The Official Microsoft Forefront Endpoint Protection Team Blog

We’ve moved

J.C. Hornbeck — Tue, 01 Mar 2016 13:31:43 GMT

This is probably long overdue, but with Endpoint Protection being part of System Center it’s been decided to go ahead and close the shutters on our old Forefront Endpoint Protection blog here. That doesn’t mean we’re not going to be posting new content for Endpoint Protection, just that you’ll need to look for it over on our core Configuration Manager blog instead. And don’t worry, we’re going to leave all this content in place for now so it shouldn't be going anywhere soon. If you subscribe to this blog now and wish to keep receiving notifications of new content, you can subscribe to our Configuration Manager blog here.

Have a suggestion for the Microsoft Endpoint Protection team? Here’s how to make your voice heard

J.C. Hornbeck — Thu, 28 Jan 2016 12:05:40 GMT

Do you have a suggestion or idea on how to improve Microsoft System Center Endpoint Protection? If so the Endpoint Protection team would love to hear it through their User Voice site at https://configurationmanager.uservoice.com/forums/300492-ideas/category/115737-endpoint-protection. Please take a few minutes to submit your idea or vote up an idea submitted by another SCEP customer. All of the feedback you share in these forums is regularly monitored and reviewed by the Microsoft engineering teams responsible for building SCEP. They have already added some of the feedback they received so please don’t hesitate to let them know what you think.

J.C. Hornbeck | Solution Asset PM | Microsoft

Our Blogs

Configuration Manager: https://blogs.technet.com/configurationmgr/
Data Protection Manager: https://blogs.technet.com/dpm/
Orchestrator: https://blogs.technet.com/b/orchestrator/
Operations Manager: https://blogs.technet.com/momteam/
Operations Management Suite: https://blogs.technet.microsoft.com/omsblog/
Service Manager: https://blogs.technet.com/b/servicemanager
Virtual Machine Manager: https://blogs.technet.com/scvmm
Microsoft Intune: https://blogs.technet.microsoft.com/intunesupport/
WSUS: https://blogs.technet.com/sus/
AD and Azure RMS: https://blogs.technet.com/b/rms/
Application Virtualization: https://blogs.technet.com/appv/
MED-V: https://blogs.technet.com/medv/
Application Proxy: https://blogs.technet.com/b/applicationproxyblog/
Forefront Endpoint Protection: https://blogs.technet.com/b/clientsecurity/
Forefront Identity Manager: https://blogs.msdn.com/b/ms-identity-support/
Forefront TMG: https://blogs.technet.com/b/isablog/
Forefront UAG: https://blogs.technet.com/b/edgeaccessblog/

SCEP 2012 R2 ConfigMgr 2012 R2

Now Available: February 2015 anti-malware platform update for Endpoint Protection Clients

J.C. Hornbeck — Thu, 12 Feb 2015 11:02:51 GMT

Microsoft has a new anti-malware platform update package available for the following clients:

- Microsoft System Center 2012 R2 Configuration Manager Endpoint Protection clients
- System Center 2012 Endpoint Protection Service Pack 1 (SP1) clients
- Microsoft Forefront Endpoint Protection 2010 clients

These packages update Endpoint Protection client services, drivers and UI components.

For all the details regarding the improvements and updates, please see the following:

KB3036437 - February 2015 anti-malware platform update for Endpoint Protection Clients (https://support.microsoft.com/kb/3036437)

J.C. Hornbeck | Solution Asset PM | Microsoft GBS Management and Security Division

Get the latest System Center news on Facebook and Twitter:

Main System Center blog: https://blogs.technet.com/b/systemcenter/

Configuration Manager Support Team blog: https://blogs.technet.com/configurationmgr/
Data Protection Manager Team blog: https://blogs.technet.com/dpm/
Orchestrator Team blog: https://blogs.technet.com/b/orchestrator/
Operations Manager Team blog: https://blogs.technet.com/momteam/
Service Manager Team blog: https://blogs.technet.com/b/servicemanager
Virtual Machine Manager Team blog: https://blogs.technet.com/scvmm

Microsoft Intune: https://blogs.technet.com/b/microsoftintune/
WSUS Support Team blog: https://blogs.technet.com/sus/
RMS blog: https://blogs.technet.com/b/rms/
App-V Team blog: https://blogs.technet.com/appv/
MED-V Team blog: https://blogs.technet.com/medv/
Server App-V Team blog: https://blogs.technet.com/b/serverappv

Forefront Endpoint Protection blog: https://blogs.technet.com/b/clientsecurity/
Forefront Identity Manager blog: https://blogs.msdn.com/b/ms-identity-support/
Forefront TMG blog: https://blogs.technet.com/b/isablog/
Forefront UAG blog: https://blogs.technet.com/b/edgeaccessblog/
Application Proxy blog: https://blogs.technet.com/b/applicationproxyblog/
The Surface Team blog: https://blogs.technet.com/b/surface/

SCEP 2012 R2 ConfigMgr 2012 R2

KB: October 2014 anti-malware platform update for Endpoint Protection clients

J.C. Hornbeck — Wed, 15 Oct 2014 12:17:19 GMT

The article below describes an anti-malware platform update package for the following:

- Microsoft System Center 2012 R2 Configuration Manager Endpoint Protection clients
- Microsoft System Center 2012 Endpoint Protection Service Pack 1 (SP1) clients
- Microsoft Forefront Endpoint Protection 2010 clients

These packages update Endpoint Protection client services, drivers, and user interface (UI) components.

This anti-malware platform update contains the following improvements:

- Improved scanning for MBR/VBR detections and advanced bootkits
- Dynamic registry key hardening to counter tampering from malware
- Disk space optimization for Low end devices
- Shortening fallback time to ADL for signatures

For complete details please see the following:

KB2998627 - October 2014 anti-malware platform update for Endpoint Protection clients (https://support.microsoft.com/kb/2998627)

J.C. Hornbeck | Solution Asset PM | Microsoft GBS Management and Security Division

Get the latest System Center news on Facebook and Twitter:

System Center All Up: https://blogs.technet.com/b/systemcenter/
System Center – Configuration Manager Support Team blog: https://blogs.technet.com/configurationmgr/
System Center – Data Protection Manager Team blog: https://blogs.technet.com/dpm/
System Center – Orchestrator Support Team blog: https://blogs.technet.com/b/orchestrator/
System Center – Operations Manager Team blog: https://blogs.technet.com/momteam/
System Center – Service Manager Team blog: https://blogs.technet.com/b/servicemanager
System Center – Virtual Machine Manager Team blog: https://blogs.technet.com/scvmm

Windows Intune: https://blogs.technet.com/b/windowsintune/
WSUS Support Team blog: https://blogs.technet.com/sus/
The RMS blog: https://blogs.technet.com/b/rms/

App-V Team blog: https://blogs.technet.com/appv/
MED-V Team blog: https://blogs.technet.com/medv/
Server App-V Team blog: https://blogs.technet.com/b/serverappv

The Forefront Endpoint Protection blog : https://blogs.technet.com/b/clientsecurity/
The Forefront Identity Manager blog : https://blogs.msdn.com/b/ms-identity-support/
The Forefront TMG blog: https://blogs.technet.com/b/isablog/
The Forefront UAG blog: https://blogs.technet.com/b/edgeaccessblog/

ConfigMgr 2012 R2 SCEP 2012 R2

HOTFIX: Up to date Forefront Endpoint Protection 2010 clients listed in the “Out of Date” collection

J.C. Hornbeck — Wed, 09 Jul 2014 11:14:07 GMT

Forefront Endpoint Protection 2010 clients managed by System Center Configuration Manager 2007 may appear in the “Out of Date” deployment status collection after an anti-malware platform update is installed via Microsoft Update.

This issue occurs because the “Out of Date” collection checks for the version of the 'Microsoft Forefront Endpoint Protection 2010 Server Management' entry in Add/Remove programs data, however this data is not updated by anti-malware platform updates released to Microsoft Update.

For information about a hotfix that addresses this issue please see the following article in the Microsoft Knowledge Base:

KB2975384 - Up to date Forefront Endpoint Protection 2010 clients listed in the “Out of Date” collection (https://support.microsoft.com/kb/2975384)

J.C. Hornbeck | Solution Asset PM | Microsoft GBS Management and Security Division

Get the latest System Center news on Facebook and Twitter:

Windows Intune: https://blogs.technet.com/b/windowsintune/
WSUS Support Team blog: https://blogs.technet.com/sus/
The AD RMS blog: https://blogs.technet.com/b/rmssupp/

App-V Team blog: https://blogs.technet.com/appv/
MED-V Team blog: https://blogs.technet.com/medv/
Server App-V Team blog: https://blogs.technet.com/b/serverappv

KB: Supported usage of wildcard characters with exclusions

J.C. Hornbeck — Thu, 12 Jun 2014 09:15:01 GMT

Just wanted to let you know about a new KB article we published that outlines the supported usage of wildcard characters with exclusions for the following products:

- Microsoft Forefront Client Security (FCS)

- Microsoft Forefront Endpoint Protection (FEP) 2010

- Microsoft System Center 2012 Endpoint Protection (SCEP 2012)

- Microsoft System Center 2012 R2 Endpoint Protection (SCEP 2012 R2)

- Microsoft Antimalware for Azure

You can find the complete article here:

KB2962341 - Supported usage of wildcard characters with exclusions (https://support.microsoft.com/kb/2962341)

J.C. Hornbeck | Solution Asset PM | Microsoft GBS Management and Security Division

Get the latest System Center news on Facebook and Twitter:

Windows Intune: https://blogs.technet.com/b/windowsintune/
WSUS Support Team blog: https://blogs.technet.com/sus/
The AD RMS blog: https://blogs.technet.com/b/rmssupp/

App-V Team blog: https://blogs.technet.com/appv/
MED-V Team blog: https://blogs.technet.com/medv/
Server App-V Team blog: https://blogs.technet.com/b/serverappv

The March 2014 anti-malware platform update for Endpoint Protection clients is now available

J.C. Hornbeck — Thu, 03 Apr 2014 09:59:30 GMT

The KB article below describes an anti-malware platform update package for the following clients:

- Microsoft System Center 2012 R2 Configuration Manager Endpoint Protection clients

- Microsoft System Center 2012 Configuration Manager Endpoint Protection Service Pack 1 (SP1) clients

- Microsoft Forefront Endpoint Protection 2010 clients.

These packages update Endpoint Protection client services, drivers, and UI components.

Microsoft regularly releases anti-malware platform updates to guarantee consistency in protection, performance, robustness, and usability in a malware landscape that is constantly changing. This update package is dated March 2014.

For additional details as well as information on how to obtain the update, please see the following:

KB2952678 - March 2014 anti-malware platform update for Endpoint Protection clients (https://support.microsoft.com/kb/2952678)

J.C. Hornbeck | Solution Asset PM | Microsoft GBS Management and Security Division

Get the latest System Center news on Facebook and Twitter:

Windows Intune: https://blogs.technet.com/b/windowsintune/
WSUS Support Team blog: https://blogs.technet.com/sus/
The AD RMS blog: https://blogs.technet.com/b/rmssupp/

App-V Team blog: https://blogs.technet.com/appv/
MED-V Team blog: https://blogs.technet.com/medv/
Server App-V Team blog: https://blogs.technet.com/b/serverappv

KB: Exclude mounted volumes from the weekly on-demand scan in System Center 2012 Endpoint Protection for Mac

J.C. Hornbeck — Wed, 02 Apr 2014 11:48:44 GMT

When System Center 2012 Endpoint Protection (SCEP 2012) for Mac runs a scheduled weekly scan, it may unexpectedly scan all network mounted drives such as Server Message Block (SMB) share folders and Andrew File System (AFS) share folders. This may cause System Center 2012 to scan the files on hundreds of servers. This issue occurs because on Mac computers, all drives are mounted to the "/Volumes" path. The root path is mounted to the "/" path and has a symbolic link under the "/Volumes" path. Therefore, System Center 2012 Endpoint Protection for Mac cannot include or exclude drives from scanning.

For all the details and a workaround please see the following:

KB2937878 - Exclude mounted volumes from the weekly on-demand scan in System Center 2012 Endpoint Protection for Mac (https://support.microsoft.com/kb/2937878)

J.C. Hornbeck | Solution Asset PM | Microsoft GBS Management and Security Division

Get the latest System Center news on Facebook and Twitter:

Windows Intune: https://blogs.technet.com/b/windowsintune/
WSUS Support Team blog: https://blogs.technet.com/sus/
The AD RMS blog: https://blogs.technet.com/b/rmssupp/

App-V Team blog: https://blogs.technet.com/appv/
MED-V Team blog: https://blogs.technet.com/medv/
Server App-V Team blog: https://blogs.technet.com/b/serverappv

Anti-malware platform updates for FEP 2010 and SCEP 2012 are being released to Microsoft Update

J.C. Hornbeck — Tue, 01 Apr 2014 13:42:12 GMT

Starting April 8^th, Microsoft will release all anti-malware platform updates for Forefront Endpoint Protection (FEP) and System Center 2012 Endpoint Protection (SCEP) through Microsoft Update (MU). To deliver the latest anti-malware platform updates to enterprise customers in a timely fashion, these updates will be made available approximately three times per year. For more details please see this post by Minfang Lv, Software Development Engineer in Test, Configuration Manager Sustained Engineering:

Anti-malware platform updates for Forefront Endpoint Protection/System Center Endpoint Protection will be released to Microsoft Update

J.C. Hornbeck | Solution Asset PM | Microsoft GBS Management and Security Division

Get the latest System Center news on Facebook and Twitter:

Windows Intune: https://blogs.technet.com/b/windowsintune/
WSUS Support Team blog: https://blogs.technet.com/sus/
The AD RMS blog: https://blogs.technet.com/b/rmssupp/

App-V Team blog: https://blogs.technet.com/appv/
MED-V Team blog: https://blogs.technet.com/medv/
Server App-V Team blog: https://blogs.technet.com/b/serverappv

Information on FEP and SCEP support after OSes (like Windows XP) reach end-of-life

J.C. Hornbeck — Mon, 31 Mar 2014 10:11:44 GMT

Concerned about how SCEP 2012 and FEP 2010 will work when an OS reaches it’s end of life? Check out this post by Minfang Lv, Software Development Engineer in Test, for all the details:

FEP and SCEP anti-malware protection support after OSes reach end-of-life

J.C. Hornbeck | Solution Asset PM | Microsoft GBS Management and Security Division

Get the latest System Center news on Facebook and Twitter:

Windows Intune: https://blogs.technet.com/b/windowsintune/
WSUS Support Team blog: https://blogs.technet.com/sus/
The AD RMS blog: https://blogs.technet.com/b/rmssupp/

App-V Team blog: https://blogs.technet.com/appv/
MED-V Team blog: https://blogs.technet.com/medv/
Server App-V Team blog: https://blogs.technet.com/b/serverappv