Updating FCS and FEP2010 without WSUS

Both FCS and FEP2010 can get updates direct from Microsoft, but their behaviour is different enough to cause confusion.

For an FCS client to update from Microsoft you need to opt the machine into Microsoft Update. Just turning Windows Update on is not enough. Unfortunately FCS doesn't give you any information that anything is wrong - it just reports that there are no updates available. Once you've opted in to Microsoft Update everything is fine.

A FEP2010 client can update from Microsoft without you needing to opt the machine into Microsoft Update.

You can prove this to yourself by creating two vbscripts as supplied below, optinMU.vbs and optoutMU.vbs. Using the scripts to opt in and out of Microsoft Update you can see for yourself the behaviour of FCS and FEP2010. If your machine is configured for WSUS, you can set it to use Windows Update by deleting the registry key HKLM\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate and restarting the Automatic Updates service. While testing you can install the Forefront Client Security client in standalone mode by running CLIENTSETUP.EXE /NOMOM

So, to summarise-

FCS - needs opt in to MU
FEP2010 - no requirement for MU

optinMU.vbs

'from http://msdn.microsoft.com/en-us/library/aa826676(v=vs.85).aspx
Set ServiceManager = CreateObject("Microsoft.Update.ServiceManager")
ServiceManager.ClientApplicationID = "My App"

'add the Microsoft Update Service, GUID
Set NewUpdateService = ServiceManager.AddService2("7971f918-a847-4430-9279-4a52d1efe18d",7,"")

optoutMU.vbs

Set ServiceManager = CreateObject("Microsoft.Update.ServiceManager")
ServiceManager.ClientApplicationID = "My App"

ServiceManager.RemoveService("7971f918-a847-4430-9279-4a52d1efe18d")

MMS 2011 Day 3

The dodgy wifi at the Mandalay Bay finally conspired against me and I didn't get a chance to post this entry until today - a full week later. I'll probably type up the other notes as separate blog postings.

Keynote 2 - You! Empowered to Embrace Consumerization

This keynote is available to watch here.

As suspected, SCCM 2012 will be able to do lightweight management of iPad, iPhone, Android and Symbian devices through ActiveSync.

A new feature of SCCM 2012 is Intelligent Application Delivery. This can autodetermine if you're on a corporate machine, an untrusted machine, your primary work machine and so on. It can determine rules based on hardware or software features and then deploy the same Application in different ways based on these rules.

Forefront Endpoint Protection 2010 is now part of the core CAL not just the Enterprise CAL. SCCM 2012 integration now reports on the top users that get viruses, not just the top workstations.

As reported elsewhere client settings can now be set at the collection level, so you don't need a new site just to have different Software Update settings for different machines. You can, however, set default client settings for the entire site and let other admins override them at the collection level. Editing of the sms_def.mof file shouldn't be necessary as you'll be able to enable custom hardware inventory through the client settings.

Windows Intune, a cloud based management service, was launched at the keynote. This looks like a potentially revolutionary way to manage desktop PCs in small to medium businesses.

MMS 2011 Day 2

Day 2 - the first real day of the conference, and the day of the myitforum party!

Keynote 1 - You. Empowered by the Cloud

Surprisingly early start to day 2 with a Keynote at 8.30am. There were two keynotes at MMS 2011, the first focusing on cloud computing, the second on the consumerisation of IT.

First up was the announcement that Opalis has been renamed as System Center Orchestrator. Another new addition to the System Center family is System Center Advisor. This product, formerly codenamed Atlanta, allows you to track config changes on your systems, and compare them with best practices.  The beta is available today.

A key theme in the keynote was separating the apps, data, and OS on servers to provide increased manageability and reliability. Server app-v is a key component here, which can also help reduce the number of OS images you have for your servers. To help with building and managing these private clouds, Microsoft released the beta of Virtual Machine Manager 2012 this morning.

We were given a quick demo of Avicode for client experience monitoring. The most impressive part of the demo was drilling down into exactly what part of a stored procedure is causing slowdowns. 

Tomorrows keynote- the consumerisation of IT. On the slide deck they had a picture of an iPhone- does this mean we'll be managing idevices through sccm soon?

You can watch the first keynote here.

BA01 Configuration Manager State of the Union

After the keynote, comes the 'real' keynote for SCCM. The biggest announcement came at the end!

As usual, lots of top ten lists. Interestingly the User state migration hotfix is the 2nd most applied behind the r3 power management hotfix. I'll be blogging about this particular patch at a later date, it's a pain to apply and affects OSD builds even when you're not using USMT.

As mentioned in the keynote Opalis is now Orchestrator. Out fall 2011 with built in support for sccm 2012. Built in actions like add computer to collection are supported. 

Adobe Reader X has had support for ConfigMgr since November 2010 for updates through SCUP. 

Sccm 2012 beta 2 will be RTW any day now. There's new exclude/include rules for collections!

They provided a great demo of role based administration. Thankfully you can now scope users to collection, and hide features and collections a user doesn't have access to. And at last you can run two instances of the console at once with different credentials. 

2012 has integrated global search across the entire product. They gave the example of searching for Flash. This search returned applications, deployments and software updates. You can drill down and see the context (eg properties of package) direct in the search dialog.

Supercedence is another new feature in SCCM 2012. This allows you to set rules based on versions of a product so that if you install version 9.2 of a product it will first detect and uninstall version 9.1. This also provides a graphical view of the supercedence of your apps. 

SCCM 2012 also provides a graphical view of your site hierarchy. You can enter geographical locations and view a bing map with the location of all your sites. 

An important point for those thinking of evaluating SCCM 2012 that are deploying/have deployed FEP - you'll need to wait for a compatible version of FEP. 

They announced PCM (Package Conversion Manager) to ease the transition to the new application model. This tool analyzes and checks whether classic software packages can be converted to the new app model, and if so, can convert them for you. It has a cool dashboard which gives pie and bar charts for readiness and conversion status.

One potential point of confusion with the new application model that they cleared up - legacy software distribution is still there. You can continue to use the classic way of deploying apps if you want to.

The SCCM 2012 SDK has been updated with powershell cmdlets such as new-collection, get-package. 

Server Configuration Packs look interesting. These are packs of DCM settings built and converted from the Microsoft Best Practices Analyzers. DCM is becoming much more important in SCCM, and has been rebranded as Settings Management for the 2012 release of the product. This now includes settings enforcement to remediate configuration drift. 

They quickly mentioned the P2V Migration Toolkit, which will assist with virtualizing SCCM site systems. Yesterday's BA17 Virtualizing Configuration Manager went into much more depth about this tool.

The last announcement was the headline grabber. SCCM 2012 will support Linux/unix servers. They are planning to offer support for various versions of Red Hat, SuSE, Solaris, HP-UX and AIX. These appear to be the same supported platforms as OpsMgr. The client will offer a subset of current Windows ConfigMgr functionality, and will be available some months after SCCM 2012 RTMs. They revealed a previously hidden talk on Wednesday - BA16 Configuration Manager 2012: Cross Platform Management.

Finally, they will be uploading howto videos for SCCM 2012 on Connect.

BA03 Configuration Manager 2012: Technical Overview

The main change in SCCM 2012 seems to be the Application model. In SCCM 2012 you will be managing applications, not scripts. By managing the Application you get a host of nice new features - automatic revision management and supercedence. As mentioned above, supercedence can enforce the uninstall of a previous version before installing the new version. The Application model also allows a choice of deployment options based on the device the user is sitting at - so, for example, a full install on their primary PC, but a streamed app on any other PC.

The PXE Service Point role has been bundled into the Distribution Point role.

Client health has been greatly improved in SCCM 2012 - a new program ccmeval.exe runs on the client itself and can check and remediate problems with the client.

There's lightweight device management based on Exchange ActiveSync - this will provide limited inventory and tasks that can be run on mobile devices that connect to your Exchange server via ActiveSync.

They've improved the Settings Management (DCM) interface, and you can now browse for Registry keys to check/remediate!

Migrating from Sophos to Forefront Endpoint Protection

One of the great things about deploying FEP 2010 is that it eases the pain of migrating away from your existing antimalware solution. According to the documentation it can detect and remove the following products

• Symantec Endpoint Protection version 11
  
• Symantec Corporate Edition version 10
  
• McAfee VirusScan Enterprise version 8.5 and version 8.7
  
• Trend Micro OfficeScan version 8.0 and version 10.0
  
• Forefront Client Security version 1 including the Operations Manager agent
  

But what if you use Sophos Endpoint Protection?

Sadly, if you're like me you'll have to work it out yourself. Sophos used to provide a script that could uninstall old versions of the client software, however I seem to recall it wasn't officially supported.

The problem with Sophos is that you have two components to remove- the update agent and the antimalware engine.

Both components are installed by MSI packages which are cached in the AutoUpdate folder. So, to perform the uninstall of Sophos you can create a cmd file in your FEP deployment folder with the following lines

msiexec /x "%programfiles%\Sophos\AutoUpdate\Cache\savxp\Sophos Anti-Virus.msi" /qn /quiet /norestart

msiexec /x "%programfiles%\Sophos\AutoUpdate\Cache\sau\Sophos AutoUpdate.msi" /qn /quiet /norestart

FEPInstall.exe /s /q

If you're planning an enterprise deployment you'll probably want to add more error checking in your script, but this should help you get started.

The cache folder can be useful if you still need to deploy Sophos as part of your transition. Create a new package that contains the sau folder from the Cache folder. Create a program with the following command line.

msiexec /i "sophos autoupdate.msi" BOOTSTRAP=NOUPDATE RMSACTION=0 REBOOT=ReallySuppress /qb

This will install the AutoUpdate agent on its own. Once installed, the agent will install the latest version of the antimalware agent from the Central Install Directory.

A final point that applies to both Sophos and Forefront endpoint protection - don't put your antimalware software in your image. Install it as a post-deployment step in your task sequence. This gives you the option to migrate between antimalware packages without the need to recreate your images.

Manually update Forefront Endpoint Protection and Client Security

Sometimes in FEP 2010 and FCS you need to force a signature update. There are two ways of doing this. Firstly, Microsoft supply a download of the latest signatures at this link

http://support.microsoft.com/kb/935934

The package you download can update both FCS and FEP 2010.

To manually start the signature update from the client software run

MpCmdRun.exe -SignatureUpdate

In FCS you should therefore run

C:\Program Files\Microsoft Forefront\Client Security\Client\Antimalware\MpCmdRun.exe -SignatureUpdate

In FEP 2010 you should run

C:\Program Files\Microsoft Security Client\Antimalware\MpCmdRun.exe -SignatureUpdate

On Windows 7 you should run MpCmdRun.exe with elevated privileges or from an elevated command prompt.

Don't forget that because the path to the executable contains spaces you'll need to use quotes if run in a Run Command Line step in a Task Sequence.