Forefront Endpoint Protection Monitoring Service

Question

Hello,
I just saw that the Forefront Endpoint Protection Monitoring Service is stoppable. I had a virus a few weeks ago on my machine at home that has security essential installed. The virus continually disabled the service. Does it make sense to control the service
via gpo to not make it stoppable even by the system and admin user?
Cheers
Sebastian
Sebastian Bammer

Answer 1

This is old discussion, but let me explain some improvements in Microsoft Anti-Malware Engine. When a program tried to disable any service, process or anything related to Windows Security or Microsoft Anti-Malware Engine , Firewall, etc. It will be detected
as a suspicious behavior and it will be blocked (no matter whether it is known malware or unknown program). In case of unknown program, you might be asked to send more details or submit it to Microsoft Malware Protection Center.
In addition, in Windows Vista and later version of Windows such as Windows 7, Windows 8.x when you have User Account Control (UAC), all programs run as an standard user unless you grand them permission as administrator. So by default, if a program tried
to disable any Security related service in Windows is unable to that because it won't run as administrator and is unable to perform something which runs as administer unless, if you are in administrator account and UAC is off or you grand administrator privilege
to the program (e.g. right click and run as administrator).
However, if you still face any programs which might try to disable services and it won't block by FEP , Microsoft Security Essentials or other Microsoft Anti-Malware products, you could submit it sample to Microsoft Malware Protection Center for more analysis.