McAfee Gold vs Complete Endpoint Protection

We are due for AV Renewal.  Looking around $15/seat for Total Endpoint Protection, or upgrade to Complete Endpoint Protection for around $30/seat.
Major differences?  Worth double the cost?  I know if comes with drive encryption which seems useful, but not sure what else.
Any reviews / use cases or anything? Ideas / recommendations?
This topic first appeared in the Spiceworks Community

Hi,
Thank you for the post.
Please try register MSI installer or clean boot your system to install FEP client.
Registered MSI Installer following the steps below:
1.Run "cmd"--Browse to the "%systemroot%\system32" directory and execute: "msiexec /regserver" 
2.Change directories to "%systemroot%\SysWow64" and execute: "msiexec /regserver" 
3.Reboot the server
http://technet.microsoft.com/en-us/library/ff823833.aspx
If there are more inquiries on this issue, please feel free to let us know.
Regards
Rick Tan
TechNet Community Support

Similar Messages

  • How Does Configuration Manager 2012 R2 Endpoint Protection Stack Up to the Competition (Bit9, Symantec, McAfee, etc.)?

    I have a client in the financial services sector that owns System Center 2012 R2 (just Operations Manager 2012 R2 deployed so far) that is being courted by Bit9 for its "superior" endpoint protection. Can anyone point me to some credible resources
    for comparing Microsoft's Endpoint Protection (component of Configuration Manager 2012 R2) to the competition (Bit9, Symantec, McAfee, etc.)?
    If Microsoft's Endpoint Protection is "good enough" (and has a credible long term product roadmap), it probably makes sense to deploy that since it has already been purchased/licensed.  Any feedback is much appreciated.
    Thanks in advance.
    Bill Thacker

    Check out this page :
    http://www.microsoft.com/security/portal/mmpc/research/awards-and-certifications.aspx
    Under "Highlight" 
    There are many awards and certification programs across the IT security industry. Detailed below are some of the most widely recognized programs and testing
    bodies.
    Benoit Lecours | Blog: System Center Dudes

  • McAfee Endpoint Protection for MAC v1.2 and NAC

    Has anyone been able to check for and enforce compliance using NAC for MAC OS X systems running this McAfee endpoint protection product?
    Thanks in advance!!
    David

    The newest product from OPSWAT, GEARS, allows you to perform endpoint compliance checks on Mac devices, as well as provides the administrator the option to detect advanced threats on the endpoints. It integrates easily in the Cisco ASA and ISE devices to provide the compliance checks on an ongoing basis. 
    You can read more about the integration/configuration steps in the attached document. 

  • Automatic Install of Endpoint Protection fails on windows 8.1 clients with SCCM 2012 R2

    Running SCCM 2012 R2 and deploying CM clients and Endpoint Protection via software updates. CM client and EP install fine on Windows 7 clients. CM client installs fine but endpoint protection fails on Windows 8.1 clients with the following from the
    endpoint protection agent log:
    <![LOG[Create Process Command line: "C:\Windows\ccmsetup\SCEPInstall.exe" /s /q /policy "C:\Windows\CCM\EPAMPolicy.xml".]LOG]!><time="12:22:02.560+240" date="08-13-2014" component="EndpointProtectionAgent"
    context="" type="1" thread="4260" file="epagentutil.cpp:607">
    <![LOG[Detail error message is : [EppSetupResult]
    HRESULT=0x80070643
    Description=Cannot complete the System Center Endpoint Protection installation. An error has prevented the System Center Endpoint Protection setup wizard from completing successfully. Please restart your computer and try again. Error code:0x80070643. Fatal
    error during installation.
    So on the win8.1 client I run the above command line manually in a command window and receive Access is denied. Then I run the same command in an elevated command window and EP installs fine. Does this have something to do with why the automatic
    EP client install fails with the 0x80070643 error code? If so, what is the fix?

    Hi,
    Try uninstalling any other security software.
    For more information, please review the link below:
    I‘m getting an error code from my Microsoft security software
    http://www.microsoft.com/security/portal/mmpc/help/errorcodes.aspx
    We
    are trying to better understand customer views on social support experience, so your participation in this
    interview project would be greatly appreciated if you have time.
    Thanks for helping make community forums a great place.

  • Upgraded SCCM 2012 SP1 to CU5 - Problem updating Endpoint Protection Client (to V4.5.216.0)

    We upgraded SCCM SP1 to CU5. We got one primary site, on which we had no problems with running the CU setup. After the upgrade we pushed the new administrator console and client.
    SP1 CU5 - console update -> Updated on all administrator users (50 computers)
    SP1 CU5- x64 and x86 client update -> Updated on pilot group (50 computers)
    No problems so far.
    We are having troubles updating the Endpoint Protection Client version. This was V4.1.522.0 before the upgrade. When we enroll a new computer, it receives the new V4.5.216.0, which is the last version.
    But we can't update our older clients. We try to deploy the software update (Update for Forefront Endpoint Protection 2010 Client - 4.5.216.0 (KB2952678)) but it doesn't install. After 20 minutes, if I look in the Deployment logs, it says the installation
    was successfull; but it isn't, it's still the old version.
    Strange thing is, we can upgrade to an inbetween version (Update for Forefront Endpoint Protection 2010 Client - 4.3.215.0 (KB2864366)). Which installs on a test client.
    If I look to the cache files of the new EP Client update, and use the UpdateInstall.exe manually, the update does install. Then I see in the logfile EndpointProtectionAgent.log it still refers to the version 4.1.522.0.
    EP 4.5.216.0 is installed, version is higher than expected installer version 4.1.522.0. EndpointProtectionAgent 13/01/2015 14:54:00 7808 (0x1E80)
    Re-apply EP AM policy. EndpointProtectionAgent 13/01/2015 14:54:00 7808 (0x1E80)
    Apply AM Policy. EndpointProtectionAgent 13/01/2015 14:54:00 7808 (0x1E80)
    Create Process Command line: "c:\Program Files\Microsoft Security Client\\ConfigSecurityPolicy.exe" "C:\Windows\CCM\EPAMPolicy.xml". EndpointProtectionAgent 13/01/2015 14:54:00 7808 (0x1E80)
    Applied the C:\Windows\CCM\EPAMPolicy.xml with ConfigSecurityPolicy.exe successfully. EndpointProtectionAgent 13/01/2015 14:54:02 7808 (0x1E80)
    Save new policy state 1 to registry SOFTWARE\Microsoft\CCM\EPAgent\PolicyApplicationState EndpointProtectionAgent 13/01/2015 14:54:02 7808 (0x1E80)
    State 1 and ErrorCode 0 and ErrorMsg and PolicyName Antimalware Policy and GroupResolveResultHash D277339FA77A9017801399D96266BAD42DE74F38 is NOT changed. EndpointProtectionAgent 13/01/2015 14:54:02 7808 (0x1E80)
    Skip sending state message due to same state message already exists. EndpointProtectionAgent 13/01/2015 14:54:02 7808 (0x1E80)
    Firewall provider is installed. EndpointProtectionAgent 13/01/2015 14:54:02 7808 (0x1E80)
    Installed firewall provider meet the requirements. EndpointProtectionAgent 13/01/2015 14:54:02 7808 (0x1E80)
    This is the WindowsUpdate.log when I try to push the new EP client.
    2015-01-14 11:24:13:651 7416 1c44 Handler :::::::::
    2015-01-14 11:24:13:651 7416 1c44 Handler : Updates to install = 1
    2015-01-14 11:24:21:716 7416 1c44 Handler : WARNING: Command line install completed. Return code = 0x8004ff25, Result = Failed, Reboot required = false
    2015-01-14 11:24:21:716 7416 1c44 Handler : WARNING: Exit code = 0x8024200B
    2015-01-14 11:24:21:716 7416 1c44 Handler :::::::::
    2015-01-14 11:24:21:716 7416 1c44 Handler :: END :: Handler: Command Line Install
    2015-01-14 11:24:21:732 7416 1c44 Handler :::::::::::::
    2015-01-14 11:24:21:794 1096 c18 Agent *********
    2015-01-14 11:24:21:794 1096 edc AU Can not perform non-interactive scan if AU is interactive-only
    2015-01-14 11:24:21:794 1096 c18 Agent ** END ** Agent: Installing updates [CallerId = CcmExec]
    2015-01-14 11:24:21:794 1096 c18 Agent *************
    2015-01-14 11:24:21:794 2296 fac COMAPI >>-- RESUMED -- COMAPI: Install [ClientId = CcmExec]
    2015-01-14 11:24:21:794 2296 fac COMAPI - Install call complete (succeeded = 0, succeeded with errors = 0, failed = 1, unaccounted = 0)
    2015-01-14 11:24:21:794 2296 fac COMAPI - Reboot required = No
    2015-01-14 11:24:21:794 2296 fac COMAPI - WARNING: Exit code = 0x00000000; Call error code = 0x80240022
    2015-01-14 11:24:21:794 2296 fac COMAPI ---------
    2015-01-14 11:24:21:794 2296 fac COMAPI -- END -- COMAPI: Install [ClientId = CcmExec]
    2015-01-14 11:24:21:794 2296 fac COMAPI -------------
    2015-01-14 11:24:21:794 1096 1620 AU Can not perform non-interactive scan if AU is interactive-only
    2015-01-14 11:24:26:739 1096 1424 Report REPORT EVENT: {ED287668-4BEF-46FD-BB57-CA17680E5D3B} 2015-01-14 11:24:21:732+0100 1 182 101 {A90C3005-7B59-4268-8B11-12D9BE5C8EA0} 201 80070643 CcmExec Failure Content Install Installation Failure: Windows failed to install the following update with error 0x80070643: Update for System Center Endpoint Protection 2012 Client - 4.5.216.0 (KB2952678).
    2015-01-14 11:24:27:207 1096 1424 Report CWERReporter::HandleEvents - WER report upload completed with status 0x8
    2015-01-14 11:24:27:207 1096 1424 Report WER Report sent: 7.5.7601.17514 0x80070643 A90C3005-7B59-4268-8B11-12D9BE5C8EA0 Install 101 Managed
    2015-01-14 11:24:27:207 1096 1424 Report CWERReporter finishing event handling. (00000000)
    Thanks in advance!

    Hello,
    According to
    kb2952678:
    To apply this update, you must have one of the following installed:
    System Center 2012 R2 Configuration Manager Cumulative Update 4 for System Center 2012
    Configuration Manager Service Pack
    Service Pack 2 for System Center Configuration Manager 2007 and Update Rollup 1 for
    Forefront Endpoint Protection 2010
    Do you have Update Rollup 1 for Forefront Endpoint Protection 2010?
    Please remember to mark the replies as answers if they help and unmark them if they provide no help. If you have feedback for TechNet Subscriber Support, contact [email protected]

  • Symantec Endpoint Protection 12.1 and Peopletools 8.53

    Hello,
    We're currently enabling virus scan for PT 8.53 with Symantec Endpoint Protection (SEP) v12. However, we are unable to configure it correctly. Our set up looks like this:
    * PS webserver is insatalled on server 1, this is where we configure the virusscan.xml file
    * SEP 12 is installed on a separate server, server 2. client and SEP manager is installed on this server.
    * OS is Windows 2008 R2 64-bit for both servers.
    May I know if  anyone here have successfully used SEP for scanning attachments?
    Unfortunately, as per oracle, only symantec scan engine was verified to work with peoplesoft, other versions are still not tested to work.
    another question is, what should be the value for the virusscan.xml parameters below?
        <Provider>
         <name>SymantecManagementClient</name>
        <class>psft.pt8.virusscan.provider.GenericVirusScanProviderImpl</class>
        <icapversion>ICAP/1.0</icapversion>
        <service-name>/SmcService</service-name>
        <policycommand>?action=SCAN</policycommand>
        <address>server2</address>
        <port>8014</port>
        <disable>false</disable>
         </Provider>
    we've mixed and matched the available service names from server 2, but we are still getting the error below:
    Sep 10, 2013 11:14:19 PM psft.pt8.virusscan.ICAPClient connectAndCheckOptions
    INFO: Input OPTIONS Header = OPTIONS icap://server2:8014/SmcService ICAP/1.0
    Sep 10, 2013 11:14:19 PM psft.pt8.virusscan.ICAPClient connectAndCheckOptions
    INFO: OPTIONS recieve header= HTTP/1.1 200 OK
    Date: Tue, 10 Sep 2013 15:14:19 GMT
    Server: Apache
    Allow: GET,HEAD,POST,OPTIONS
    Content-Length: 0
    Connection: close
    Content-Type: text/plain
    ICAP header = ICAP/1.0 200
    Sep 10, 2013 11:14:19 PM psft.pt8.virusscan.ICAPClient scanStream
    SEVERE: Unable to connect to the Scan server SymantecManagementClient; Reason = CONNECTERROR
    Sep 10, 2013 11:14:19 PM psft.pt8.virusscan.VirusScanProviderManager scanStream
    INFO:  Scanning completed using provider = SymantecManagementClient Provider classname = psft.pt8.virusscan.provider.GenericVirusScanProviderImpl
    Sep 10, 2013 11:14:19 PM psft.pt8.virusscan.VirusScanProviderManager scanStream
    INFO: Finish Scanning Request.
    port 8014 is the client communications port for SEP and its the only port that gives us a response (INFO: OPTIONS recieve header= HTTP/1.1 200 OK..etc), when we try other ports we get a "SEVERE: Unable to connect to SymantecManagementClient" message on this line.
    Hoping for your responses, thank you in adance for your help.

    Hello,
    Just to give an update. We were able to make this work but we used Symantec Protection Engine for Cloud Services instead. Also, for anyone having problems with the parameters - we used the exact same parameters listed in Peoplebooks or on the delivered virusscan.xml file, just update the IP address. We also saved the xml file on both the Portal.war and PSIGW.war directories.

  • System Center Endpoint Protection creates TEMP Folders / Reinstallation not possible

    Hi all,
    After I updated from SCCM 2012 RTM to SCCM 2012 R2 CU2 I have an issue on several Servers, which havin System Center Endpoint Protection 2012 installed (provided through SCCM Agent).
    There are hourly Temp Folders created in C:\Windows\...:
    The Temp-Folders are including SCEP 2012 Content...
     This files are filling up my System drive C:\. I always have to delte those files.
    I think System Center Endpoint Protection is trying to reinstall or update itself, and failes...
    If I try to uninstall "System Center 2012 Endpoint Protection" manually from the sever, i get the following popup (file not found):
    I cannot find the correct Version of this msi-File "fepclient.msi", so I click Cancel, and then I get the Error 0x8007064C (Cannot complete uninstall wizard).
    I have this Problem on 4 different Servers right now (FileServer, two Citrix Server, SCCM-Server).
    I tried several steps on the SCCM Server:
    - Manual Uninstall
    - Re-Installation with "scepinstall.exe" from the SCCM Client Source (same error)
    - Re-Installation from SCCM Console (Push)
    I am not getting rid of this error... I do not want to delete registry keys and testing arround because this are productive Servers... Any ideas how to resolve this one???
    If you Need more Details about the infrastructure / OS, just ask.
    Patrik

    Reinstalling the SCCM Agent did not help to get any additional log-Information.
    But I did no found a log-file in C:\ProgramData\Microsoft\Microsoft Security Client\Support\MSSecurityClient_Setup_4.5.216.0_epp_install.log
    I find the following warnings / Errors:
    TEMP Folder which is created in C:\Windows\...:
     MSI-Missing:
    But that does not really help me...

  • Endpoint Protection Client not running run scheduled scan

    Hi,
    We are running SCCM 2012 R2 CU1 on our site system and clients, having upgraded from SCCM 2012 sp1 12 months ago.
    A few of our clients will not run a scheduled scan, even though it displays the Scan date and time in the client properties. 
    Someome did create a new EP policy and pointed the clients at it, but that didn't fix this problem.
    The AV engine and AV definitions are upto date and the real time monitor is running.
    In the SCCM console, Active Clients at Risk, the client has Endpoint Protection Enabled showing as Disabled, nothing in the Endpoint Protection Engine Version, nothing for Last Full Scan Start Time, Endpoint Protection Pending Full Scan - No.
    The MPLog-xxxx-xxx.log shows:
    Signature updated on 02-11-2015 05:57:13
    Product Version: 4.7.205.0
    Service Version: 4.7.205.0
    Engine Version: 1.1.11302.0
    AS Signature Version: 1.191.4588.0
    AV Signature Version: 1.191.4588.0
    2015-02-11T05:57:15.492Z IWscAVStatus::UpdateStatus() succceeded writing instance with state (1) and up-to-date state(1)
    2015-02-11T05:57:15.492Z IWscASStatus::UpdateStatus() succceeded writing instance with state (1) and up-to-date state(1)
    2015-02-11T05:57:40.982Z Process scan (postsignatureupdatescan) started.
    2015-02-11T05:57:50.420Z Process scan (postsignatureupdatescan) completed.
    2015-02-11T06:06:47.173Z AutoPurgeWorker triggered with dwWork=0x3
    2015-02-11T06:06:47.173Z Product supports installmode: 0
    2015-02-11T06:06:47.173Z Task(Scan -ScheduleJob -RestrictPrivileges) is scheduled to run in 604800000(ms) from now with period 21957080(ms)
    2015-02-11T06:06:47.173Z Task(SignatureUpdate -ScheduleJob -RestrictPrivileges) is scheduled to run in 28800000(ms) from now with period 28800000(ms)
    2015-02-11T06:06:47.173Z Task(Scan -ScheduleJob -RestrictPrivileges -ScanType 2) is scheduled to run in 86400000(ms) from now with period 70114864(ms)
    2015-02-11T06:06:47.844Z Detection State: Finished(0) Failed(0) CriticalFailed(0) Additional Actions(0)
    The EndpointProtectionAgent.log shows:
    Endpoint is triggered by message. EndpointProtectionAgent 11/02/2015 12:12:00 2692 (0x0A84)
    File C:\WINDOWS\ccmsetup\SCEPInstall.exe version is 4.5.216.0. EndpointProtectionAgent 11/02/2015 12:12:00 2692 (0x0A84)
    EP version 4.7.205.0 is already installed. EndpointProtectionAgent 11/02/2015 12:12:00 2692 (0x0A84)
    EP 4.7.205.0 is installed, version is higher than expected installer version 4.5.216.0. EndpointProtectionAgent 11/02/2015 12:12:00 2692 (0x0A84)
    Re-apply EP AM policy. EndpointProtectionAgent 11/02/2015 12:12:00 2692 (0x0A84)
    Apply AM Policy. EndpointProtectionAgent 11/02/2015 12:12:00 2692 (0x0A84)
    Create Process Command line: "c:\Program Files\Microsoft Security Client\\ConfigSecurityPolicy.exe" "C:\WINDOWS\CCM\EPAMPolicy.xml". EndpointProtectionAgent 11/02/2015 12:12:00 2692 (0x0A84)
    Applied the C:\WINDOWS\CCM\EPAMPolicy.xml with ConfigSecurityPolicy.exe successfully. EndpointProtectionAgent 11/02/2015 12:12:01 2692 (0x0A84)
    Save new policy state 1 to registry SOFTWARE\Microsoft\CCM\EPAgent\PolicyApplicationState EndpointProtectionAgent 11/02/2015 12:12:01 2692 (0x0A84)
    State 1 and ErrorCode 0 and ErrorMsg  and PolicyName Default Client Antimalware Policy
    SCEP Standard Desktop EP Policy and GroupResolveResultHash 5E75089B490B85DD66BBA85BC91E15A5EA853B9C is NOT changed. EndpointProtectionAgent 11/02/2015 12:12:01 2692 (0x0A84)
    Skip sending state message due to same state message already exists. EndpointProtectionAgent 11/02/2015 12:12:01 2692 (0x0A84)
    Firewall provider is installed. EndpointProtectionAgent 11/02/2015 12:12:01 2692 (0x0A84)
    Installed firewall provider meet the requirements. EndpointProtectionAgent 11/02/2015 12:12:01 2692 (0x0A84)
    Could anyone provide any pointers on why the scheduled scan wont work?
    Jaz

    Hi,
    Please verify if any GPO applied and overwrite the setting, you can check registry key:
    http://blogs.technet.com/b/mspfe/archive/2013/11/13/system-center-configuration-manager-2012-scep-policy-behavior.aspx
    Please remember to mark the replies as answers if they help and unmark them if they provide no help. If you have feedback for TechNet Subscriber Support, contact [email protected]

  • Endpoint Protection not updating

    Hi all,
    Not sure if this is the right forum but I couldn't see one for Endpoint Protection
    I've been having some troubles updating EP on 2 of my 40 of so machines for a while and I can't work it out.  Basically they aren't seeing that EP updates are available to install for them.
    I've uninstalled EP and the CM client.  They re-installed fine.  The 2 machines are getting the same policies as the others.  I've deleted the Software Distribution directory, reset BITS, deleted the qr*.dat files.
    When I initiate a Software Updates scan from the Configuration Mgr client this is what appears in my WindowsUpdate.log
    2013-05-13 09:18:15:205 5704 19b8 COMAPI -------------
    2013-05-13 09:18:15:205 5704 19b8 COMAPI -- START --  COMAPI: Search [ClientId = CcmExec]
    2013-05-13 09:18:15:205 5704 19b8 COMAPI ---------
    2013-05-13 09:18:15:210  948 a04 Agent *************
    2013-05-13 09:18:15:210 5704 19b8 COMAPI <<-- SUBMITTED -- COMAPI: Search [ClientId = CcmExec]
    2013-05-13 09:18:15:210  948 a04 Agent ** START **  Agent: Finding updates [CallerId = CcmExec]
    2013-05-13 09:18:15:210  948 a04 Agent *********
    2013-05-13 09:18:15:210  948 a04 Agent   * Include potentially superseded updates
    2013-05-13 09:18:15:210  948 a04 Agent   * Online = Yes; Ignore download priority = Yes
    2013-05-13 09:18:15:210  948 a04 Agent   * Criteria = "(DeploymentAction=* AND Type='Software') OR (DeploymentAction=* AND Type='Driver')"
    2013-05-13 09:18:15:210  948 a04 Agent   * ServiceID = {3DA21691-E39D-4DA6-8A4B-B43877BCB1B7} Managed
    2013-05-13 09:18:15:210  948 a04 Agent   * Search Scope = {Machine}
    2013-05-13 09:18:15:538  948 a04 PT +++++++++++  PT: Synchronizing server updates  +++++++++++
    2013-05-13 09:18:15:538  948 a04 PT   + ServiceId = {3DA21691-E39D-4DA6-8A4B-B43877BCB1B7}, Server URL =
    HTTP://%FQDN%8530/ClientWebService/client.asmx
    2013-05-13 09:19:16:523  948 a04 Misc WARNING: SendRequest failed with hr = 80072ee2. Proxy List used: <%PROXYIP%> Bypass List used : <(null)> Auth Schemes used : <>
    2013-05-13 09:19:16:523  948 a04 PT   + Last proxy send request failed with hr = 0x80072EE2, HTTP status code = 0
    2013-05-13 09:19:16:523  948 a04 PT   + Caller provided proxy = No
    2013-05-13 09:19:16:523  948 a04 PT   + Proxy list used = %PROXYIP%
    2013-05-13 09:19:16:523  948 a04 PT   + Bypass list used = <NULL>
    2013-05-13 09:19:16:523  948 a04 PT   + Caller provided credentials = No
    2013-05-13 09:19:16:523  948 a04 PT   + Impersonate flags = 0
    2013-05-13 09:19:16:523  948 a04 PT   + Possible authorization schemes used =
    2013-05-13 09:19:16:523  948 a04 PT WARNING: GetConfig failure, error = 0x80072EE2, soap client error = 5, soap error code = 0, HTTP status code = 200
    2013-05-13 09:19:16:524  948 a04 PT WARNING: PTError: 0x80072ee2
    2013-05-13 09:19:16:524  948 a04 PT WARNING: GetConfig_WithRecovery failed: 0x80072ee2
    2013-05-13 09:19:16:524  948 a04 PT WARNING: RefreshConfig failed: 0x80072ee2
    2013-05-13 09:19:16:524  948 a04 PT WARNING: RefreshPTState failed: 0x80072ee2
    2013-05-13 09:19:16:524  948 a04 PT WARNING: Sync of Updates: 0x80072ee2
    2013-05-13 09:19:16:524  948 a04 PT WARNING: SyncServerUpdatesInternal failed: 0x80072ee2
    2013-05-13 09:19:16:524  948 a04 Agent   * WARNING: Failed to synchronize, error = 0x80072EE2
    2013-05-13 09:19:16:525  948 a04 Agent   * WARNING: Exit code = 0x80072EE2
    2013-05-13 09:19:16:525  948 a04 Agent *********
    2013-05-13 09:19:16:525  948 a04 Agent **  END  **  Agent: Finding updates [CallerId = CcmExec]
    2013-05-13 09:19:16:525  948 a04 Agent *************
    2013-05-13 09:19:16:525  948 a04 Agent WARNING: WU client failed Searching for update with error 0x80072ee2
    2013-05-13 09:19:16:526 5704 19b8 COMAPI >>--  RESUMED  -- COMAPI: Search [ClientId = CcmExec]
    2013-05-13 09:19:16:527 5704 19b8 COMAPI   - Updates found = 0
    2013-05-13 09:19:16:527 5704 19b8 COMAPI   - WARNING: Exit code = 0x00000000, Result code = 0x80072EE2
    2013-05-13 09:19:16:527 5704 19b8 COMAPI ---------
    2013-05-13 09:19:16:527 5704 19b8 COMAPI --  END  --  COMAPI: Search [ClientId = CcmExec]
    2013-05-13 09:19:16:527 5704 19b8 COMAPI -------------
    2013-05-13 09:19:16:527 5704 19b8 COMAPI WARNING: Operation failed due to earlier error, hr=80072EE2
    2013-05-13 09:19:16:527 5704 19b8 COMAPI FATAL: Unable to complete asynchronous search. (hr=80072EE2)
    2013-05-13 09:19:21:526  948 a04 Report REPORT EVENT: {4F1FD932-6FB2-4909-BB14-B58ECB839A4B} 2013-05-13 09:19:16:524+1000 1 148 101 {00000000-0000-0000-0000-000000000000} 0 80072ee2 CcmExec Failure Software
    Synchronization Windows Update Client failed to detect with error 0x80072ee2.
    2013-05-13 09:19:21:543  948 a04 Report CWERReporter::HandleEvents - WER report upload completed with status 0x8
    2013-05-13 09:19:21:543  948 a04 Report WER Report sent: 7.6.7600.256 0x80072ee2 00000000-0000-0000-0000-000000000000 Scan 101 Managed
    2013-05-13 09:19:21:543  948 a04 Report CWERReporter finishing event handling. (00000000)
    From my research this indicates to me that these computers are trying to access the internet to perform their updates.  They should be going to Config Mgr as specified in the policy and then WSUS (MS Updates is not selected in my policy).  These
    machines do not have internet access.  The machines that are updating correctly also don't have internet access
    Below is the WUAHandler.log
    Its a WSUS Update Source type ({E6405AF2-4712-4848-8E46-A6AFF1872B0A}), adding it. WUAHandler 13/05/2013 9:18:15 AM 6584 (0x19B8)
    Existing WUA Managed server was already set (%FQDN%:8530), skipping Group Policy registration. WUAHandler 13/05/2013 9:18:15 AM 6584 (0x19B8)
    Added Update Source ({E6405AF2-4712-4848-8E46-A6AFF1872B0A}) of content type: 2 WUAHandler 13/05/2013 9:18:15 AM 6584 (0x19B8)
    Scan results will include superseded updates only when they are superseded by service packs and definition updates. WUAHandler 13/05/2013 9:18:15 AM 6584 (0x19B8)
    Search Criteria is (DeploymentAction=* AND Type='Software') OR (DeploymentAction=* AND Type='Driver') WUAHandler 13/05/2013 9:18:15 AM 6584 (0x19B8)
    Async searching of updates using WUAgent started. WUAHandler 13/05/2013 9:18:15 AM 6584 (0x19B8)
    Async searching completed. WUAHandler 13/05/2013 9:19:16 AM 5152 (0x1420)
    OnSearchComplete - Failed to end search job. Error = 0x80072ee2. WUAHandler 13/05/2013 9:19:16 AM 6584 (0x19B8)
    Scan failed with error = 0x80072ee2. WUAHandler 13/05/2013 9:19:16 AM 6584 (0x19B8)
    Any help would be awesome
    Thanks

    Thanks for the reply.
    It shouldn't be a proxy issue as the computers aren't configured to use a proxy.  Nothing is ticked in IE settings about connecting to the Internet and the netsh winhttp show proxy gives me a direct connection
    Nothing in bypass list as well
    I check these settings on a machine that is working and the settings are the same
    I looked in the scanagent.log and got this
    - -Processing Scan Job TTL invalidity request ScanAgent 16/05/2013 3:02:17 PM 4376 (0x1118)
    Message received: '<?xml version='1.0' ?> <UpdateSourceMessage MessageType='ScanByUpdateSource'>
      <ForceScan>TRUE</ForceScan>
      <UpdateSourceIDs>
       <ID>{E6405AF2-4712-4848-8E46-A6AFF1872B0A}   </ID>
      </UpdateSourceIDs>
     </UpdateSourceMessage>'
     ScanAgent 16/05/2013 3:02:19 PM 5348 (0x14E4)
    *****ScanByUpdateSource request received with ForceReScan=2, ScanOptions=0x0000000a,  WSUSLocationTimeout = 604800 ScanAgent 16/05/2013 3:02:19 PM 5348 (0x14E4)
    Sources are not current ScanAgent 16/05/2013 3:02:19 PM 5348 (0x14E4)
    ScanJob({9B789A83-3229-4658-99E4-0FD797B48AB0}): - - - - - -Locations requested for ScanJobID={9B789A83-3229-4658-99E4-0FD797B48AB0} (LocationRequestID={5D090B44-18AC-4153-AEB4-55CE285A7CD1}), will process the scan request once locations are available. ScanAgent 16/05/2013
    3:02:19 PM 5348 (0x14E4)
    *****WSUSLocationUpdate received for location request guid={5D090B44-18AC-4153-AEB4-55CE285A7CD1} ScanAgent 16/05/2013 3:02:19 PM 5348 (0x14E4)
    Sources are not current ScanAgent 16/05/2013 3:02:19 PM 3680 (0x0E60)
    ScanJob({9B789A83-3229-4658-99E4-0FD797B48AB0}): CScanJob::OnScanComplete -Scan Failed with Error=0x80244019 ScanAgent 16/05/2013 3:02:19 PM 5348 (0x14E4)
    ScanJob({9B789A83-3229-4658-99E4-0FD797B48AB0}): CScanJob::ScheduleScanRetry- ScanRetry Timer task successfully scheduled. Will wake up in next 1800 seconds ScanAgent 16/05/2013 3:02:19 PM 5348 (0x14E4)
    ScanJob({9B789A83-3229-4658-99E4-0FD797B48AB0}): CScanJob::OnScanComplete - Scan Retry successfully scheduled ScanAgent 16/05/2013 3:02:19 PM 5348 (0x14E4)
    ScanJob({9B789A83-3229-4658-99E4-0FD797B48AB0}): CScanJobManager::OnScanComplete- Scan has failed, scan request will be pending for scan retry cycle. ScanAgent 16/05/2013 3:02:20 PM 5348 (0x14E4)
    CScanAgent::ScanCompleteCallback - failed at OnScanComplete with error=0x87d00631 ScanAgent 16/05/2013 3:02:20 PM 5348 (0x14E4)
    Doesn't make any sense to me
    I can use IE to hit the wsus/sccm server (roles installed on same machine).  It will prompt me to download or save the *.cab files as well.

  • Endpoint Protection clients no getting updates from SCCM 2012 in new Secondary Site

    I recently stood up a secondary site behind a PCI firewall to manage PCI in-scope systems. All of my boundaries are properly configured and there are no overlaps. I am able to push packages to these clients and the clients are reporting as healthy however
    I am not able to get updates to the SCEP clients. There is no internet access from these systems so I have to rely on updates from SCCM. From what I can see in the WindowsUpdate log it is only trying to go to Microsoft for the definitions. Here is the Log:
    2014-04-30 11:05:09:739
     828 da8
    Misc WARNING: Send failed with hr = 80072ee2.
    2014-04-30 11:05:09:739
     828 da8
    Misc WARNING: Proxy List used: <(null)> Bypass List used : <(null)> Auth Schemes used : <None>
    2014-04-30 11:05:09:739
     828 da8
    Misc WARNING: Send request failed, hr:0x80072ee2
    2014-04-30 11:05:09:739
     828 da8
    Misc WARNING: WinHttp: SendRequestUsingProxy failed for <HTTPS://sls.update.microsoft.com/SLS/{9482F4B4-E343-43B6-B170-9A65BC822C77}/x64/6.3.9600.0/0?CH=41&L=en-US&P=&PT=0x7&WUA=7.9.9600.16422>.
    error 0x80072ee2
    2014-04-30 11:05:09:739
     828 da8
    Misc WARNING: WinHttp: SendRequestToServerForFileInformation MakeRequest failed. error 0x80072ee2
    2014-04-30 11:05:09:739
     828 da8
    Misc WARNING: WinHttp: SendRequestToServerForFileInformation failed with 0x80072ee2
    2014-04-30 11:05:09:739
     828 da8
    Misc WARNING: WinHttp: ShouldFileBeDownloaded failed with 0x80072ee2
    2014-04-30 11:05:09:739
     828 da8
    SLS FATAL: GetResponse failed with hresult 0x80072ee2...
    2014-04-30 11:05:09:739
     828 da8
    EP FATAL: EP: CSLSEndpointProvider::GetWUClientDataAndInitParser - failed to get SLS data, error = 0x80072EE2
    2014-04-30 11:05:09:739
     828 da8
    EP FATAL: EP: CSLSEndpointProvider::GetEndpointFromSLS - Failed to get client data and init parser, error = 0x80072EE2
    2014-04-30 11:05:09:739
     828 da8
    EP FATAL: Failed to obtain 9482F4B4-E343-43B6-B170-9A65BC822C77 redir SecondaryServiceAuth URL, error = 0x80072EE2
    2014-04-30 11:05:09:739
     828 da8
    Agent WARNING: Failed to obtain the authorization cab URL for service 7971f918-a847-4430-9279-4a52d1efe18d, hr=0
    2014-04-30 11:05:09:739
     828 da8
    Agent FATAL: Caller <NULL> failed to opt in to service 7971f918-a847-4430-9279-4a52d1efe18d, hr=0X80072EE2
    2014-04-30 11:05:09:739
     828 da8
    SLS Retrieving SLS response from server...
    2014-04-30 11:05:09:739
     828 da8
    SLS Making request with URL HTTPS://sls.update.microsoft.com/SLS/{9482F4B4-E343-43B6-B170-9A65BC822C77}/x64/6.3.9600.0/0?CH=41&L=en-US&P=&PT=0x7&WUA=7.9.9600.16422
    2014-04-30 11:05:30:742
     828 da8
    Misc WARNING: Send failed with hr = 80072ee2.
    2014-04-30 11:05:30:742
     828 da8
    Misc WARNING: Proxy List used: <(null)> Bypass List used : <(null)> Auth Schemes used : <None>
    2014-04-30 11:05:30:742
     828 da8
    Misc WARNING: Send request failed, hr:0x80072ee2
    2014-04-30 11:05:30:742
     828 da8
    Misc WARNING: WinHttp: SendRequestUsingProxy failed for <HTTPS://sls.update.microsoft.com/SLS/{9482F4B4-E343-43B6-B170-9A65BC822C77}/x64/6.3.9600.0/0?CH=41&L=en-US&P=&PT=0x7&WUA=7.9.9600.16422>.
    error 0x80072ee2
    2014-04-30 11:05:30:742
     828 da8
    Misc WARNING: WinHttp: SendRequestToServerForFileInformation MakeRequest failed. error 0x80072ee2
    2014-04-30 11:05:30:742
     828 da8
    Misc WARNING: WinHttp: SendRequestToServerForFileInformation failed with 0x80072ee2
    2014-04-30 11:05:30:742
     828 da8
    Misc WARNING: WinHttp: ShouldFileBeDownloaded failed with 0x80072ee2
    2014-04-30 11:05:30:742
     828 da8
    SLS FATAL: GetResponse failed with hresult 0x80072ee2...
    2014-04-30 11:05:30:742
     828 da8
    EP FATAL: EP: CSLSEndpointProvider::GetWUClientDataAndInitParser - failed to get SLS data, error = 0x80072EE2
    2014-04-30 11:05:30:742
     828 da8
    EP FATAL: EP: CSLSEndpointProvider::GetSecondaryServicesEnabledState - Failed to get client data and init parser, error = 0x80072EE2
    2014-04-30 11:05:30:742
     828 da8
    Agent   * WARNING: Online service registration/service ID resolution failed, hr=0x80248014
    2014-04-30 11:05:30:742
     828 da8
    Agent   * WARNING: Exit code = 0x80248014
    2014-04-30 11:05:30:742
     828 da8
    Agent *********
    2014-04-30 11:05:30:742
     828 da8
    Agent **  END  **  Agent: Finding updates [CallerId = System Center Endpoint Protection (DDEFDD14-250E-4DC8-A0B3-9D667EC5D8EB)  Id = 9]
    2014-04-30 11:05:30:742
     828 da8
    Agent *************
    2014-04-30 11:05:30:742
     828 da8
    Agent WARNING: WU client failed Searching for update with error 0x80248014
    2014-04-30 11:05:30:742
     828 da8
    IdleTmr WU operation (CSearchCall::Init ID 9, operation # 99) stopped; does use network; is not at background priority
    2014-04-30 11:05:30:742
     828 da8
    IdleTmr Decremented PDC RefCount for Network to 0
    2014-04-30 11:05:30:742
     828 da8
    IdleTmr Decremented idle timer priority operation counter to 0
    2014-04-30 11:05:30:743
     576 12c0
    COMAPI >>--  RESUMED  -- COMAPI: Search [ClientId = System Center Endpoint Protection (DDEFDD14-250E-4DC8-A0B3-9D667EC5D8EB)]
    2014-04-30 11:05:30:743
     576 12c0
    COMAPI   - Updates found = 0
    2014-04-30 11:05:30:743
     576 12c0
    COMAPI   - WARNING: Exit code = 0x00000000, Result code = 0x80248014
    2014-04-30 11:05:30:743
     576 12c0
    COMAPI ---------
    2014-04-30 11:05:30:743
     576 12c0
    COMAPI --  END  --  COMAPI: Search [ClientId = System Center Endpoint Protection (DDEFDD14-250E-4DC8-A0B3-9D667EC5D8EB)]
    2014-04-30 11:05:30:743
     576 12c0
    COMAPI -------------
    2014-04-30 11:05:30:743
     576 1254
    COMAPI WARNING: Operation failed due to earlier error, hr=80248014
    2014-04-30 11:05:30:743
     576 1254
    COMAPI FATAL: Unable to complete asynchronous search. (hr=80248014)
    The log is from a Server 2012 R2 Client. The only thing I was able to find was this Article which did not resolve my issue. Anyone else encounter anything similar? Any help would be appreciated.
    Regards, Evan Mills - Systems Administrator

    Every two hours is too aggressive for the ADR. Definitions are only released 2-3 times a day so every 8 hours is what most consider best practice. Is your WSUS sync occurring every two hours as well? If not, then the ADR wouldn't have anything new to pick
    up anyway. It's best to set the WSUS sync for every 8 hours and then set the ADR to run after any successful WSUS sync.
    So the EP definitions are caching but not installing? What does the WUAHandler.log show? One of my machines shows the following which indicates a successful installation from the ConfigMgr delivered update:
    1. Update (Missing): Definition Update for Microsoft Endpoint Protection - KB2461484 (Definition 1.173.933.0) (0a156122-d4f8-4215-9e63-8f0f1e32c9c6, 200)    WUAHandler    4/30/2014 6:49:33 AM    11080 (0x2B48)
    Async installation of updates started.    WUAHandler    4/30/2014 6:49:34 AM    11080 (0x2B48)
    Update 1 (0a156122-d4f8-4215-9e63-8f0f1e32c9c6) finished installing (0x00000000), Reboot Required? No    WUAHandler    4/30/2014 6:50:23 AM    8664 (0x21D8)
    Async install completed.    WUAHandler    4/30/2014 6:50:23 AM    8664 (0x21D8)
    Installation of updates completed.    WUAHandler    4/30/2014 6:50:23 AM    11032 (0x2B18)
    It sounds like if you set "Check for Endpoint Protection definitions at a specific interval" to 0 then it would prevent the WindowsUpdate.log activity you're seeing when the EP client tries to reach out for updates.

  • Symantec endpoint protection will not open hidden.  mavericks 10.9.4

    Symantec endpoint protection will not open hidden.  i have the hide on opening box checked in login options.
    Please help.
    thnaks

    doctorjay wrote:
    Symantec endpoint protection will not open hidden.  i have the hide on opening box checked in login options.
    Please help.
    thnaks
    If you are (ugh!) referring to Symantec's Anti-Virus software for the Mac, this when installed runs behind the scenes and does not require the application to be open all the time. Therefore the solution might be to not run it at login at all. That will certainly 'hide' it.
    [Why don't Apple have an emoticon for retching? I don't know which is worse Symantec or McAfee.]
    Typically you just get a small symbol in the menu bar near the clock to show it is installed and active. This certainly was the case when I was unfortunately required to use it at one organisation, it is also true for most if not all other makes, e.g Sophos.

  • Technical Preview Compatibility with Endpoint protection

    I've been running the technical preview for enterprise for some time now. I was under the impression that it was going to be compatible with existing client management (SCCM 2012 R2)? Anyways it seems that the System Center Endpoint Protection client
    is not completely compatible. It runs and appears to operate fine, however, when attempting to apply the October update for the Endpoint protection client I receive errors. The update fails in Software Center with the WUAHandler log showing:
    Installation job encountered some failures. Error = 0x80240022. WUAHandler 2014-11-13 8:32:19 AM 8696 (0x21F8)
    I then attempted to manually install the update from ccmcache and I see the following error:
    I'm hoping this gets fixed soon, it seems I'm still getting definition updates, but with the absence of the System Center v. Next Configuration manager/ Endpoint protection availability, it would be nice to keep the existing software up to date.
    If I answered your question, please Click "Mark as Answer". If you found my post helpful, feel free to Vote as helpful on the left. This posting is provided "AS IS" with no warranties, and confers no rights

    As this is Technical Preview System Center Endpoint Protection and other Anti-Malware products are not compatible with this release. For now, you may relay on Windows Defender which build into Windows 10 TP and has the same definition update as SCEP.

  • SCEP 2012R2 downloading Endpoint Protection definitions from Microsoft, rather than using internal Distribution Point

    Hi all, 
    Need your help figuring out why SCEP definitions are being updated from Microsoft and not from the local DP. 
    * I have a new 5 site SCCM hierarchy with a Primary site installed in EMEA HQ and a secondary site in 4 x USA offices. 
    * A Software update point and Endpoint protection point are deployed in HQ primary site. 
    * Software updates for SCEP have been synched down to the Primary site server which has WSUS role installed, a software update group created and an Automatic Deployment rule created to push these definition updates to the relevant device collection. 
    * Distribution > Content Status shows the software update package has been replicated successfully to all 5 DP's in the environment. 
    * An antimalware policy that specifies only SCCM as the definition updates has been created and is deployed to the relevant device collection. 
    * Custom client settings that disable alternate sources for initial definition update have also been created and deployed to the relevant device collection. 
    **** Yet, a closer look at the MPRUNCMD.log on client machines, shows that definition updates are coming from Microsoft
    I'm baffled why they still download from Microsoft despite disallowing this and making the DP the only source. 
    MpCmdRun: Command Line: "c:\Program Files\Microsoft Security Client\MpCmdRun.exe" SignaturesUpdateService -UnmanagedUpdate
     Start Time: ‎Mon ‎Apr ‎27 ‎2015 07:28:02
    Start: Signatures Update Service
    Update Started
    Search Started (MU/WU update) (Path: http://www.microsoft.com)...
    Time Info - ‎Mon ‎Apr ‎27 ‎2015 07:28:55 Search Completed 
    Update completed succesfully. no updates needed
    End: Signatures Update Service
    MpCmdRun: End Time: ‎Mon ‎Apr ‎27 ‎2015 07:28:55
    Note - One of the secondary sites has a very poor internet connection, so it's not feasible for definitions to be downloaded from the web. This is why a solution is required. 
    Thanks....

    Hi,
    Could these clients get other updates from SCCM?
    You could check the HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\CCM\EPAgent\LastAppliedPolicy to see if the definition updates policy is applied to the client.
    Best Regards,
    Joyce
    Please remember to mark the replies as answers if they help and unmark them if they provide no help. If you have feedback for TechNet Subscriber Support, contact [email protected]

  • Endpoint Protection Signature Updates taking up Terabytes of Internet Data

    I have my antimalware policy set up as below. I've been looking a web traffic reports on our firewalls and I can see that as of mid-December a lot of clients are going to the internet for their EP definition updates. In January alone client machines used
    up 44 TB of data going to download.windowsupdate.com for updates.
    I don't really understand why as my policy says not to even use Microsoft Update as a source at all.
    What I've noticed on the firewall reports is that Monday resulted in literally 100 times more traffic than Wednesday which led to me thinking it might having something to do with the "If configuration manager is used as a source for definition updates
    ...." setting. This setting has a default value of 72 hours so if a client gets an update at 8 am on Friday morning then is turned off on Friday afternoon for the weekend and doesn't get turned on until 9 am on Monday morning this would mean it hasn't
    had an update in 73 hours.
    What happens at this point? I looks like the client goes to download.windowsupdate.com even when the policy says not to. It also looks like it doesn't first check for updates from Config Manager before it does this.
    Another thing that doesn't make much sense is that this only started happening mid-December and I had been using SCCM for EP updates for nearly two months by that time.
    Any ideas?
    Hibs Ya Bass!

    There is no value in that registry key.
    HHowever I have noticed that my ADRs have the below setting. I'm not sure what will happen with this setting enabled when I have no fallback locations configured.
    Here are some logs of a typical PC going to the internet for updates - remember not all PCs are doing this.
    From the mplogxxxx.log below you can see the EP client starting up at 23:50 UTC with version 1.67.1843.0 signatures installed. This version is out of date.
    **************************END RTP Perf Log*************************
    2014-03-16T23:50:33.339Z Verifying license file...
    2014-03-16T23:50:33.339Z verified!
    2014-03-16T23:50:33.339Z Product supports installmode: 0
    2014-03-16T23:50:33.620Z Auto purger task is scheduled to run in 600000(ms) from now with period 86400000(ms)
    Product Version: 4.4.304.0
    Service Version: 4.4.304.0
    Engine Version: 1.1.10302.0
    AS Signature Version: 1.167.1843.0
    AV Signature Version: 1.167.1843.0
    2014-03-16T23:51:24.971Z Process scan (poststartupscan) started.
    2014-03-16T23:51:26.572Z Process scan (poststartupscan) completed.
    2014-03-16T23:53:05.128Z IWscAVStatus::UpdateStatus() succceeded writing instance with state (1) and up-to-date state(1)
    2014-03-16T23:53:05.128Z IWscASStatus::UpdateStatus() succceeded writing instance with state (1) and up-to-date state(1)
    2014-03-16T23:57:58.214Z Task(SpyNetService -RestrictPrivileges -AccessKey 613C3C1F-F85A-BCED-39AF-C0B481FC03E0) launched
    2014-03-17T00:00:31.917Z Task(Scan -ScheduleJob -RestrictPrivileges) is scheduled to run in 604800000(ms) from now with period 190246545(ms)
    2014-03-17T00:00:31.917Z Task(SignatureUpdate -ScheduleJob -RestrictPrivileges) is scheduled to run in 86400000(ms) from now with period 1454570(ms)
    2014-03-17T00:00:31.918Z Task(Scan -ScheduleJob -RestrictPrivileges -ScanType 2) is scheduled to run in 86400000(ms) from now with period 65506808(ms)
    2014-03-17T00:00:32.197Z AutoPurgeWorker triggered with dwWork=0x3
    2014-03-17T00:00:32.197Z Product supports installmode: 0
    ==========================================================================
    A few minutes later at 23:55 (07:53 local time) the below happens in the WindowsUpdate.log where you can clearly see the client downloading the latest signatures from download.windowsupsate.com (i've removed some of the rows where the WU engine goes through
    all the updates to get under the 60,000 character limit)
    ================================================================
    2014-03-17    07:53:03:403     452    1398    Misc    ===========  Logging initialized (build: 7.6.7600.256, tz: +0800)  ===========
    2014-03-17    07:53:03:465     452    1398    Misc      = Process: C:\windows\system32\svchost.exe
    2014-03-17    07:53:03:480     452    1398    Misc      = Module: c:\windows\system32\wuaueng.dll
    2014-03-17    07:53:03:403     452    1398    Service    *************
    2014-03-17    07:53:03:480     452    1398    Service    ** START **  Service: Service startup
    2014-03-17    07:53:03:480     452    1398    Service    *********
    2014-03-17    07:53:04:351     452    1398    Agent      * WU client version 7.6.7600.256
    2014-03-17    07:53:04:351     452    1398    Agent      * Base directory: C:\windows\SoftwareDistribution
    2014-03-17    07:53:04:351     452    1398    Agent      * Access type: No proxy
    2014-03-17    07:53:04:366     452    1398    Agent      * Network state: Connected
    2014-03-17    07:53:17:688     452    bf4    Report    CWERReporter::Init succeeded
    2014-03-17    07:53:17:688     452    bf4    Agent    ***********  Agent: Initializing Windows Update Agent  ***********
    2014-03-17    07:53:17:688     452    bf4    Agent    ***********  Agent: Initializing global settings cache  ***********
    2014-03-17    07:53:17:688     452    bf4    Agent      * WSUS server: HTTP://mySiteServer.domain.GLOBAL:8530
    2014-03-17    07:53:17:688     452    bf4    Agent      * WSUS status server: HTTP://mySiteServer.domain.GLOBAL:8530
    2014-03-17    07:53:17:688     452    bf4    Agent      * Target group: (Unassigned Computers)
    2014-03-17    07:53:17:688     452    bf4    Agent      * Windows Update access disabled: No
    2014-03-17    07:53:17:719     452    bf4    DnldMgr    Download manager restoring 0 downloads
    2014-03-17    07:53:18:045     452    1398    Report    ***********  Report: Initializing static reporting data  ***********
    2014-03-17    07:53:18:045     452    1398    Report      * OS Version = 6.1.7601.1.0.65792
    2014-03-17    07:53:18:045     452    1398    Report      * OS Product Type = 0x00000004
    2014-03-17    07:53:18:061     452    1398    Report      * Computer Brand = Hewlett-Packard
    2014-03-17    07:53:18:061     452    1398    Report      * Computer Model = HP Z210 Workstation
    2014-03-17    07:53:18:061     452    1398    Report      * Bios Revision = J51 v01.20
    2014-03-17    07:53:18:061     452    1398    Report      * Bios Name = Default System BIOS
    2014-03-17    07:53:18:061     452    1398    Report      * Bios Release Date = 2011-09-16T00:00:00
    2014-03-17    07:53:18:061     452    1398    Report      * Locale ID = 3081
    2014-03-17    07:53:23:144     452    9fc    Report    CWERReporter finishing event handling. (00000000)
    2014-03-17    07:53:23:362    4672    a50    Misc    ===========  Logging initialized (build: 7.6.7600.256, tz: +0800)  ===========
    2014-03-17    07:53:23:362    4672    a50    Misc      = Process: C:\windows\CCM\CcmExec.exe
    2014-03-17    07:53:23:362    4672    a50    Misc      = Module: C:\Windows\system32\wuapi.dll
    2014-03-17    07:53:23:362    4672    a50    COMAPI    -------------
    2014-03-17    07:53:23:362    4672    a50    COMAPI    -- START --  COMAPI: Search [ClientId = CcmExec]
    2014-03-17    07:53:23:362    4672    a50    COMAPI    ---------
    2014-03-17    07:53:23:470     452    9fc    Agent    *************
    2014-03-17    07:53:23:470     452    9fc    Agent    ** START **  Agent: Finding updates [CallerId = CcmExec]
    2014-03-17    07:53:23:470     452    9fc    Agent    *********
    2014-03-17    07:53:23:470    4672    a50    COMAPI    <<-- SUBMITTED -- COMAPI: Search [ClientId = CcmExec]
    2014-03-17    07:53:23:470     452    9fc    Agent      * Include potentially superseded updates
    2014-03-17    07:53:23:470     452    9fc    Agent      * Online = No; Ignore download priority = Yes
    2014-03-17    07:53:23:470     452    9fc    Agent      * Criteria = "((DeploymentAction=* AND Type='Software' AND CategoryIDs contains 'E6CF1350-C01B-414D-A61F-263D14D133B4'))"
    2014-03-17    07:53:23:470     452    9fc    Agent      * ServiceID = {3DA21691-E39D-4DA6-8A4B-B43877BCB1B7} Managed
    2014-03-17    07:53:23:470     452    9fc    Agent      * Search Scope = {Machine}
    2014-03-17    07:53:50:191     452    1398    AU    ###########  AU: Initializing Automatic Updates  ###########
    2014-03-17    07:53:50:378     452    1398    AU    AU setting next sqm report timeout to 2014-03-16 23:53:50
    2014-03-17    07:53:50:378     452    1398    AU      # AU disabled through Policy
    2014-03-17    07:53:50:378     452    1398    AU      # Will interact with non-admins (Non-admins are elevated (User preference))
    2014-03-17    07:53:50:409     452    1398    AU    Initializing featured updates
    2014-03-17    07:53:50:409     452    1398    AU    Found 0 cached featured updates
    2014-03-17    07:53:50:409     452    1398    AU    Successfully wrote event for AU health state:0
    2014-03-17    07:53:50:409     452    1398    AU    Successfully wrote event for AU health state:0
    2014-03-17    07:53:50:409     452    1398    AU    AU finished delayed initialization
    2014-03-17    07:53:50:409     452    1398    AU    AU setting next sqm report timeout to 2014-03-17 23:53:50
    2014-03-17    07:55:40:569     452    9fc    Agent    *************
    2014-03-17    07:55:40:591     452    9fc    Report    CWERReporter finishing event handling. (00000000)
    2014-03-17    07:55:40:592    4672    e6c    COMAPI    >>--  RESUMED  -- COMAPI: Search [ClientId = CcmExec]
    2014-03-17    07:55:40:936    4672    e6c    COMAPI      - Updates found = 96
    2014-03-17    07:55:40:936    4672    e6c    COMAPI    ---------
    2014-03-17    07:55:40:936    4672    e6c    COMAPI    --  END  --  COMAPI: Search [ClientId = CcmExec]
    2014-03-17    07:55:40:936    4672    e6c    COMAPI    -------------
    2014-03-17    07:56:38:889    4672    1534    COMAPI    -------------
    2014-03-17    07:56:38:889    4672    1534    COMAPI    -- START --  COMAPI: Search [ClientId = CcmExec]
    2014-03-17    07:56:38:889    4672    1534    COMAPI    ---------
    2014-03-17    07:56:38:891     452    9fc    Agent    *************
    2014-03-17    07:56:38:891     452    9fc    Agent    ** START **  Agent: Finding updates [CallerId = CcmExec]
    2014-03-17    07:56:38:891     452    9fc    Agent    *********
    2014-03-17    07:56:38:891    4672    1534    COMAPI    <<-- SUBMITTED -- COMAPI: Search [ClientId = CcmExec]
    2014-03-17    07:56:38:891     452    9fc    Agent      * Include potentially superseded updates
    2014-03-17    07:56:38:891     452    9fc    Agent      * Online = No; Ignore download priority = Yes
    2014-03-17    07:56:38:891     452    9fc    Agent      * Criteria = "((DeploymentAction=* AND Type='Software' AND CategoryIDs contains 'E6CF1350-C01B-414D-A61F-263D14D133B4'))"
    2014-03-17    07:56:38:891     452    9fc    Agent      * ServiceID = {3DA21691-E39D-4DA6-8A4B-B43877BCB1B7} Managed
    2014-03-17    07:56:38:891     452    9fc    Agent      * Search Scope = {Machine}
    279C58FA-1C7C-41B2-81F5-F9D92DD1D8E6}.200 to search result
    2014-03-17    07:56:46:433     452    9fc    Agent      * Added update {B1D0B8FF-1023-438F-BE07-CD893F229A68}.200 to search result
    2014-03-17    07:56:46:462     452    9fc    Agent      * Found 96 updates and 10 categories in search; evaluated appl. rules of 1952 out of 3516 deployed entities
    2014-03-17    07:56:46:463     452    9fc    Agent    *********
    2014-03-17    07:56:46:463     452    9fc    Agent    **  END  **  Agent: Finding updates [CallerId = CcmExec]
    2014-03-17    07:56:46:463     452    9fc    Agent    *************
    2014-03-17    07:56:46:488    4672    a34    COMAPI    >>--  RESUMED  -- COMAPI: Search [ClientId = CcmExec]
    2014-03-17    07:56:46:515    4672    a34    COMAPI      - Updates found = 96
    2014-03-17    07:56:46:515    4672    a34    COMAPI    ---------
    2014-03-17    07:56:46:515    4672    a34    COMAPI    --  END  --  COMAPI: Search [ClientId = CcmExec]
    2014-03-17    07:56:46:515    4672    a34    COMAPI    -------------
    2014-03-17    07:59:28:666    4672    1ba0    COMAPI    -------------
    2014-03-17    07:59:28:666    4672    1ba0    COMAPI    -- START --  COMAPI: Search [ClientId = CcmExec]
    2014-03-17    07:59:28:666    4672    1ba0    COMAPI    ---------
    2014-03-17    07:59:28:668    4672    1ba0    COMAPI    <<-- SUBMITTED -- COMAPI: Search [ClientId = CcmExec]
    2014-03-17    07:59:28:668     452    9fc    Agent    *************
    2014-03-17    07:59:28:668     452    9fc    Agent    ** START **  Agent: Finding updates [CallerId = CcmExec]
    2014-03-17    07:59:28:668     452    9fc    Agent    *********
    2014-03-17    07:59:28:668     452    9fc    Agent      * Include potentially superseded updates
    2014-03-17    07:59:28:668     452    9fc    Agent      * Online = Yes; Ignore download priority = Yes
    2014-03-17    07:59:28:668     452    9fc    Agent      * Criteria = "((DeploymentAction=* AND Type='Software' AND CategoryIDs contains 'A38C835C-2950-4E87-86CC-6911A52C34A3'))"
    2014-03-17    07:59:28:668     452    9fc    Agent      * ServiceID = {3DA21691-E39D-4DA6-8A4B-B43877BCB1B7} Managed
    2014-03-17    07:59:28:668     452    9fc    Agent      * Search Scope = {Machine}
    2014-03-17    07:59:28:755     452    9fc    PT    WARNING: Cached cookie has expired or new PID is available
    2014-03-17    07:59:28:755     452    9fc    PT    Initializing simple targeting cookie, clientId = 553c311c-66c6-4896-a549-521f549398a5, target group = , DNS name = mySiteServer.domain.global
    2014-03-17    07:59:28:755     452    9fc    PT      Server URL = HTTP://mySiteServer.domain.GLOBAL:8530/SimpleAuthWebService/SimpleAuth.asmx
    2014-03-17    07:59:29:227     452    9fc    PT    +++++++++++  PT: Starting category scan  +++++++++++
    2014-03-17    07:59:29:227     452    9fc    PT      + ServiceId = {3DA21691-E39D-4DA6-8A4B-B43877BCB1B7}, Server URL = HTTP://mySiteServer.domain.GLOBAL:8530/ClientWebService/client.asmx
    2014-03-17    07:59:29:406     452    9fc    PT    +++++++++++  PT: Synchronizing server updates  +++++++++++
    2014-03-17    07:59:29:406     452    9fc    PT      + ServiceId = {3DA21691-E39D-4DA6-8A4B-B43877BCB1B7}, Server URL = HTTP://mySiteServer.domain.GLOBAL:8530/ClientWebService/client.asmx
    2014-03-17    07:59:30:089     452    9fc    PT    +++++++++++  PT: Synchronizing extended update info  +++++++++++
    2014-03-17    07:59:30:089     452    9fc    PT      + ServiceId = {3DA21691-E39D-4DA6-8A4B-B43877BCB1B7}, Server URL = HTTP://mySiteServer.domain.GLOBAL:8530/ClientWebService/client.asmx
    2014-03-17    07:59:55:387    4672    1534    COMAPI    ---------
    2014-03-17    07:59:55:388    4672    1534    COMAPI    <<-- SUBMITTED -- COMAPI: Search [ClientId = CcmExec]
    2014-03-17    07:59:55:388     452    9fc    Agent    *************
    2014-03-17    07:59:55:388     452    9fc    Agent    ** START **  Agent: Finding updates [CallerId = CcmExec]
    2014-03-17    07:59:55:388     452    9fc    Agent    *********
    2014-03-17    07:59:55:388     452    9fc    Agent      * Include potentially superseded updates
    2014-03-17    07:59:55:388     452    9fc    Agent      * Online = Yes; Ignore download priority = Yes
    2014-03-17    07:59:55:388     452    9fc    Agent      * Criteria = "((DeploymentAction=* AND Type='Software' AND CategoryIDs contains 'E0789628-CE08-4437-BE74-2495B842F43B'))"
    2014-03-17    07:59:55:389     452    9fc    Agent      * ServiceID = {3DA21691-E39D-4DA6-8A4B-B43877BCB1B7} Managed
    2014-03-17    07:59:55:389     452    9fc    Agent      * Search Scope = {Machine}
    2014-03-17    07:59:55:433     452    9fc    PT    +++++++++++  PT: Starting category scan  +++++++++++
    2014-03-17    07:59:55:433     452    9fc    PT      + ServiceId = {3DA21691-E39D-4DA6-8A4B-B43877BCB1B7}, Server URL = HTTP://mySiteServer.domain.GLOBAL:8530/ClientWebService/client.asmx
    2014-03-17    08:00:02:360     452    9fc    PT    +++++++++++  PT: Synchronizing server updates  +++++++++++
    2014-03-17    08:00:02:360     452    9fc    PT      + ServiceId = {3DA21691-E39D-4DA6-8A4B-B43877BCB1B7}, Server URL = HTTP://mySiteServer.domain.GLOBAL:8530/ClientWebService/client.asmx
    2014-03-17    08:00:16:100     452    9fc    Agent    WARNING: Failed to evaluate Installed rule, updateId = {189A8F50-0C3A-4FDF-8BC2-BC23A3EB11FB}.101, hr = 80242013
    2014-03-17    08:00:18:951     452    9fc    PT    +++++++++++  PT: Synchronizing extended update info  +++++++++++
    2014-03-17    08:00:18:951     452    9fc    PT      + ServiceId = {3DA21691-E39D-4DA6-8A4B-B43877BCB1B7}, Server URL = HTTP://mySiteServer.domain.GLOBAL:8530/ClientWebService/client.asmx
    2014-03-17    08:00:19:974     452    1398    AU    Can not perform non-interactive scan if AU is interactive-only
    2014-03-17    08:00:19:979     452    9fc    Agent    *************
    2014-03-17    08:00:20:008     452    9fc    Report    REPORT EVENT: {B2A79652-BABC-46DE-B505-B6CB6D5CD9A8}    2014-03-17 08:00:19:978+0800    1  
     147    101    {00000000-0000-0000-0000-000000000000}    0    0    CcmExec    Success    Software Synchronization    Windows Update
    Client successfully detected 12 updates.
    2014-03-17    08:00:20:008     452    9fc    Report    CWERReporter finishing event handling. (00000000)
    2014-03-17    08:00:20:008    4672    1534    COMAPI    >>--  RESUMED  -- COMAPI: Search [ClientId = CcmExec]
    2014-03-17    08:00:20:013    4672    1534    COMAPI      - Updates found = 12
    2014-03-17    08:00:20:013    4672    1534    COMAPI    ---------
    2014-03-17    08:00:20:013    4672    1534    COMAPI    --  END  --  COMAPI: Search [ClientId = CcmExec]
    2014-03-17    08:00:20:013    4672    1534    COMAPI    -------------
    2014-03-17    08:00:24:973     452    9fc    Report    CWERReporter finishing event handling. (00000000)
    2014-03-17    08:24:46:620    5620    1890    Misc    ===========  Logging initialized (build: 7.6.7600.256, tz: +0800)  ===========
    2014-03-17    08:24:46:620    5620    1890    Misc      = Process: c:\Program Files\Microsoft Security Client\MpCmdRun.exe
    2014-03-17    08:24:46:620    5620    1890    Misc      = Module: C:\Windows\system32\wuapi.dll
    2014-03-17    08:24:46:620    5620    1890    COMAPI    -------------
    2014-03-17    08:24:46:620    5620    1890    COMAPI    -- START --  COMAPI: Search [ClientId = System Center Endpoint Protection (DDEFDD14-250E-4DC8-A0B3-9D667EC5D8EB)]
    2014-03-17    08:24:46:620    5620    1890    COMAPI    ---------
    2014-03-17    08:24:46:623    5620    1890    COMAPI    <<-- SUBMITTED -- COMAPI: Search [ClientId = System Center Endpoint Protection (DDEFDD14-250E-4DC8-A0B3-9D667EC5D8EB)]
    2014-03-17    08:24:46:623     452    1a78    Agent    *************
    2014-03-17    08:24:46:623     452    1a78    Agent    ** START **  Agent: Finding updates [CallerId = System Center Endpoint Protection (DDEFDD14-250E-4DC8-A0B3-9D667EC5D8EB)]
    2014-03-17    08:24:46:623     452    1a78    Agent    *********
    2014-03-17    08:24:46:623     452    1a78    Agent      * Online = Yes; Ignore download priority = No
    2014-03-17    08:24:46:623     452    1a78    Agent      * Criteria = "(IsInstalled = 0 and IsHidden = 0 and CategoryIDs contains 'a38c835c-2950-4e87-86cc-6911a52c34a3' and
    CategoryIDs contains 'e0789628-ce08-4437-be74-2495b842f43b')"
    2014-03-17    08:24:46:623     452    1a78    Agent      * ServiceID = {7971F918-A847-4430-9279-4A52D1EFE18D} Third party service
    2014-03-17    08:24:46:623     452    1a78    Agent      * Search Scope = {Machine}
    2014-03-17    08:24:46:657     452    1a78    Misc    Validating signature for C:\windows\SoftwareDistribution\WuRedir\9482F4B4-E343-43B6-B170-9A65BC822C77\muv4wuredir.cab:
    2014-03-17    08:24:46:706     452    1a78    Misc     Microsoft signed: Yes
    2014-03-17    08:24:48:018     452    1a78    Misc    Validating signature for C:\windows\SoftwareDistribution\WuRedir\9482F4B4-E343-43B6-B170-9A65BC822C77\muv4wuredir.cab:
    2014-03-17    08:24:48:025     452    1a78    Misc     Microsoft signed: Yes
    2014-03-17    08:24:48:073     452    1a78    Agent    Checking for updated auth cab for service 7971f918-a847-4430-9279-4a52d1efe18d at http://ds.download.windowsupdate.com/v10/1/microsoftupdate/redir/muauth.cab
    2014-03-17    08:24:48:073     452    1a78    Misc    Validating signature for C:\windows\SoftwareDistribution\AuthCabs\authcab.cab:
    2014-03-17    08:24:48:083     452    1a78    Misc     Microsoft signed: Yes
    2014-03-17    08:24:48:644     452    1a78    Misc    Validating signature for C:\windows\SoftwareDistribution\AuthCabs\authcab.cab:
    2014-03-17    08:24:48:650     452    1a78    Misc     Microsoft signed: Yes
    2014-03-17    08:24:48:755     452    1a78    Misc    Validating signature for C:\windows\SoftwareDistribution\WuRedir\7971F918-A847-4430-9279-4A52D1EFE18D\muredir.cab:
    2014-03-17    08:24:48:762     452    1a78    Misc     Microsoft signed: Yes
    2014-03-17    08:24:49:139     452    1a78    Misc    Validating signature for C:\windows\SoftwareDistribution\WuRedir\7971F918-A847-4430-9279-4A52D1EFE18D\muredir.cab:
    2014-03-17    08:24:49:146     452    1a78    Misc     Microsoft signed: Yes
    2014-03-17    08:24:49:156     452    1a78    PT    WARNING: Cached cookie has expired or new PID is available
    2014-03-17    08:24:51:859     452    1a78    PT    +++++++++++  PT: Starting category scan  +++++++++++
    2014-03-17    08:24:51:860     452    1a78    PT      + ServiceId = {7971F918-A847-4430-9279-4A52D1EFE18D}, Server URL = https://update.microsoft.com/v6/ClientWebService/client.asmx
    2014-03-17    08:24:52:293     452    1a78    Misc    Validating signature for C:\windows\SoftwareDistribution\WuRedir\7971F918-A847-4430-9279-4A52D1EFE18D\muredir.cab:
    2014-03-17    08:24:52:296     452    1a78    Misc     Microsoft signed: Yes
    2014-03-17    08:24:52:570     452    1a78    Misc    Validating signature for C:\windows\SoftwareDistribution\WuRedir\7971F918-A847-4430-9279-4A52D1EFE18D\muredir.cab:
    2014-03-17    08:24:52:577     452    1a78    Misc     Microsoft signed: Yes
    2014-03-17    08:24:52:584     452    1a78    PT    +++++++++++  PT: Synchronizing server updates  +++++++++++
    2014-03-17    08:24:52:584     452    1a78    PT      + ServiceId = {7971F918-A847-4430-9279-4A52D1EFE18D}, Server URL = https://update.microsoft.com/v6/ClientWebService/client.asmx
    2014-03-17    08:24:52:584     452    1a78    PT    WARNING: Cached cookie has expired or new PID is available
    2014-03-17    08:24:54:237     452    1a78    Misc    Validating signature for C:\windows\SoftwareDistribution\WuRedir\7971F918-A847-4430-9279-4A52D1EFE18D\muredir.cab:
    2014-03-17    08:24:54:241     452    1a78    Misc     Microsoft signed: Yes
    2014-03-17    08:24:54:851     452    1a78    Misc    Validating signature for C:\windows\SoftwareDistribution\WuRedir\7971F918-A847-4430-9279-4A52D1EFE18D\muredir.cab:
    2014-03-17    08:24:54:857     452    1a78    Misc     Microsoft signed: Yes
    2014-03-17    08:24:54:864     452    1a78    PT    +++++++++++  PT: Synchronizing extended update info  +++++++++++
    2014-03-17    08:24:54:864     452    1a78    PT      + ServiceId = {7971F918-A847-4430-9279-4A52D1EFE18D}, Server URL = https://update.microsoft.com/v6/ClientWebService/client.asmx
    2014-03-17    08:24:55:403     452    1398    AU    Can not perform non-interactive scan if AU is interactive-only
    2014-03-17    08:24:55:405     452    1a78    Agent    Update {59B2BB4D-839D-4719-8905-48902D4F9E0B}.200 is pruned out due to potential supersedence
    2014-03-17    08:24:55:405     452    1a78    Agent    Update {759CD48D-010A-42E7-84DE-AC43603E653D}.200 is pruned out due to potential supersedence
    2014-03-17    08:24:55:405     452    1a78    Agent    Update {B31982D9-2558-4A53-8EC7-9FF0E865698C}.200 is pruned out due to potential supersedence
    2014-03-17    08:24:55:406     452    1a78    Agent    Update {DB9D9C73-2729-4248-9314-663B427AF113}.200 is pruned out due to potential supersedence
    2014-03-17    08:24:55:406     452    1a78    Agent    Update {7AF502C1-C821-414B-9FD3-47F52F3FD523}.200 is pruned out due to potential supersedence
    2014-03-17    08:24:55:406     452    1a78    Agent      * Added update {33FBE82E-BE96-48C4-9C34-F6AEC8569DC7}.200 to search result
    2014-03-17    08:24:55:406     452    1a78    Agent      * Found 1 updates and 4 categories in search; evaluated appl. rules of 61 out of 76 deployed entities
    2014-03-17    08:24:55:413     452    1a78    Agent    *********
    2014-03-17    08:24:55:413     452    1a78    Agent    **  END  **  Agent: Finding updates [CallerId = System Center Endpoint Protection (DDEFDD14-250E-4DC8-A0B3-9D667EC5D8EB)]
    2014-03-17    08:24:55:413     452    1a78    Agent    *************
    2014-03-17    08:24:55:414    5620    1518    COMAPI    >>--  RESUMED  -- COMAPI: Search [ClientId = System Center Endpoint Protection (DDEFDD14-250E-4DC8-A0B3-9D667EC5D8EB)]
    2014-03-17    08:24:55:416    5620    1518    COMAPI      - Updates found = 1
    2014-03-17    08:24:55:416    5620    1518    COMAPI    ---------
    2014-03-17    08:24:55:416    5620    1518    COMAPI    --  END  --  COMAPI: Search [ClientId = System Center Endpoint Protection (DDEFDD14-250E-4DC8-A0B3-9D667EC5D8EB)]
    2014-03-17    08:24:55:416    5620    1518    COMAPI    -------------
    2014-03-17    08:24:55:419    5620    b4c    COMAPI    -------------
    2014-03-17    08:24:55:419    5620    b4c    COMAPI    -- START --  COMAPI: Download [ClientId = System Center Endpoint Protection (DDEFDD14-250E-4DC8-A0B3-9D667EC5D8EB)]
    2014-03-17    08:24:55:419    5620    b4c    COMAPI    ---------
    2014-03-17    08:24:55:419    5620    b4c    COMAPI      - Forced: No; Download priority: 2
    2014-03-17    08:24:55:419    5620    b4c    COMAPI      - Updates in request: 1
    2014-03-17    08:24:55:419    5620    b4c    COMAPI      - ServiceID = {7971F918-A847-4430-9279-4A52D1EFE18D} Third party service
    2014-03-17    08:24:55:422    5620    b4c    COMAPI    <<-- SUBMITTED -- COMAPI: Download [ClientId = System Center Endpoint Protection (DDEFDD14-250E-4DC8-A0B3-9D667EC5D8EB)]
    2014-03-17    08:24:55:422     452    1a78    DnldMgr    *************
    2014-03-17    08:24:55:422     452    1a78    DnldMgr    ** START **  DnldMgr: Downloading updates [CallerId = System Center Endpoint Protection (DDEFDD14-250E-4DC8-A0B3-9D667EC5D8EB)]
    2014-03-17    08:24:55:422     452    1a78    DnldMgr    *********
    2014-03-17    08:24:55:422     452    1a78    DnldMgr      * Call ID = {E0013492-D13F-43AB-896F-8521DE916FCD}
    2014-03-17    08:24:55:422     452    1a78    DnldMgr      * Priority = 2, Interactive = 1, Owner is system = 1, Explicit proxy = 1, Proxy session id = -1, ServiceId = {7971F918-A847-4430-9279-4A52D1EFE18D}
    2014-03-17    08:24:55:422     452    1a78    DnldMgr      * Updates to download = 1
    2014-03-17    08:24:55:422     452    1a78    Agent      *   Title = Definition Update for Microsoft Endpoint Protection - KB2461484 (Definition 1.167.2113.0)
    2014-03-17    08:24:55:422     452    1a78    Agent      *   UpdateId = {33FBE82E-BE96-48C4-9C34-F6AEC8569DC7}.200
    2014-03-17    08:24:55:422     452    1a78    Agent      *     Bundles 3 updates:
    2014-03-17    08:24:55:422     452    1a78    Agent      *       {7E4CD222-2348-4617-A8FD-4608CA0F5D9C}.200
    2014-03-17    08:24:55:422     452    1a78    Agent      *       {85F7798B-FE1C-4AAB-8B5C-313B2ACB1778}.200
    2014-03-17    08:24:55:422     452    1a78    Agent      *       {F7095866-6910-4D42-B4BE-AA4ECE02D6CA}.200
    2014-03-17    08:24:55:441     452    1a78    DnldMgr    ***********  DnldMgr: New download job [UpdateId = {85F7798B-FE1C-4AAB-8B5C-313B2ACB1778}.200]  ***********
    2014-03-17    08:24:55:492     452    1a78    DnldMgr      * BITS job initialized, JobId = {774F570F-FF72-408E-B8F9-1A9EC2A9DFEC}
    2014-03-17    08:24:55:492     452    1a78    DnldMgr    BITS job {774F570F-FF72-408E-B8F9-1A9EC2A9DFEC} using proxy = nzpr01.domain.co.nz:8080;proxy.domain.co.nz:8080, bypass = <NULL>
    2014-03-17    08:24:55:539     452    1a78    DnldMgr      * Downloading from http://download.windowsupdate.com/msdownload/update/software/defu/2014/03/nis_delta_patch_35110c44392d4ed2952852248b7d4e98730d59d7.exe
    to C:\windows\SoftwareDistribution\Download\5d16f20387cc485e8ab3f76cf00d482d\35110c44392d4ed2952852248b7d4e98730d59d7 (full file).
    2014-03-17    08:24:55:617     452    1a78    DnldMgr    ***********  DnldMgr: New download job [UpdateId = {F7095866-6910-4D42-B4BE-AA4ECE02D6CA}.200]  ***********
    2014-03-17    08:24:55:676     452    1a78    DnldMgr      * BITS job initialized, JobId = {34C6823B-B255-429F-ABB3-31D850C69994}
    2014-03-17    08:24:55:676     452    1a78    DnldMgr    BITS job {34C6823B-B255-429F-ABB3-31D850C69994} using proxy = nzpr01.domain.co.nz:8080;proxy.domain.co.nz:8080, bypass = <NULL>
    2014-03-17    08:24:55:792     452    1a78    DnldMgr      * Downloading from http://download.windowsupdate.com/msdownload/update/software/defu/2014/03/am_delta_4561a4006e1295d251371592cbebc2c18adcca43.exe
    to C:\windows\SoftwareDistribution\Download\8439bb6ce5944930522a2c27c57de50e\4561a4006e1295d251371592cbebc2c18adcca43 (full file).
    2014-03-17    08:24:55:943     452    1a78    Agent    *********
    2014-03-17    08:24:55:943     452    1a78    Agent    **  END  **  Agent: Downloading updates [CallerId = System Center Endpoint Protection (DDEFDD14-250E-4DC8-A0B3-9D667EC5D8EB)]
    2014-03-17    08:24:55:943     452    1a78    Agent    *************
    2014-03-17    08:25:00:411     452    1a78    Report    REPORT EVENT: {4215F4AF-AAF5-4BB5-BE2C-BB09A9BA6176}    2014-03-17 08:24:55:412+0800    1  
     147    101    {00000000-0000-0000-0000-000000000000}    0    0    System Center Endpoint Protecti    Success    Software Synchronization  
     Windows Update Client successfully detected 1 updates.
    2014-03-17    08:25:00:411     452    1a78    Report    CWERReporter finishing event handling. (00000000)
    2014-03-17    08:25:17:443     452    134c    DnldMgr    BITS job {774F570F-FF72-408E-B8F9-1A9EC2A9DFEC} completed successfully
    2014-03-17    08:25:17:486     452    134c    Misc    Validating signature for C:\windows\SoftwareDistribution\Download\5d16f20387cc485e8ab3f76cf00d482d\35110c44392d4ed2952852248b7d4e98730d59d7:
    2014-03-17    08:25:17:496     452    134c    Misc     Microsoft signed: Yes
    2014-03-17    08:25:17:499     452    134c    DnldMgr      Download job bytes total = 76056, bytes transferred = 76056
    2014-03-17    08:25:17:500     452    134c    DnldMgr    ***********  DnldMgr: New download job [UpdateId = {85F7798B-FE1C-4AAB-8B5C-313B2ACB1778}.200]  ***********
    2014-03-17    08:25:17:501     452    134c    DnldMgr      * All files for update were already downloaded and are valid.
    2014-03-17    08:25:22:501     452    1a78    Report    CWERReporter finishing event handling. (00000000)
    Hibs Ya Bass!

  • SCCM Server says Forefront Endpoint Protection failed to install update(s)

    I have a single SCCM 2012 SP1 CU4 server running on Windows Server 2012.  I primarily use this for Endpoint Protection and Windows Updates.
    Recently I started seeing a lot of errors in the Endpoint Protection deployments.  This one has me baffled because the Endpoint Protection client on the machine says that it is up-to-date.  However, when I go to
    Monitoring --> Deployments on the server, I see tons of errors that read "Failed to install update(s)."
    Under the "Last Enforcement Error Code" heading, it reads: 
    0x80070643. 
    I have spent several days searching about this, but the only info I can find is about Endpoint Protection
    installation problems.  In my case, though, I have Endpoint Protection installed...it is the
    update(s) that are showing the errors.
    Server screen-shot:
    Client screen-shot:
    Thanks in advance for any help.

    I see these entries starting at 6:19 PM last night and ending at 6:09 AM today:  I put in
    bold what kind of stands out to me. 
    Assignment {7b642d5f-623d-4c44-a902-a414bef0adf7} has total CI = 1    UpdatesDeploymentAgent    5/15/2014 6:19:29 PM    1232 (0x04D0)
    OnPolicyModify for assignment ({7b642d5f-623d-4c44-a902-a414bef0adf7})...     UpdatesDeploymentAgent    5/15/2014 6:19:29 PM    1232 (0x04D0)
    Starting forced trigger (TriggerActivate) for assignment {7b642d5f-623d-4c44-a902-a414bef0adf7}    UpdatesDeploymentAgent    5/15/2014 6:19:29 PM    1232 (0x04D0)
    Detection job ({F7A501B7-38F4-458B-AA62-F32212D3B614}) started for assignment ({7b642d5f-623d-4c44-a902-a414bef0adf7})    UpdatesDeploymentAgent    5/15/2014 6:19:29 PM    1232 (0x04D0)
    Progress received for assignment ({7b642d5f-623d-4c44-a902-a414bef0adf7})    UpdatesDeploymentAgent    5/15/2014 6:20:02 PM    1072 (0x0430)
    DetectJob completion received for assignment ({7b642d5f-623d-4c44-a902-a414bef0adf7})    UpdatesDeploymentAgent    5/15/2014 6:20:02 PM    4632 (0x1218)
    Update (Site_A0C81BE8-8706-4378-B3C3-9149D17EA00E/SUM_ba89c7f4-5400-4c40-aa1b-aefa5fbdffb2) Name (Definition Update for Microsoft Endpoint Protection - KB2461484 (Definition 1.173.2187.0)) ArticleID (2461484) added to the targeted list of deployment ({7b642d5f-623d-4c44-a902-a414bef0adf7})  
     UpdatesDeploymentAgent    5/15/2014 6:20:02 PM    4632 (0x1218)
    Update (Site_A0C81BE8-8706-4378-B3C3-9149D17EA00E/SUM_4fcb1b37-19a1-4c12-a77c-bbe513872a43) Name (Definition Update for Microsoft Endpoint Protection - KB2461484 (Definition 1.173.2219.0)) ArticleID (2461484) added to the targeted list of deployment ({7b642d5f-623d-4c44-a902-a414bef0adf7})  
     UpdatesDeploymentAgent    5/15/2014 6:20:02 PM    4632 (0x1218)
    DownloadCIContents Job ({8C3E7548-DA29-48EB-B3C3-12B96B31D492}) started for assignment ({7b642d5f-623d-4c44-a902-a414bef0adf7})    UpdatesDeploymentAgent    5/15/2014 6:20:02 PM    4632 (0x1218)
    Progress received for assignment ({7b642d5f-623d-4c44-a902-a414bef0adf7})    UpdatesDeploymentAgent    5/15/2014 6:20:03 PM    4632 (0x1218)
    Progress received for assignment ({7b642d5f-623d-4c44-a902-a414bef0adf7})    UpdatesDeploymentAgent    5/15/2014 6:20:03 PM    4508 (0x119C)
    Update (Site_A0C81BE8-8706-4378-B3C3-9149D17EA00E/SUM_ba89c7f4-5400-4c40-aa1b-aefa5fbdffb2) Progress: Status = ciStateDownloading, PercentComplete = 0, Result = 0x0    UpdatesDeploymentAgent    5/15/2014 6:20:03 PM  
     4508 (0x119C)
    Update (Site_A0C81BE8-8706-4378-B3C3-9149D17EA00E/SUM_4fcb1b37-19a1-4c12-a77c-bbe513872a43) Progress: Status = ciStateDownloading, PercentComplete = 0, Result = 0x0    UpdatesDeploymentAgent    5/15/2014 6:20:03 PM  
     4508 (0x119C)
    Progress received for assignment ({7b642d5f-623d-4c44-a902-a414bef0adf7})    UpdatesDeploymentAgent    5/15/2014 6:20:03 PM    4508 (0x119C)
    Progress received for assignment ({7b642d5f-623d-4c44-a902-a414bef0adf7})    UpdatesDeploymentAgent    5/15/2014 6:20:03 PM    4508 (0x119C)
    Progress received for assignment ({7b642d5f-623d-4c44-a902-a414bef0adf7})    UpdatesDeploymentAgent    5/15/2014 6:20:03 PM    4508 (0x119C)
    DownloadJob completion received for assignment ({7b642d5f-623d-4c44-a902-a414bef0adf7})    UpdatesDeploymentAgent    5/15/2014 6:20:03 PM    1128 (0x0468)
    Update (Site_A0C81BE8-8706-4378-B3C3-9149D17EA00E/SUM_ba89c7f4-5400-4c40-aa1b-aefa5fbdffb2) Name (Definition Update for Microsoft Endpoint Protection - KB2461484 (Definition 1.173.2187.0)) ArticleID (2461484) added to the targeted list of deployment ({7b642d5f-623d-4c44-a902-a414bef0adf7})  
     UpdatesDeploymentAgent    5/15/2014 6:20:03 PM    1128 (0x0468)
    Update (Site_A0C81BE8-8706-4378-B3C3-9149D17EA00E/SUM_4fcb1b37-19a1-4c12-a77c-bbe513872a43) Name (Definition Update for Microsoft Endpoint Protection - KB2461484 (Definition 1.173.2219.0)) ArticleID (2461484) added to the targeted list of deployment ({7b642d5f-623d-4c44-a902-a414bef0adf7})  
     UpdatesDeploymentAgent    5/15/2014 6:20:03 PM    1128 (0x0468)
    Message received: '<?xml version='1.0' ?>
        <CIAssignmentMessage MessageType='Activation'>
            <AssignmentID>{7b642d5f-623d-4c44-a902-a414bef0adf7}</AssignmentID>
        </CIAssignmentMessage>'    UpdatesDeploymentAgent    5/15/2014 6:37:00 PM    452 (0x01C4)
    Assignment {7b642d5f-623d-4c44-a902-a414bef0adf7} has total CI = 2    UpdatesDeploymentAgent    5/15/2014 6:37:00 PM    452 (0x01C4)
    Assignment ({7b642d5f-623d-4c44-a902-a414bef0adf7}) received activation trigger    UpdatesDeploymentAgent    5/15/2014 6:37:00 PM    452 (0x01C4)
    Detection job ({726D8962-0690-46DB-B9A0-FF5D979AE3CF}) started for assignment ({7b642d5f-623d-4c44-a902-a414bef0adf7})    UpdatesDeploymentAgent    5/15/2014 6:37:00 PM    452 (0x01C4)
    Progress received for assignment ({7b642d5f-623d-4c44-a902-a414bef0adf7})    UpdatesDeploymentAgent    5/15/2014 6:37:00 PM    620 (0x026C)
    DetectJob completion received for assignment ({7b642d5f-623d-4c44-a902-a414bef0adf7})    UpdatesDeploymentAgent    5/15/2014 6:37:01 PM    4496 (0x1190)
    Update (Site_A0C81BE8-8706-4378-B3C3-9149D17EA00E/SUM_ba89c7f4-5400-4c40-aa1b-aefa5fbdffb2) Name (Definition Update for Microsoft Endpoint Protection - KB2461484 (Definition 1.173.2187.0)) ArticleID (2461484) added to the targeted list of deployment ({7b642d5f-623d-4c44-a902-a414bef0adf7})  
     UpdatesDeploymentAgent    5/15/2014 6:37:01 PM    4496 (0x1190)
    Update (Site_A0C81BE8-8706-4378-B3C3-9149D17EA00E/SUM_4fcb1b37-19a1-4c12-a77c-bbe513872a43) Name (Definition Update for Microsoft Endpoint Protection - KB2461484 (Definition 1.173.2219.0)) ArticleID (2461484) added to the targeted list of deployment ({7b642d5f-623d-4c44-a902-a414bef0adf7})  
     UpdatesDeploymentAgent    5/15/2014 6:37:01 PM    4496 (0x1190)
    DownloadCIContents Job ({7EEA627C-B1B3-457D-BE69-6F3A8DDDA692}) started for assignment ({7b642d5f-623d-4c44-a902-a414bef0adf7})    UpdatesDeploymentAgent    5/15/2014 6:37:01 PM    4496 (0x1190)
    Progress received for assignment ({7b642d5f-623d-4c44-a902-a414bef0adf7})    UpdatesDeploymentAgent    5/15/2014 6:37:01 PM    452 (0x01C4)
    Progress received for assignment ({7b642d5f-623d-4c44-a902-a414bef0adf7})    UpdatesDeploymentAgent    5/15/2014 6:37:01 PM    1648 (0x0670)
    Update (Site_A0C81BE8-8706-4378-B3C3-9149D17EA00E/SUM_ba89c7f4-5400-4c40-aa1b-aefa5fbdffb2) Progress: Status = ciStateDownloading, PercentComplete = 0, Result = 0x0    UpdatesDeploymentAgent    5/15/2014 6:37:01 PM  
     1648 (0x0670)
    Update (Site_A0C81BE8-8706-4378-B3C3-9149D17EA00E/SUM_4fcb1b37-19a1-4c12-a77c-bbe513872a43) Progress: Status = ciStateDownloading, PercentComplete = 0, Result = 0x0    UpdatesDeploymentAgent    5/15/2014 6:37:01 PM  
     1648 (0x0670)
    Progress received for assignment ({7b642d5f-623d-4c44-a902-a414bef0adf7})    UpdatesDeploymentAgent    5/15/2014 6:37:01 PM    1648 (0x0670)
    Progress received for assignment ({7b642d5f-623d-4c44-a902-a414bef0adf7})    UpdatesDeploymentAgent    5/15/2014 6:37:01 PM    1648 (0x0670)
    Progress received for assignment ({7b642d5f-623d-4c44-a902-a414bef0adf7})    UpdatesDeploymentAgent    5/15/2014 6:37:01 PM    1648 (0x0670)
    DownloadJob completion received for assignment ({7b642d5f-623d-4c44-a902-a414bef0adf7})    UpdatesDeploymentAgent    5/15/2014 6:37:01 PM    1648 (0x0670)
    Update (Site_A0C81BE8-8706-4378-B3C3-9149D17EA00E/SUM_ba89c7f4-5400-4c40-aa1b-aefa5fbdffb2) Name (Definition Update for Microsoft Endpoint Protection - KB2461484 (Definition 1.173.2187.0)) ArticleID (2461484) added to the targeted list of deployment ({7b642d5f-623d-4c44-a902-a414bef0adf7})  
     UpdatesDeploymentAgent    5/15/2014 6:37:01 PM    1648 (0x0670)
    Update (Site_A0C81BE8-8706-4378-B3C3-9149D17EA00E/SUM_4fcb1b37-19a1-4c12-a77c-bbe513872a43) Name (Definition Update for Microsoft Endpoint Protection - KB2461484 (Definition 1.173.2219.0)) ArticleID (2461484) added to the targeted list of deployment ({7b642d5f-623d-4c44-a902-a414bef0adf7})  
     UpdatesDeploymentAgent    5/15/2014 6:37:01 PM    1648 (0x0670)
    CUpdateAssignmentsManager received a SERVICEWINDOWEVENT START Event    UpdatesDeploymentAgent    5/15/2014 10:00:00 PM    3736 (0x0E98)
    Suspend activity in presentation mode is selected    UpdatesDeploymentAgent    5/15/2014 10:00:00 PM    3736 (0x0E98)
    Atleast one user has elected to suspend non-business hours activity when in presentation mode. Checking for presentation mode.    UpdatesDeploymentAgent    5/15/2014 10:00:00 PM    3736 (0x0E98)
    Proceeding to non-business hours activites as presentation mode is off.    UpdatesDeploymentAgent    5/15/2014 10:00:00 PM    3736 (0x0E98)
    Auto install during non-business hours is disabled or never set, selecting only scheduled updates.    UpdatesDeploymentAgent    5/15/2014 10:00:00 PM    3736 (0x0E98)
    A user-defined service window(non-business hours) is available. We will attempt to install any scheduled updates.    UpdatesDeploymentAgent    5/15/2014 10:00:00 PM    3736 (0x0E98)
    Attempting to install 0 updates    UpdatesDeploymentAgent    5/15/2014 10:00:00 PM    3736 (0x0E98)
    No actionable updates for install task. No attempt required.    UpdatesDeploymentAgent    5/15/2014 10:00:00 PM    3736 (0x0E98)
    Updates could not be installed at this time. Waiting for the next maintenance window.    UpdatesDeploymentAgent    5/15/2014 10:00:00 PM    3736 (0x0E98)
    CUpdateAssignmentsManager received a SERVICEWINDOWEVENT END Event    UpdatesDeploymentAgent    5/16/2014 5:00:00 AM    3500 (0x0DAC)
    No current service window available to run updates assignment with time required = 1    UpdatesDeploymentAgent    5/16/2014 5:00:00 AM    3500 (0x0DAC)
    Attempting to cancel any job started at non-business hours.    UpdatesDeploymentAgent    5/16/2014 5:00:00 AM    3500 (0x0DAC)
    Message received: '<?xml version='1.0' ?>
        <CIAssignmentMessage MessageType='EnforcementDeadline'>
            <AssignmentID>{7b642d5f-623d-4c44-a902-a414bef0adf7}</AssignmentID>
        </CIAssignmentMessage>'    UpdatesDeploymentAgent    5/16/2014 6:09:00 AM    2768 (0x0AD0)
    Assignment {7b642d5f-623d-4c44-a902-a414bef0adf7} has total CI = 2    UpdatesDeploymentAgent    5/16/2014 6:09:00 AM    2768 (0x0AD0)
    Deadline received for assignment ({7b642d5f-623d-4c44-a902-a414bef0adf7})    UpdatesDeploymentAgent    5/16/2014 6:09:00 AM    2768 (0x0AD0)
    Detection job ({41BE2786-E548-429E-9590-5102B1F8DE2A}) started for assignment ({7b642d5f-623d-4c44-a902-a414bef0adf7})    UpdatesDeploymentAgent    5/16/2014 6:09:00 AM    2768 (0x0AD0)
    Progress received for assignment ({7b642d5f-623d-4c44-a902-a414bef0adf7})    UpdatesDeploymentAgent    5/16/2014 6:09:00 AM    4660 (0x1234)
    DetectJob completion received for assignment ({7b642d5f-623d-4c44-a902-a414bef0adf7})    UpdatesDeploymentAgent    5/16/2014 6:09:01 AM    4660 (0x1234)
    Update (Site_A0C81BE8-8706-4378-B3C3-9149D17EA00E/SUM_ba89c7f4-5400-4c40-aa1b-aefa5fbdffb2) Name (Definition Update for Microsoft Endpoint Protection - KB2461484 (Definition 1.173.2187.0)) ArticleID (2461484) added to the targeted list of deployment ({7b642d5f-623d-4c44-a902-a414bef0adf7})  
     UpdatesDeploymentAgent    5/16/2014 6:09:01 AM    4660 (0x1234)
    Update (Site_A0C81BE8-8706-4378-B3C3-9149D17EA00E/SUM_4fcb1b37-19a1-4c12-a77c-bbe513872a43) Name (Definition Update for Microsoft Endpoint Protection - KB2461484 (Definition 1.173.2219.0)) ArticleID (2461484) added to the targeted list of deployment ({7b642d5f-623d-4c44-a902-a414bef0adf7})  
     UpdatesDeploymentAgent    5/16/2014 6:09:01 AM    4660 (0x1234)
    UpdateAssginment Download: CCM_CONTENT_WF_DEADLINE_DOWNLOAD set    UpdatesDeploymentAgent    5/16/2014 6:09:01 AM    4660 (0x1234)
    DownloadCIContents Job ({D484DF2D-C472-478E-A75F-1C50DACF6A5D}) started for assignment ({7b642d5f-623d-4c44-a902-a414bef0adf7})    UpdatesDeploymentAgent    5/16/2014 6:09:01 AM    4660 (0x1234)
    Progress received for assignment ({7b642d5f-623d-4c44-a902-a414bef0adf7})    UpdatesDeploymentAgent    5/16/2014 6:09:01 AM    4660 (0x1234)
    Progress received for assignment ({7b642d5f-623d-4c44-a902-a414bef0adf7})    UpdatesDeploymentAgent    5/16/2014 6:09:01 AM    748 (0x02EC)
    Update (Site_A0C81BE8-8706-4378-B3C3-9149D17EA00E/SUM_ba89c7f4-5400-4c40-aa1b-aefa5fbdffb2) Progress: Status = ciStateDownloading, PercentComplete = 0, Result = 0x0    UpdatesDeploymentAgent    5/16/2014 6:09:01 AM  
     748 (0x02EC)
    Update (Site_A0C81BE8-8706-4378-B3C3-9149D17EA00E/SUM_4fcb1b37-19a1-4c12-a77c-bbe513872a43) Progress: Status = ciStateDownloading, PercentComplete = 0, Result = 0x0    UpdatesDeploymentAgent    5/16/2014 6:09:01 AM  
     748 (0x02EC)
    Progress received for assignment ({7b642d5f-623d-4c44-a902-a414bef0adf7})    UpdatesDeploymentAgent    5/16/2014 6:09:01 AM    748 (0x02EC)
    Progress received for assignment ({7b642d5f-623d-4c44-a902-a414bef0adf7})    UpdatesDeploymentAgent    5/16/2014 6:09:01 AM    748 (0x02EC)
    Progress received for assignment ({7b642d5f-623d-4c44-a902-a414bef0adf7})    UpdatesDeploymentAgent    5/16/2014 6:09:01 AM    748 (0x02EC)
    DownloadJob completion received for assignment ({7b642d5f-623d-4c44-a902-a414bef0adf7})    UpdatesDeploymentAgent    5/16/2014 6:09:01 AM    748 (0x02EC)
    Update (Site_A0C81BE8-8706-4378-B3C3-9149D17EA00E/SUM_ba89c7f4-5400-4c40-aa1b-aefa5fbdffb2) Name (Definition Update for Microsoft Endpoint Protection - KB2461484 (Definition 1.173.2187.0)) ArticleID (2461484) added to the targeted list of deployment ({7b642d5f-623d-4c44-a902-a414bef0adf7})  
     UpdatesDeploymentAgent    5/16/2014 6:09:02 AM    748 (0x02EC)
    Update (Site_A0C81BE8-8706-4378-B3C3-9149D17EA00E/SUM_4fcb1b37-19a1-4c12-a77c-bbe513872a43) Name (Definition Update for Microsoft Endpoint Protection - KB2461484 (Definition 1.173.2219.0)) ArticleID (2461484) added to the targeted list of deployment ({7b642d5f-623d-4c44-a902-a414bef0adf7})  
     UpdatesDeploymentAgent    5/16/2014 6:09:02 AM    748 (0x02EC)
    Starting install for assignment ({7b642d5f-623d-4c44-a902-a414bef0adf7})    UpdatesDeploymentAgent    5/16/2014 6:09:02 AM    748 (0x02EC)
    ApplyCIs - JobId = {24FEF2A6-EFAB-4675-B3DE-E357BD4D7384}    UpdatesDeploymentAgent    5/16/2014 6:09:02 AM    748 (0x02EC)
    Raising client SDK event for class NULL, instance NULL, actionType 13l, value NULL, user NULL, session 4294967295l, level 0l, verbosity 30l    UpdatesDeploymentAgent    5/16/2014 6:09:02 AM    748 (0x02EC)
    Update (Site_A0C81BE8-8706-4378-B3C3-9149D17EA00E/SUM_4fcb1b37-19a1-4c12-a77c-bbe513872a43) Progress: Status = ciStateDetecting, PercentComplete = 0, DownloadSize = 0, Result = 0x0    UpdatesDeploymentAgent    5/16/2014 6:09:02
    AM    4660 (0x1234)
    Update (Site_A0C81BE8-8706-4378-B3C3-9149D17EA00E/SUM_ba89c7f4-5400-4c40-aa1b-aefa5fbdffb2) Progress: Status = ciStateDetecting, PercentComplete = 0, DownloadSize = 0, Result = 0x0    UpdatesDeploymentAgent    5/16/2014 6:09:02
    AM    4660 (0x1234)
    Update (Site_A0C81BE8-8706-4378-B3C3-9149D17EA00E/SUM_4fcb1b37-19a1-4c12-a77c-bbe513872a43) Progress: Status = ciStateDownloading, PercentComplete = 0, DownloadSize = 0, Result = 0x0    UpdatesDeploymentAgent    5/16/2014 6:09:02
    AM    2788 (0x0AE4)
    Update (Site_A0C81BE8-8706-4378-B3C3-9149D17EA00E/SUM_ba89c7f4-5400-4c40-aa1b-aefa5fbdffb2) Progress: Status = ciStateDownloading, PercentComplete = 0, DownloadSize = 0, Result = 0x0    UpdatesDeploymentAgent    5/16/2014 6:09:02
    AM    2788 (0x0AE4)
    Update (Site_A0C81BE8-8706-4378-B3C3-9149D17EA00E/SUM_4fcb1b37-19a1-4c12-a77c-bbe513872a43) Progress: Status = ciStateWaitInstall, PercentComplete = 0, DownloadSize = 0, Result = 0x0    UpdatesDeploymentAgent    5/16/2014 6:09:02
    AM    4660 (0x1234)
    Update (Site_A0C81BE8-8706-4378-B3C3-9149D17EA00E/SUM_ba89c7f4-5400-4c40-aa1b-aefa5fbdffb2) Progress: Status = ciStateWaitInstall, PercentComplete = 0, DownloadSize = 0, Result = 0x0    UpdatesDeploymentAgent    5/16/2014 6:09:02
    AM    4660 (0x1234)
    Update (Site_A0C81BE8-8706-4378-B3C3-9149D17EA00E/SUM_4fcb1b37-19a1-4c12-a77c-bbe513872a43) Progress: Status = ciStateInstalling, PercentComplete = 0, DownloadSize = 0, Result = 0x0    UpdatesDeploymentAgent    5/16/2014 6:09:22
    AM    2788 (0x0AE4)
    Update (Site_A0C81BE8-8706-4378-B3C3-9149D17EA00E/SUM_4fcb1b37-19a1-4c12-a77c-bbe513872a43) Progress: Status = ciStateInstalling, PercentComplete = 100, DownloadSize = 0, Result = 0x0    UpdatesDeploymentAgent    5/16/2014 6:09:22
    AM    4660 (0x1234)
    Update (Site_A0C81BE8-8706-4378-B3C3-9149D17EA00E/SUM_4fcb1b37-19a1-4c12-a77c-bbe513872a43) Progress: Status = ciStateVerifying, PercentComplete = 0, DownloadSize = 0, Result = 0x0    UpdatesDeploymentAgent    5/16/2014 6:09:22
    AM    4660 (0x1234)
    Update (Site_A0C81BE8-8706-4378-B3C3-9149D17EA00E/SUM_ba89c7f4-5400-4c40-aa1b-aefa5fbdffb2) Progress: Status = ciStateInstalling, PercentComplete = 100, DownloadSize = 0, Result = 0x0    UpdatesDeploymentAgent    5/16/2014 6:09:22
    AM    4660 (0x1234)
    Update (Site_A0C81BE8-8706-4378-B3C3-9149D17EA00E/SUM_ba89c7f4-5400-4c40-aa1b-aefa5fbdffb2) Progress: Status = ciStateVerifying, PercentComplete = 0, DownloadSize = 0, Result = 0x0    UpdatesDeploymentAgent    5/16/2014 6:09:22
    AM    2788 (0x0AE4)
    CUpdatesJob({24FEF2A6-EFAB-4675-B3DE-E357BD4D7384}): Job completion received.    UpdatesDeploymentAgent    5/16/2014 6:09:51 AM    4660 (0x1234)
    Update (Site_A0C81BE8-8706-4378-B3C3-9149D17
    I did not specifically specify any maintenance windows.  It looks like the default business hours are set on the client though:
    Is this maybe causing my problems???  Is it possible to change that default value from the SCCM console??
    Thanks again for all of your help!

Maybe you are looking for

  • WAP321 intermittent lock-ups

    Have been trying to work through an ongoing lock-up issue on a pair fo WAP321's.  Have read many of the prior threads and have tried to get some feedback from data from either the switch or the AP's to help figure out where the problem may be, but am

  • HT204259 How can I go to iPhoto 9.6.1

    How can I go to iPhoto 9.6.1

  • Compress Audio from Microphone

    Hi, I am developing an app that records voice from mic and needs to save it in the disk then send it via email. I got it no problem. I get the bytes and tranform it to wav format using the WAVWriter class. But the wav file is HUGE. As I said, I need

  • Changing size of image in Aperture

    I just purchased a Nikon D2hs which has only a 4mp sensor. The image is pretty small relatively. I want to print at 13x19" on my Epson 2200 printer. In PS which is what I am used to, I upsized the image to 13x19" and resolution to 300 dpi and then af

  • Is Corel Painter Essentials 4 compatible with Mac X v10.7 Lion.

    I was wondering if Coral Paonter Essential 4 is compatible with Mac X v10.7 Lion. By looking at all problem it is best to wait 3 or 4 weeks. Thanks simon