FEP Log Files

Applies To: Forefront Endpoint Protection

Forefront Endpoint Protection (FEP) creates log files both during the installation on your Configuration Manager server and during day-to-day operations.

FEP Server Installation Log Files

The installation log files are listed below.

Log file name Description


FEP site server extensions


FEP Reporting Components


FEP Console Extensions


FEP Setup

You can find FEP server installation log files in the following location:

  • If you installed FEP on Windows Server 2003:

    %AllUsersProfile%\Application Data\Microsoft Forefront\Support\Server

  • If you installed FEP on Windows Server 2008:

    %ProgramData%\Microsoft Forefront\Support\Server

The file names use the following format:


where the following is true:

  • LogFileName is the name of the log file.

  • Date is the day, month, and year the log was created, in the format DDMMYYY.

  • Time is the hour, minute, and second the log file was created, in the format HHMMSS.

FEP Server Operational Log Files

The following table lists the log files in which FEP stores operational information.

Log file name Description


FEP stores console-related information in this Configuration Manager console log file. It can be found in C:\Program Files (x86)\Microsoft Configuration Manager\AdminUI\AdminUILog. For more information about this log file, see Troubleshooting Configuration Manager Console Issues (https://go.microsoft.com/fwlink/?LinkId=207567) in the Configuration Manager documentation.


FEP service tracing log file. This file, stored in %ProgramData%\Microsoft Forefront\Support\, contains binary information typically only useful to product support personnel.

FEP Client Software Installation Log Files

The FEP client software creates log files both during installation and during day-to-day operations.

The following table lists setup log files and the components with which they are associated.

Log file name Description


Master setup log file.


User interface and management extension setup log file.


Configuration Manager management extensions setup log file.


Antimalware service setup log file.

MSSecurityClient_Setup_epploc_x86_Install or MSSecurityClient_Setup_epploc_x64_Install

Localized resources installation log file (specific to the architecture on the client computer).


Log file for installation of localized resources for the antimalware service. %locale% represents the locale for which the install was performed.


The log file for Windows patch installation KB981889. Only present on Windows 7 or Windows Server 2008 R2.


Log file for installation of Dr. Watson (only installed on computers running Windows XP and only if not already present).

You can find FEP client installation log files in the following location:

  • %allusersprofile%\Microsoft\Microsoft Antimalware\Support—Log files specific for the antimalware service.

  • %allusersprofile%\Microsoft\Microsoft Security Client\Support—Log files specific for the FEP client software.

  • %windir%\WindowsUpdate.log—Windows Update log files, which include information about definition updates.