SCCM 2012 - Endpoint Protection Reporting only using static end date

I have created a subscription to the Endpoint Protection/Antimalware Activity Report built into SCCM2012/Endpoint Protection.
My problem is that I am having trouble getting the dates to work correctly.  I want to have the report automaticlly emailed out every monday morning with the status from the last 7 days (i.e. since the last monday report). 
However the subscription seems to want a static end date.  That is, every monday when the report runs it gives me a status report from the exact same 7 days.  Not the most recent 7 days. 
How do I go about changing this so it is useful and that every monday it runs, the report it creates/sends is from the the last 7 days?

I hope this helps (I am still testing it) but I did this by:-
"Editing" the default report such as "Antimalware activity report".
To avoid corrupting this default report before you change anything select SaveAs and call it something like "Antimalware activity report
for the last 7 days".
Open Datasets, StartEndDates and replace the query with this for the last 7 days
"select DATEADD(day,datediff(day,0,GetDate())- 7,0) as StartDate, DATEADD(day,datediff(day,0,GetDate()),0) as EndDate"
Then open Parameters, StartDate and under General change it to "Hidden".
Then open Parameters, EndDate and under General change it to "Hidden".
Save and test
I had to set the "default value" on each parameter, per Lillonel:
StartDate : =DateAdd("d",-7,Globals!ExecutionTime)
EndDate : =Globals!ExecutionTime
It looks like it is using a 7 day window now.

Similar Messages

  • SCCM 2012 Endpoint Protection initial update not downloaded

    Hi,
    I'm new to SCCM 2012. I recently started deploying the Endpoint  Protection to all of clients (Windos 7 and XP Pro). 
    I've noticed that some clients have not been updating their initial definitions after the Endpoint Protection Software is installed. 
    Since they are not updating their detonation the client remains unprotected with the status icon in red.
    The odd thing is that some of our computers do the initial update just fine while others are effected. 
    Also if I click update manually then the update goes through no issue, but with 100+ clients not updated its not something I want to do manually. 
    The clients are set to receive auto updates via a auto deployment rule. 
    Also the antimalware policy is set to do updates as well in this order: 
    Config Mgr
    WSUS
    Microsoft Malware Protection Center
    Microsoft Update
    Has anyone seen this before? 
    If I need to upload any specific logs just let me know. 
    Many Thanks

    Do you have Software update configured (and working) thru ConfigMgr or using a standalone WSUS?
    Kent Agerlund | My blogs: blog.coretech.dk/kea and
    SCUG.dk/ | Twitter:
    @Agerlund | Linkedin: Kent Agerlund |
    Mastering ConfigMgr 2012 The Fundamentals

  • SCCM 2012 EndPoint Protection migration

    I have the old ConfigMgr 2012 name " BACKOFFICE" it is currently managing all the EndPoint Protection for all workstations/servers.
    I now have new ConfigMgr 2012 called "SCCM"  I just installed ForeFront EndPoint Protection and configured the Custom Client Deviec EndPoint Protection to roll out to workstations. What is the best practice to remove old ForeFront EndPoint
    Protection client from old site name and install new one?
    1. Do I have to manually uninstall EndPoint Client in control panel for each computer? or is there a way to just uninstall for all computers using the old COnfigMgr 2012 "BACKOFFICE"
    Thanks for your help!

    Hi !
    You have to reassign the desired clients.
    It can be scripted:
    http://msdn.microsoft.com/en-us/library/cc146558.aspx
    Otherwise, you could install again the client on your targets, with the following options: force install and site assignement.
    You can refer to this link:
    http://technet.microsoft.com/en-us/library/gg712298.aspx
    Hope this helps.
    Note: This posting is provided 'AS IS' with no warranties or guarantees, and confers no rights. Please take a moment to "Vote as Helpful" and/or "Mark as Answer", where applicable. This helps the community, keeps the forums tidy, and
    recognises useful contributions.

  • SCCM 2012 Endpoint Protection Definition Update

    Hi Guys, can you please help me out with this, some of the clients are not pulling or seeing the latest definition updates from the server.
    What do I check?

    Again - Start with the EndpointProtectionAgent.log file on the clients
    http://technet.microsoft.com/en-us/library/c6675aac-4bb8-4b4b-9075-06b4ecec2a18#BKMK_ClientOpLogs
    Nick Moseley | http://t3chn1ck.wordpress.com
    What do I look for in the CIDownloader.log?

  • System Center 2012 Endpoint Protection

    I am trying to install System Center 2012 Endpoint Protection on my computer for Windows 8.1 and keep getting  Error code:0x8004FF71. The license is
    offered through our school. Not sure what to do so it will install. 

    Hi,
    You need to use System Center Endpoint PRotection 2012 R2 as that it is the version that supports Windows 8.1.
    https://social.technet.microsoft.com/Forums/en-US/d9e257f2-3959-430e-a687-749ce43376c2/sccm-2012-endpoint-protection-on-windows-81?forum=configmanagersecurity
    Regards,
    Jörgen
    -- My System Center blog ccmexec.com -- Twitter
    @ccmexec

  • Can I use System Center 2012 Endpoint Protection in "Windows Server Remote Desktop Session Host" without buy the license ?

    Can I use System Center 2012 Endpoint Protection in Azure Virtual Machine Gallary's "Windows Server Remote Desktop Session Host" without buy the System Center 2012 Endpoint Protection license ?
    I want to protect my Azure RemoteApp against the malware.
    System Center 2012 Endpoint Protection installed Azure Virtual Machine Gallary's "Windows Server Remote Desktop Session Host".
    Now, I try to build Azure RemoteApp template by using the  Azure Virtual Machine Gallary's "Windows Server Remote Desktop Session Host" .
    Regards,
    Yoshihiro Kawabata

    Hi Yoshihiro,
    Unless and until Microsoft modifies the license terms for System Center 2012 Endpoint Protection and/or modifies the Online Services Terms (OST) and/or other document explicitly saying that use is included with the Azure RemoteApp (ARA) monthly
    fee I recommend you assume as that it is
    not included and license it separately for ARA if that is even possible, which is a separate question.
    For licensing it is best to be cautious and make decisions based on the official documents that are available that govern use of the software and services involved.  At this moment I'm not able to find a Microsoft document that grants use of System
    Center 2012 Endpoint Protection with Azure RemoteApp.
    When I first used the gallery template and noticed that Endpoint Protection was installed within it I had the same question as you.  I will update this thread if/when I obtain more information.
    -TP

  • How effective is System Center 2012 Endpoint Protection for Windows?

    Hi,
    Is there any thing out there that compares how effective System Center 2012 Endpoint Protection is compared to other AV / Malware solutions?    I have read where MS Security Essentials comes up short of the level of protection compared to
    other solutions.  
    Thanks Lance

    Didn't mean to propose that MS love (yes we all know that you love MS Jason) post as an answer to your question.
    Truth is SCEP may be good at how it works, it doesn't whine to users and it integrates to ConfigMgr. That's where it's good at.  And I get Jason's point there, I'd just like to know what are those "other products" that haven't found the malware
    when SCEP did? MS may gather telemetry, but so do all the other players.
    There are several companies that do ONLY and ONLY AV products so they put their 100% effort in them, I don't think that AV is the business priority number 1 for MS.
    Check this:
    http://lifehacker.com/microsoft-admits-that-third-party-antivirus-is-more-eff-1441135677
    And for your info Security Essentials uses the same AV engine that SCEP does.
    If you want REAL protection, tested in the REAL world, I suggest you read some reviews of the products.
    http://www.av-test.org/en/tests/corporate-user/windows-8/janfeb-2013/
    http://chart.av-comparatives.org/chart1.php
    --- ADVERT (I don't think it's illegal here, eh Jason?)
    I'd go with F-Secure, it's not that expensive and you get some neat features like USB (or any other device for that matter) blocker. And yes, it can be configured to use individual USB sticks and so on..

  • Can we assign 2 IPs for a SCCM 2012 primary site server and use 1 IP for communicating with its 2 DPs and 2nd one for communicating with its upper hierarchy CAS which is in a different .Domain

    Hi,
    Can we assign 2 IPs for a SCCM 2012 primary site server and use 1 Ip for communicating with its 2 DPs and 2nd one for communicating with its upper hierarchy CAS . ?
    Scenario: We are building 1 SCCM 2012 primary site and 2 DPs in one domain . In future this will attach to a CAS server which is in different domain. Can we assign  2 IPs in Primary site server , one IP will use to communicate with its 2 DPs and second
    IP for communicating with the CAS server which is in a different domain.? 
    Details: 
    1)Server : Windows 2012 R2 Std , VM environment .2) SCCM : SCCM 2012 R2 .3)SQL: SQL 2012 Std
    Thanks
    Rajesh Vasudevan

    First, it's not possible. You cannot attach a primary site to an existing CAS.
    Primary sites in 2012 are *not* the same as primary sites in 2007 and a CAS is 2012 is completely different from a central primary site in 2007.
    CASes cannot manage clients. Also, primary sites are *not* used for delegation in 2012. As Torsten points out, multiple primary sites are used for scale-out (in terms of client count) only. Placing primary sites for different organizational units provides
    no functional differences but does add complexity, latency, and additional failure points.
    Thus, as the others have pointed out, your premise for doing this is completely incorrect. What are your actual business goals?
    As for the IP Addressing, that depends upon your networking infrastructure. There is no way to configure ConfigMgr to use different interfaces for different types of traffic. You could potentially manipulate the routing tables in Windows but that's asking
    for trouble IMO.
    Jason | http://blog.configmgrftw.com | @jasonsandys

  • System Center 2012 Endpoint Protection - any user may reboot Windows Server

    Hello,
    I've got System Center 2012 Endpoint Protection client installed on a Windows Server 2008 R2 Terminal Server. I've just noticed that if System Center Endpoint Protection detects some malware that requires system restart in order to successfully clean it,
    the notification will be seen by all logged users on Terminal Server and if anyone will press on "Restart" than the Server will reboot even if User hasn't the required permission and I think this is totally unacceptable, Microsoft has to do something
    about it. In all situations only an Administrator should have the right to restart the Server.
    Please fix this issue asap, thank you.

    While there is no setting that just controls the 'SCEP needs to reboot', there are other settings that might help.
    Have you tried setting "Disable the client user interface" to Yes on the antimalware policy?  How about "Show notifications messages..."?  I don't have a way to reproduce the behavior you were seeing, but maybe you can give it a shot.
    I understand why Microsoft would want to give non-admin users a prompt to reboot a machine that needs it to remove malware.  This is the typical scenario for most workstations. However, your exception with a terminal server is definitely something that
    needs a workaround. 
    If you put in Connect feedback asking for a discreet setting to control this, please post a link to it.
    I hope that helps,
    Nash
    Nash Pherson, Senior Systems Consultant
    Now Micro -
    My Blog Posts
    If you've found a bug or want the product worked differently,
    share your feedback.
    <-- If this post was helpful, please click "Vote as Helpful".

  • Can I get the detecting malware alert by System Center 2012 Endpoint Protection in Azure RemoteApp ?

    Can I get the detecting malware alert by System Center 2012 Endpoint Protection in Azure RemoteApp ?
    I want to get the alert and cleanup malware and alert our Azure RemoteApp users.
    the System Center 2012 Endpoint Protection exist Azure Virtual Machine gallery "Windows Server Remote Desktop Session Host”.
    I test the behavior of System Center 2012 Endpoint Protection by TrendMicro Malware sample "EICAR".
    Regards,
    Yoshihiro Kawabata

    Thank you Pavithra for reply.
    I have 3 points for alerting users and admins of Azure RemoteApp template image.
    point 1: Fix action.
      When the user detect a malware, There are some reasons,
      like viewing a malicious web site, like using the vulnerable applications.
      The User must fix his action in Azure RemoteApp session.
      "Hey, the reason is that you open this web site, Don't open this web site"
    point 2: Fix server.
      When the user detect a malware, ITpro of Azure RemoteApp fix the current Azure Virtual Machine of Azure RemoteApp.
      There may be infected with other malwares.
      ITpro need to fix the current Azure Virtual Machine of Azure RemoteApp before infecting other users.
      "Hey, This Azure RemoteApp collection will update with the template image after ten minutes."
    point 3: Fix damage.
      When the user detect a malware, ITpro of Azure RemoteApp research the damage of all system,
      like whether or not sent the infected email to other persons by other malware,
      like whether or not broken other related systems by other malwares.
      "Hey, Are other systems OK ?"
    Regards,
    Yoshihiro Kawabata     

  • Microsoft System Center 2012 Endpoint Protection compared to Sophos endpoint protection.

    Hi All,
    We are currently running Sophos Enterprise Console with Sophos Endpoint protection in our environment. We use most of the Sophos functionality with Device Control, Application Control, Disk Encryption and Tamper Protection. We are looking to move to
    Microsoft System Center 2012 Endpoint Protection, but is not sure if the Microsoft product will be able to offer us the same functionality as the Sophos product with the same level of protection.
    I have done some research and found that we will have to implement MDOP with System Center to come close to achieve our Sophos functionality. Is this true? Or can everything be centrally managed?
    Please advise with suggestions before we get rid of Sophos will be highly appreciated.
    Kind Regards,
    Francois Kaljee
    Regards Francois Kaljee IT Systems Administrator MCITP Svr2k8 Direct: +2712 381 1000 Cell: +2782 852 2367 Fax: +2786 602 8482 GPS: S 25 39.639 E 27 50.699 Hernic's Street Address: R/E of PTN 103 De Kroon 444 JQ Brits 0250 South Africa Hernic's
    Postal Address: P.O.Box 4534 Brits 0250 South Africa

    Most third-party security vendors have multiple products that they bundle together. You need to sit down and define your requirements in terms of functionality and features and then map those to Microsoft's offerings. Trying to find equivalent "products"
    won't really work.
    You also need to look at the cost. It's quite possible that many of the required MS technologies are available to you through your EA. This is the way to sell a strategy like this to your business.
    Simply comparing product features won't work. It should be a combination of
    1. what do I actually need?
    2. what will it cost?
    Gerry Hampson | Blog:
    www.gerryhampsoncm.blogspot.ie | LinkedIn:
    Gerry Hampson | Twitter:
    @gerryhampson

  • System Center 2012 Endpoint Protection manual scan from UNC

    We run SCCM 2012 R2, and 2012 Endpoint protection on a few servers.  I tried navigating to a UNC path, then right clicking and selecting 'Scan with System CEnter endpoint protection", but when doing so I get Scan completed on 0 items, regardless
    of the folder size I select.
    Is it not possible to scan a UNC path manually with SCEP 2012?
    Tony

    Hi,
    I think this is by design. There is no options from Antimalware Policies in console to control this.
    You could also have a look at the following thread.
    http://social.technet.microsoft.com/Forums/sqlserver/en-US/3713c941-f176-4b0f-897d-a0c4e14b4d4f/scep-2012-not-able-to-scan-network-sharesdrives
    Best Regards
    We
    are trying to better understand customer views on social support experience, so your participation in this
    interview project would be greatly appreciated if you have time.
    Thanks for helping make community forums a great place.

  • Custom BW Report by using this two data soucre

    Hi All,
               I am working on CRM 5.0 & BI 7.0
    1. I am having Data source( 0BPARTNER_ATTR & InfoObject : 0BPARTNER )
        this data source have all my custom fields & one more data source(0CRM_BPSALESCL_ATTR) it is having some fields
    2. This two data source are giving data in RSA3
    2 . I have to create custom BW Report by using this two data soucre
        i am new one to BW 
       so plz kindly help me step wise
    i ll Reward for helpful ans
    Thanks & Regards
    Ganes R

    Ganesh!!
    Build a logic between the two objects 0BPaRtner and 0crm_pssalescl, how are they related and find if you can link them. If that is the case then you can build infoset or MP between the two objects and create a report against the Provider. If the two objects are completely independent, then you can create APD and feed the transactional ods from two reports  from each Object and write a report from the transactional odb. The only disadvantage with this is you have to load the data frequently.
    Hope that guides you to the right direction.
    thanks.
    Wond

  • I updated my LG G3 this week and now it SUCKS!  When I'm connected to WIFI, nothing on Facebook works.  The photos and videos won't populate.  I have to turn off the WIFI and only use the mobile data. Not to mention, I really hate the way it looks now.

    I updated my LG G3 this week and now it SUCKS!  When I'm connected to WIFI, nothing on Facebook works.  The photos and videos won't populate.  I have to turn off the WIFI and only use the mobile data. Not to mention, I really hate the way it looks now.   Before I updated my phone, I really liked it, now I don't like my phone at all!  When will this be fixed? I hope it's soon.  I'm thinking of changing providers now.

    Does the iOS device connect to other networks? If yes that tend to indicate a problem with your network.
    Does the iOS device see the network?
    Any error messages?
    Do other devices now connect?
    Did the iOS device connect before?
    Try the following to rule out a software problem:                
    - Reset the iOS device. Nothing will be lost
    Reset iOS device: Hold down the On/Off button and the Home button at the same time for at
    least ten seconds, until the Apple logo appears.
    - Power off and then back on your router
    .- Reset network settings: Settings>General>Reset>Reset Network Settings
    - iOS: Troubleshooting Wi-Fi networks and connections
    - Wi-Fi: Unable to connect to an 802.11n Wi-Fi network      
    - iOS: Recommended settings for Wi-Fi routers and access points
    - Restore from backup. See:
    iOS: How to back up
    - Restore to factory settings/new iOS device.
    If still problem and it does not connect to any networks make an appointment at the Genius Bar of an Apple store since it appears you have a hardware problem.
    Apple Retail Store - Genius Bar

  • Use of end-date as part of Primary key in SAP Tables

    All,
    Any ideas on the rationale behind SAPs use of end-date as part of Primary key in general, specifically on condition Tables(A9xx for example) instead of Start-date? appreciate any help!!
    Best Regards
    TRP

    Hmm, another example is CSKS, this logic was probably designed already in the 1980s...maybe it was seen beneficial to be able to select the currently valid record by using the primary key only (the first record where DATBI is larger than system date, not possible when DATAB is the key instead).
    Maybe there are better explanations. Why do you need to know this, just curious?
    Thomas

Maybe you are looking for

  • Behaviuor in reading logs from DB13 - redo log backup for DB

      Hi all, I have a question , We have scheduled redo log backup using HP DP Tool. When I am reading a backup log from DB13 , I am facing the weird behavior. copy, delete, save 0000 aeomzyok.cds copy, delete, save 0001 aeomzyoh.cds Where ever the RC i

  • What is the "other" file type?

    When I go to [ > About This Mac > More Info... > Storage], I get this bar (that is just like the one in iTunes for the data storage on your device), telling me how much space my different file types take up. Most of the space is taken up by the yell

  • Ssis - Copy all tables exists in a DB to Destination flatfiles

    could anyone help me out with this task- Copy all tables exists in a DB to Destination flatfiles. Condition 1) Name of flat file should be name of the Table                   ex-   Employee.Txt               2) Flat files should be created in run tim

  • System rebooting every few hours....

    Z77A-G41, 2600K no overclock, 8 GB 1600, Win 7 Professional BIOS and all drivers up to date. Reboots seems to happen when I'm AFK not when computer is in active use.   Power management issue?

  • Satellite L300 heats up very fast

    Hi, My Toshiba satellite L300 heats up very fast, i've have had this notebook for around 2 years (26/5/2008). Recently it has over heated and shut off, this has happened twice. Just wondering if this is a hazard, or some thing i should look out for.