flannelfriday

So, for some reason the custom client settings I had setup to push out SCEP weren't getting deployed correctly. I changed the default client settings (works in our environment) to install SCEP automatically and it worked fine this time.

Any thoughts? This was working fine before I upgraded to SP1. I can manually install SCEP and it picks up the policy but it won't automatically install. I have set 'yes' to 'allow endpoint protection client installation and restarts outside maintenance windows'. File C:\WINDOWS\ccmsetup\SCEPInstall.exe version is 4.1.522.0. EndpointProtectionAgent 6/28/2013 11:37:15 AM 4644 (0x1224) Unable to query registry key (SOFTWARE\Microsoft\Microsoft Security Client), return (0x80070002) means EP client is NOT installed. EndpointProtectionAgent 6/28/2013 11:37:16 AM 4644 (0x1224) Re-apply EP AM policy. EndpointProtectionAgent 6/28/2013 11:37:16 AM 4644 (0x1224) AM policy is not applied because SCEP client is not installed and installation is disabled. EndpointProtectionAgent 6/28/2013 11:37:16 AM 4644 (0x1224) Firewall provider is installed. EndpointProtectionAgent 6/28/2013 11:37:25 AM 4644 (0x1224) Installed firewall provider meet the requirements. EndpointProtectionAgent 6/28/2013 11:37:25 AM 4644 (0x1224) File C:\WINDOWS\ccmsetup\SCEPInstall.exe version is 4.1.522.0. EndpointProtectionAgent 6/28/2013 11:37:26 AM 3320 (0x0CF8) Unable to query registry key (SOFTWARE\Microsoft\Microsoft Security Client), return (0x80070002) means EP client is NOT installed. EndpointProtectionAgent 6/28/2013 11:37:26 AM 3320 (0x0CF8) Check and enforce EP Deployment state. EndpointProtectionAgent 6/28/2013 11:37:26 AM 3320 (0x0CF8) Skip the SCEP installation/upgrade since installation is disabled. EndpointProtectionAgent 6/28/2013 11:37:27 AM 3320 (0x0CF8)

This is a lab setup so I'm just using the "default client settings" and "default client antimalware policy". I did verify it the SCEP 2010 client is using the correct policy (clicked help -> about), it matches what I have in SCCM. Are there any logs I can look at to see if it is indeed trying to update its definitions?

For some reason my SCEP 2010 clients are not updating to the latest definitions. The automatic deployment rule in SCCM 2012 runs correctly and has the latest definitions downloaded and deployed. Here is how everything is setup: SUP: Forefront Endpoint Protection 2010 Sync Schedule is at 5AM and 5PM Automatic Deployment Rule: Date Released or Revised "Last 1 Day" Product "Forefront Endpoint Protection 2010" Evaluation Schedule is at 6AM and 6PM Deployment: Software available: As soon as possible Deployment: Installation Deadline: As soon as possible Client Antimalware Policy: Check for Endpoint Protection definitions daily at 9AM Updates distributed from Configuration Manager is first If I right-click an object in SCCM and click Download Definitions the client gets the correct definitions. But it does not seem to do it automatically. Thoughts?