EndpointProtectionAgent" context="" type="2" thread="4548" file="epagentimpl.cpp:1747">
<![LOG[EP State and Error Code didn't get changed, skip resend state message.]LOG]!><time="04:04:06.795-60" date="08-05-2022" component="EndpointProtectionAgent" context="" type="1" thread="4548" file="epagentimpl.cpp:180">
<![LOG[Failed to get EP event code under registry key SOFTWARE\Microsoft\CCM\EPAgent]LOG]!><time="04:04:06.795-60" date="08-05-2022" component="EndpointProtectionAgent" context="" type="2" thread="4548" file="epagentimpl.cpp:1742">
<![LOG[Failed to get EP event message under registry key SOFTWARE\Microsoft\CCM\EPAgent]LOG]!><time="04:04:06.795-60" date="08-05-2022" component="EndpointProtectionAgent" context="" type="2" thread="4548" file="epagentimpl.cpp:1747">
<![LOG[State 1, error code 0 and detail message are not changed, skip updating registry value]LOG]!><time="04:04:06.795-60" date="08-05-2022" component="EndpointProtectionAgent" context="" type="1" thread="4548" file="epagentimpl.cpp:233">
<![LOG[Device is a workstation, no need to check for downlevel defender]LOG]!><time="04:04:06.796-60" date="08-05-2022" component="EndpointProtectionAgent" context="" type="1" thread="4548" file="epagentutil.cpp:1415">
<![LOG[Defender not detected]LOG]!><time="04:04:06.796-60" date="08-05-2022" component="EndpointProtectionAgent" context="" type="1" thread="4548" file="epagentutil.cpp:1433">
<![LOG[Failed to check enrollment url, 0x00000001:]LOG]!><time="04:04:06.796-60" date="08-05-2022" component="EndpointProtectionAgent" context="" type="2" thread="4548" file="mdmreglib.cpp:1219">
<![LOG[Endpoint protection workload is NOT migrated to Intune. SCCM will apply policy.]LOG]!><time="04:04:06.796-60" date="08-05-2022" component="EndpointProtectionAgent" context="" type="1" thread="4548" file="epagentutil.cpp:1367">
<![LOG[Service startup notification received]LOG]!><time="04:18:30.536-60" date="08-05-2022" component="EndpointProtectionAgent" context="" type="1" thread="7048" file="fepsettingendpoint.cpp:297">
<![LOG[Endpoint is triggered by CCMTask Execute.]LOG]!><time="04:18:30.551-60" date="08-05-2022" component="EndpointProtectionAgent" context="" type="1" thread="1848" file="fepsettingendpoint.cpp:266">
<![LOG[Failed to check enrollment url, 0x00000001:]LOG]!><time="04:18:30.755-60" date="08-05-2022" component="EndpointProtectionAgent" context="" type="2" thread="1848" file="mdmreglib.cpp:1219">
<![LOG[Endpoint protection workload is NOT migrated to Intune. SCCM will apply policy.]LOG]!><time="04:18:30.755-60" date="08-05-2022" component="EndpointProtectionAgent" context="" type="1" thread="1848" file="epagentutil.cpp:1367">
<![LOG[Failed to get EP event code under registry key SOFTWARE\Microsoft\CCM\EPAgent]LOG]!><time="04:18:30.755-60" date="08-05-2022" component="EndpointProtectionAgent" context="" type="2" thread="1848" file="epagentimpl.cpp:1742">
<![LOG[Failed to get EP event message under registry key SOFTWARE\Microsoft\CCM\EPAgent]LOG]!><time="04:18:30.755-60" date="08-05-2022" component="EndpointProtectionAgent" context="" type="2" thread="1848" file="epagentimpl.cpp:1747">
<![LOG[EP State and Error Code didn't get changed, skip resend state message.]LOG]!><time="04:18:30.770-60" date="08-05-2022" component="EndpointProtectionAgent" context="" type="1" thread="1848" file="epagentimpl.cpp:180">
<![LOG[Failed to get EP event code under registry key SOFTWARE\Microsoft\CCM\EPAgent]LOG]!><time="04:18:30.770-60" date="08-05-2022" component="EndpointProtectionAgent" context="" type="2" thread="1848" file="epagentimpl.cpp:1742">
<![LOG[Failed to get EP event message under registry key SOFTWARE\Microsoft\CCM\EPAgent]LOG]!><time="04:18:30.770-60" date="08-05-2022" component="EndpointProtectionAgent" context="" type="2" thread="1848" file="epagentimpl.cpp:1747">
<![LOG[State 1, error code 0 and detail message are not changed, skip updating registry value]LOG]!><time="04:18:30.770-60" date="08-05-2022" component="EndpointProtectionAgent" context="" type="1" thread="1848" file="epagentimpl.cpp:233">
<![LOG[Device is a workstation, no need to check for downlevel defender]LOG]!><time="04:18:30.770-60" date="08-05-2022" component="EndpointProtectionAgent" context="" type="1" thread="1848" file="epagentutil.cpp:1415">
<![LOG[Defender not detected]LOG]!><time="04:18:30.770-60" date="08-05-2022" component="EndpointProtectionAgent" context="" type="1" thread="1848" file="epagentutil.cpp:1433">

...and this is the status in SCCM console:
Please sign in to rate this answer.

0 comments No comments
Sign in to comment

Share via

SCEP GUI Missing

2 answers