My endpoint protection clients aren't updating. I noticed it happening this last month.

Most clients are 2 to 7 days outdated.

They are receiving the correct policy.

I'm on SCCM 2203 as of today.

Attached 2 images of log files from different clients.

I have some question for the troubleshooting: how does the Client reports its Definition Updates to the Console/CM -  Database?

I noticed several clients having been updated to 1.383.698.0 but still reports only 1.379.517.0 on the CM - Console. What is the workflow for this path between the client and the console? which logs are used?
Thanks,

Dom

In the production environment we get errors as these:
Cannot find path for destination inbox Notification Manager on server REGISTRY. The current component is possibly not installed.
Cannot connect to the inbox source, sleep 30 seconds and try again.  
[Software Inventory Processor (Site Trusted)] cannot update environment so skiping outbox processing.
Cannot find path for destination inbox Distribution Manager (incoming) on server registry.
~~ same goes for: Software Metering Processor Usage (Site), Success Policy Requests / Discovery Data Manager, etc.
[Notification Manager] cannot update environment so skiping outbox processing.
[Distribution Manager (Incoming)] halting execution.  
Remote site is in pull-mode.
Coult not read registy key HKEY_LOCAL_MACHINE\Software\Microsoft\SMS\MPFDM\INboxes\ on the server. The operating system reported error 2: cannot find the file

We have no clue how to resolve this. We opened a case with MS, but so far nothing.
It seems during the installation stuff from the new epp-server should be pushed onto the siteserver (and stuff should also be written in the registry of the site server,) but this fails.

The SiteServer is admin on the new Site System (we tried to install using the site servers computer account as well as the install service account - both failed).
The service RemoteRegistry runs on both systems.

Thank you for ideas.
Sincerely
Andreas

I hope that someone may be able to shed some light on this topic. We've been getting reports from users who have a specific model that see spikes in CPU activity on 100% when the quick scan from Windows Defender starts. The notebook gets practically unusable in the next 10-20 minutes because of a huge lag in responsiveness. I've noticed that even though Defender will report the scan as finished, the sluggishness continues for several more minutes and finally ends after some time. The odd thing is that this is widely reported only on a specific model from Lenovo (ThinkPad P1 Gen2)

• We are using SCCM 1806 and Windows 10 1809
• The CPU usage for the antimalware scan is limited to 30% by SCCM and the usage stays around this number, but the scan causes other processes to spike
• We've noticed the scan to cause other processes to spike: Skype for Business, Windows interrupts (this struck me as quite odd), Chrome, IntelliJ and others
• We've tried excluding the whole drive from the scans - still happens 
• We've tried excluding some processes used daily by some users (browser, development IDE, etc...) - still happens
• Updated everything from the Lenovo System Update tool 2-3 weeks ago with one user - still happens
• Windows event log shows nothing of value
• I was not able to find anything in EndpointProtectionAgent.log that would indicate an issue

What is really confusing to me:

• Out of all devices, only some users with P1 Gen2 models are reporting this issue
• Some users experience this on a daily basis, while others have seen it only a handful of times in the past several months
• The spike of CPU load for System interrupts in some cases leads me towards a possible driver issue, but I cannot pinpoint what exactly

I was not able to find any relevant information in the event viewer. The log files at C:\ProgramData\Microsoft\Windows Defender\Support do not seem much of use as well. I was not able to find information on the path of the scanned items or a way to produce a log with increased verbosity that is in readable format.

Is there any way we can troubleshoot this further with more details and pinpoint the exact cause of this problem?

1. Is this enough?  Are we still going to be protected as we were with a full blown AV?  We are fully Windows 10 going forward.
2. Is there a document that will walk me through setting this all up?
3. Is there a way to setup email alerts when a virus / malware / other security alert is found?
4. Anything else we need to know before starting?

What steps/procedure did you follow?

I am thinking of these steps:

1. Creating a Package with a batch file and deploying this to uninstall (@echo off C:Windowsccmsetupscepinstall.exe /u /s)
2. Then to disable Endpoint Protection via client settings on SCCM.
3. Deploy Avast via a new Package or Application.

The systems that are having the issue are reporting a 0X80072EFE error in the Data Transfer Service log. One of the systems when I used “bitsadmin” to see what was queued to the system had 116 pending files that were just sitting there. Using this link to assist https://social.technet.microsoft.com/Forums/office/en-US/ba0725b2-c9cc-41e8-81d6-fa5ec83a4be4/windows-update-error-0x80072efe?forum=winservergen I am able to determine that it is not the firewall, nor the AV that is the issues. I also renamed the softwaredistribution folder on off chance that there was a corrupted file inside one of the folders. That did not resolve the issue. I downloaded and ran Checksur.exe and no issues were noted or reported. I rerun Software Updates Deployment Eval Cycle and Updates Scan Cycle and still receive the same error. On one of the systems, I performed a SCCM repair and that did not resolve. Part of the above link is to also run System File Checker (SFC) on the system, which does not find any issues. At each point of this process I run “bitsadmin” and there are usually 6 files queued up and not showing any sign that they are downloading. Attempting to reset them fails and so my only resort is to go in and stop BITS service, rename the 2 files located in programdata\microsoft\network\downloader and this does not resolve the issue.

I may be looking up the wrong tree, but believe the 0X80072EFE error if resolved would then allow this and the other systems to automatically update themselves. Being that this a remote location, reimaging the systems is an option, but an option of last resort, but can be done. I would like to be able to resolve the above issue and move on. I have a similar setup on another location, and the systems there do not have this issue.

I have added the 3 logs and if there are any additional logs that you would like to see, please let me know so I can post them.

Tks

Mark Reny

DataTransferServiceLog.txt

EndpointProtectionAgentLog.txt

WUAHandlerLog.txt

.

I also created a custom antimalware policy and deployed it to the windows 10 clients. But they show only windows defender in the header

. So how can i proof if all is working fine?

Another Problem. All Guides say we should use SUS for Endpoint Protection Updates but how do i conifgure SUS for Endpoint Protection 1606?

What Product shoul we use:

It is very confusing for me!

How can check that everything is working well and only the visual thing is confusing.

Can please anybody clear the things??

We've been testing deploying FEP on a collection and all went well and no issues on the clients. My manager gave me the go-ahead to deploy to all desktops. However when I deploy for the collection for all desktops, nothing happens and the reporting states "Active clients protection with Endpoint Protection: 0" although the total devices comes up correctly.

I left this for 24 hours and still nothing. I then re-deployed and still nothing. I then decided to drop a handful of these desktops into our test collection and within half an hour they all had the FEP status as managed.

Why is this working for one collection but not another? Logs doesn't seem to be providing any information.

for example when the number of clients that has the definitions up to 3 days old reaches reaches the number of 1000 clients.

Would it be possible to check the threshold with every summarization on the report?

Regards

Pawel

By default SCCM/MS Security Endpoint appear to provide no more than 30 days when viewed in console. If I view a report and specify a 90 day window, still only 30 days incidents are reported.

Is anyone aware of methods to change logging to greater than 30 days?

Thank you in advance.

Dan Mahler

Grand Rapids, Michigan