Two definition updates dueling

We have System Center Endpoint Protection installed. We are currently getting updates from our WSUS server and we have two different updates that seem to apply for this product. If you one of them then the other one shows up. And if you
install the second one then first one comes back needing to be installed.
The two updates are
Definition Update for Microsoft Endpoint Protection - KB2461484 (Definition 1.165.1899.0)
Definition Update for Microsoft Forefront Endpoint Protection 2010 - KB2461484 (Definiton 1.101.1659.0)
We unchecked the entire Forefront category on our WSUS server. But we are still getting both of these updates.
Any suggestion on how to remove the second update would be appreciated.

Hi,
Decline the superseded update and everything should be done.
Similar issue discussed below:
Forefront updates repeatedly offered
http://social.technet.microsoft.com/Forums/windowsserver/en-US/68696a03-e2e3-49fc-af2f-407bcde8c4e4/forefront-updates-repeatedly-offered?forum=winserverwsus
Errors When Using the FEP 2010 Definition Update Automation Tool
http://blogs.technet.com/b/clientsecurity/archive/2011/07/18/errors-when-using-the-fep-2010-definition-update-automation-tool.aspx
Hope this helps.

Similar Messages

SCEP 2012 manual definitions update for use in OSD

So I am setting up to deploy SCEP 2012 4.5.0216.0 during my OSD task sequence. I am following the guidelines laid out by the blog post:
http://blogs.technet.com/b/configmgrteam/archive/2012/04/12/operating-system-deployment-and-endpoint-protection-client-installation.aspx. I have created a package with the scepinstall.exe, EPAMPolicy.xml, and Install.cmd.
Note: I got the EPAMPolicy.xml from a client I let install SCEP the "normal way" by deploying client settings that said to install and manage the client.
I added to the EPAMPolicy.xml file:
<AddValue Name="DisableUpdateOnStartupWithoutEngine" Disabled="false" Type="REG_DWORD">1</AddValue>
Added it between:
<AddValue Name="AuGracePeriod" Type="REG_DWORD" Disabled="false">4320</AddValue>"I ADDED THE CODE RIGHT HERE"<AddValue Name="SignatureUpdateInterval" Type="REG_DWORD" Disabled="false">8</AddValue>
The "Install.cmd" contains:
"%~dp0scepinstall.exe" /s /q /NoSigsUpdateAtInitialExp /policy "%~dp0EPAMPolicy.xml"
So these things together install SCEP 2012 version 4.5.0216.0 and
cancels any definition updates when done installing and when the service first starts up. When the install finishes the client is RED since I cancelled all updates. This is WORKING FINE.
Now I have a package that contains the definition updates "mpam-fe.exe" and "nis_full.exe" as described in the linked blog. Running the proper 32/64 version of the mpam-fe.exe effectively updates the client Anti-malware definitions
to the version I have downloaded for that day. The client now turns GREEN. This is WORKING FINE.
The part that is not working is running the Network Inspection Service definitions, "nis_full.exe". It goes right through like it was fine when run manually, but when you check event log you see it put two errors in Event
Log. It also is causing my Task Sequence to fail.
I questioned how valid the nis_full.exe was anymore since the blog post is not real new...so I found:
http://support.microsoft.com/kb/935934. It is titled, "How to manually download the latest antimalware definition updates for Microsoft Forefront Client Security, Microsoft Forefront Endpoint
Protection 2010 and Microsoft System Center 2012 Endpoint Protection". I verified by downloading using the links given in that article that my files matched hash for hash.
In that article it does say if running SCEP 2012 to also install the nis_full.exe as administrator.
This is not working!
Any assistance is appreciated. Any better way to deploy SCEP during task sequence and definitions WITHOUT scanning for updates during "Install Software Updates" task or letting client go to
internet?
Find this post helpful? Does this post answer your question? Be sure to mark it appropriately to help others find answers to their searches.

Using the supplied EPAMPolicy2.xml did not resolve the issue. I still get an "0x80004005" error when I try to deploy the "nis_full.exe" during my task sequence. The client and malware definitions work as intended and install successfully. The NIS definitions
fail though.
Snippet of my SMSTS.LOG:
<![LOG[!--------------------------------------------------------------------------------------------!]LOG]!><time="09:37:58.886+240" date="05-30-2014" component="TSManager" context="" type="1" thread="540" file="instruction.cxx:804">
<![LOG[Successfully completed the action (Install SCEP 2012 Anti-malware Defs) with the exit win32 code 0]LOG]!><time="09:37:58.886+240" date="05-30-2014" component="TSManager" context="" type="1" thread="540" file="instruction.cxx:830">
<![LOG[MP server https://SCCMSRV.domain.local. Ports 80,443. CRL=false.]LOG]!><time="09:37:58.886+240" date="05-30-2014" component="TSManager" context="" type="1" thread="540" file="utils.cpp:5881">
<![LOG[Setting authenticator]LOG]!><time="09:37:58.901+240" date="05-30-2014" component="TSManager" context="" type="1" thread="540" file="utils.cpp:5903">
<![LOG[Set authenticator in transport]LOG]!><time="09:37:58.901+240" date="05-30-2014" component="TSManager" context="" type="0" thread="540" file="libsmsmessaging.cpp:7734">
<![LOG[Sending StatusMessage]LOG]!><time="09:37:58.917+240" date="05-30-2014" component="TSManager" context="" type="1" thread="540" file="libsmsmessaging.cpp:4023">
<![LOG[Setting message signatures.]LOG]!><time="09:37:58.932+240" date="05-30-2014" component="TSManager" context="" type="0" thread="540" file="libsmsmessaging.cpp:1295">
<![LOG[Setting the authenticator.]LOG]!><time="09:37:58.932+240" date="05-30-2014" component="TSManager" context="" type="0" thread="540" file="libsmsmessaging.cpp:1325">
<![LOG[CLibSMSMessageWinHttpTransport::Send: URL: SCCMSRV.domain.local:443 CCM_POST /ccm_system_AltAuth/request]LOG]!><time="09:37:58.932+240" date="05-30-2014" component="TSManager" context="" type="1" thread="540" file="libsmsmessaging.cpp:8604">
<![LOG[In SSL, but with no client cert]LOG]!><time="09:37:58.932+240" date="05-30-2014" component="TSManager" context="" type="1" thread="540" file="libsmsmessaging.cpp:8738">
<![LOG[Request was successful.]LOG]!><time="09:37:58.964+240" date="05-30-2014" component="TSManager" context="" type="0" thread="540" file="libsmsmessaging.cpp:8939">
<![LOG[Set a global environment variable _SMSTSLastActionRetCode=0]LOG]!><time="09:37:58.964+240" date="05-30-2014" component="TSManager" context="" type="0" thread="540" file="executionenv.cxx:668">
<![LOG[Set a global environment variable _SMSTSLastActionSucceeded=true]LOG]!><time="09:37:58.964+240" date="05-30-2014" component="TSManager" context="" type="0" thread="540" file="executionenv.cxx:668">
<![LOG[Clear local default environment]LOG]!><time="09:37:58.964+240" date="05-30-2014" component="TSManager" context="" type="0" thread="540" file="executionenv.cxx:807">
<![LOG[Updated security on object C:\_SMSTaskSequence.]LOG]!><time="09:37:59.026+240" date="05-30-2014" component="TSManager" context="" type="1" thread="540" file="utils.cpp:1704">
<![LOG[Set a global environment variable _SMSTSNextInstructionPointer=15]LOG]!><time="09:37:59.026+240" date="05-30-2014" component="TSManager" context="" type="0" thread="540" file="executionenv.cxx:668">
<![LOG[Set a TS execution environment variable _SMSTSNextInstructionPointer=15]LOG]!><time="09:37:59.026+240" date="05-30-2014" component="TSManager" context="" type="0" thread="540" file="executionenv.cxx:386">
<![LOG[Set a global environment variable _SMSTSInstructionStackString=10 12]LOG]!><time="09:37:59.026+240" date="05-30-2014" component="TSManager" context="" type="0" thread="540" file="executionenv.cxx:668">
<![LOG[Set a TS execution environment variable _SMSTSInstructionStackString=10 12]LOG]!><time="09:37:59.026+240" date="05-30-2014" component="TSManager" context="" type="0" thread="540" file="executionenv.cxx:414">
<![LOG[Save the current environment block]LOG]!><time="09:37:59.026+240" date="05-30-2014" component="TSManager" context="" type="0" thread="540" file="executionenv.cxx:833">
<![LOG[Successfully save execution state and environment to local hard disk]LOG]!><time="09:37:59.182+240" date="05-30-2014" component="TSManager" context="" type="1" thread="540" file="engine.cxx:254">
<![LOG[Start executing an instruction. Instruction name: Install SCEP 2012 NIS Defs. Instruction pointer: 15]LOG]!><time="09:37:59.182+240" date="05-30-2014" component="TSManager" context="" type="1" thread="540" file="engine.cxx:116">
<![LOG[Set a global environment variable _SMSTSCurrentActionName=Install SCEP 2012 NIS Defs]LOG]!><time="09:37:59.182+240" date="05-30-2014" component="TSManager" context="" type="0" thread="540" file="executionenv.cxx:668">
<![LOG[Set a global environment variable _SMSTSNextInstructionPointer=15]LOG]!><time="09:37:59.182+240" date="05-30-2014" component="TSManager" context="" type="0" thread="540" file="executionenv.cxx:668">
<![LOG[Set a local default variable _SMSSWDProgramName]LOG]!><time="09:37:59.197+240" date="05-30-2014" component="TSManager" context="" type="0" thread="540" file="executionenv.cxx:700">
<![LOG[Set a global environment variable _SMSTSLogPath=C:\Windows\CCM\Logs\SMSTSLog]LOG]!><time="09:37:59.197+240" date="05-30-2014" component="TSManager" context="" type="0" thread="540" file="executionenv.cxx:668">
<![LOG[Expand a string: smsswd.exe /pkg:PR100043 /install /basevar: /continueOnError:]LOG]!><time="09:37:59.197+240" date="05-30-2014" component="TSManager" context="" type="0" thread="540" file="executionenv.cxx:782">
<![LOG[Expand a string: ]LOG]!><time="09:37:59.197+240" date="05-30-2014" component="TSManager" context="" type="0" thread="540" file="executionenv.cxx:782">
<![LOG[Command line for extension .exe is "%1" %*]LOG]!><time="09:37:59.197+240" date="05-30-2014" component="TSManager" context="" type="0" thread="540" file="commandline.cpp:228">
<![LOG[Set command line: smsswd.exe /pkg:PR100043 /install /basevar: /continueOnError:]LOG]!><time="09:37:59.197+240" date="05-30-2014" component="TSManager" context="" type="0" thread="540" file="commandline.cpp:731">
<![LOG[Start executing the command line: smsswd.exe /pkg:PR100043 /install /basevar: /continueOnError:]LOG]!><time="09:37:59.197+240" date="05-30-2014" component="TSManager" context="" type="1" thread="540" file="instruction.cxx:722">
<![LOG[!--------------------------------------------------------------------------------------------!]LOG]!><time="09:37:59.197+240" date="05-30-2014" component="TSManager" context="" type="1" thread="540" file="instruction.cxx:751">
<![LOG[Expand a string: FullOS]LOG]!><time="09:37:59.197+240" date="05-30-2014" component="TSManager" context="" type="0" thread="540" file="executionenv.cxx:782">
<![LOG[Executing command line: smsswd.exe /pkg:PR100043 /install /basevar: /continueOnError:]LOG]!><time="09:37:59.197+240" date="05-30-2014" component="TSManager" context="" type="1" thread="540" file="commandline.cpp:827">
<![LOG[[ smsswd.exe ]]LOG]!><time="09:37:59.587+240" date="05-30-2014" component="InstallSoftware" context="" type="1" thread="2136" file="main.cpp:289">
<![LOG[PackageID = 'PR100043']LOG]!><time="09:37:59.618+240" date="05-30-2014" component="InstallSoftware" context="" type="1" thread="2136" file="main.cpp:318">
<![LOG[BaseVar = '', ContinueOnError='']LOG]!><time="09:37:59.618+240" date="05-30-2014" component="InstallSoftware" context="" type="1" thread="2136" file="main.cpp:319">
<![LOG[ProgramName = 'Install NIS Definitions']LOG]!><time="09:37:59.618+240" date="05-30-2014" component="InstallSoftware" context="" type="1" thread="2136" file="main.cpp:320">
<![LOG[SwdAction = '0002']LOG]!><time="09:37:59.618+240" date="05-30-2014" component="InstallSoftware" context="" type="1" thread="2136" file="main.cpp:321">
<![LOG[GetExecRequestMgrInterface successful]LOG]!><time="09:37:59.650+240" date="05-30-2014" component="InstallSoftware" context="" type="0" thread="2136" file="installsoftware.cpp:187">
<![LOG[Retrieving value from TSEnv for '_SMSTSPolicyPR100043_Install NIS Definitions']LOG]!><time="09:37:59.650+240" date="05-30-2014" component="InstallSoftware" context="" type="0" thread="2136" file="installsoftware.cpp:85">
<![LOG[::DecompressBuffer(65536)]LOG]!><time="09:37:59.650+240" date="05-30-2014" component="InstallSoftware" context="" type="0" thread="2136" file="ccmzlib.cpp:739">
<![LOG[Decompression (zlib) succeeded: original size 3059, uncompressed size 39008.]LOG]!><time="09:37:59.650+240" date="05-30-2014" component="InstallSoftware" context="" type="0" thread="2136" file="ccmzlib.cpp:651">
<![LOG[ADV_AdvertisementID=PR120019]LOG]!><time="09:37:59.712+240" date="05-30-2014" component="InstallSoftware" context="" type="1" thread="2136" file="installsoftware.cpp:1151">
<![LOG[PKG_PSF_ContainsSourceFiles=TRUE]LOG]!><time="09:37:59.712+240" date="05-30-2014" component="InstallSoftware" context="" type="1" thread="2136" file="installsoftware.cpp:1170">
<![LOG[ResolveSource flags: 0x00000000]LOG]!><time="09:37:59.712+240" date="05-30-2014" component="InstallSoftware" context="" type="1" thread="2136" file="resolvesource.cpp:3201">
<![LOG[SMSTSPersistContent: . The content for package PR100043 will be persisted]LOG]!><time="09:37:59.712+240" date="05-30-2014" component="InstallSoftware" context="" type="1" thread="2136" file="resolvesource.cpp:3212">
<![LOG[The package PR100043 is found locally in the cache C:\_SMSTaskSequence\Packages\PR100043]LOG]!><time="09:37:59.712+240" date="05-30-2014" component="InstallSoftware" context="" type="1" thread="2136" file="resolvesource.cpp:3242">
<![LOG[SMS PkgID 'PR100043' resolved to location 'C:\_SMSTaskSequence\Packages\PR100043']LOG]!><time="09:37:59.712+240" date="05-30-2014" component="InstallSoftware" context="" type="1" thread="2136" file="installsoftware.cpp:145">
<![LOG[Start to compile TS policy]LOG]!><time="09:37:59.712+240" date="05-30-2014" component="InstallSoftware" context="" type="0" thread="2136" file="utils.cpp:3066">
<![LOG[Policy complied successfully in WMI 'root\ccm\policy\defaultmachine\requestedconfig' namespace]LOG]!><time="09:37:59.837+240" date="05-30-2014" component="InstallSoftware" context="" type="1" thread="2136" file="utils.cpp:3167">
<![LOG[End TS policy compilation]LOG]!><time="09:37:59.837+240" date="05-30-2014" component="InstallSoftware" context="" type="0" thread="2136" file="utils.cpp:3171">
<![LOG[getPointer()->ExecQuery( BString(L"WQL"), BString(pszQuery), lFlags, pContext, ppEnum ), HRESULT=80041017 (e:\nts_sccm_release\sms\framework\core\ccmcore\wminamespace.cpp,463)]LOG]!><time="09:37:59.837+240" date="05-30-2014" component="InstallSoftware" context="" type="0" thread="2136" file="wminamespace.cpp:463">
<![LOG[Failed to query CCM_SoftwareDistribution]LOG]!><time="09:37:59.837+240" date="05-30-2014" component="InstallSoftware" context="" type="2" thread="2136" file="installsoftware.cpp:729">
<![LOG[Get Install Directory for SMS Client]LOG]!><time="09:37:59.837+240" date="05-30-2014" component="InstallSoftware" context="" type="0" thread="2136" file="utils.cpp:4215">
<![LOG[Start to evaluate TS policy with lock]LOG]!><time="09:38:00.024+240" date="05-30-2014" component="InstallSoftware" context="" type="1" thread="2136" file="policyutil.cpp:10966">
<![LOG[Locked policy transaction lock successfully]LOG]!><time="09:38:00.039+240" date="05-30-2014" component="InstallSoftware" context="" type="0" thread="2136" file="policyutil.cpp:8021">
<![LOG[Updating settings in \\.\root\ccm\policy\machine\actualconfig]LOG]!><time="09:38:00.039+240" date="05-30-2014" component="InstallSoftware" context="" type="1" thread="2136" file="policyutil.cpp:8024">
<![LOG[RequestedConfig policy instance(s) : 437]LOG]!><time="09:38:00.086+240" date="05-30-2014" component="InstallSoftware" context="" type="0" thread="2136" file="policyutil.cpp:7653">
<![LOG[Locked \\.\ROOT\ccm\Policy\Machine\RequestedConfig for source SMS:Client:Default:{8864FB91-94EE-4F16-A144-0D82A232049D} successfully]LOG]!><time="09:38:00.086+240" date="05-30-2014" component="InstallSoftware" context="" type="0" thread="2136" file="policyutil.cpp:7463">
<![LOG[Namespace: \\.\ROOT\ccm\Policy\Machine\RequestedConfig, Query: SELECT PolicyID FROM CCM_Policy_Policy5 WHERE (PolicySource = "SMS:Client:Default:{8864FB91-94EE-4F16-A144-0D82A232049D}") AND (PolicyState = "Active") AND (PolicyType = "Machine")]LOG]!><time="09:38:00.086+240" date="05-30-2014" component="InstallSoftware" context="" type="1" thread="2136" file="policyutil.cpp:7511">
<![LOG[There is no ccm_policy_policy instance, skipping addition to realinst map]LOG]!><time="09:38:00.086+240" date="05-30-2014" component="InstallSoftware" context="" type="1" thread="2136" file="policyutil.cpp:7512">
<![LOG[Unlocked \\.\ROOT\ccm\Policy\Machine\RequestedConfig for source SMS:Client:Default:{8864FB91-94EE-4F16-A144-0D82A232049D} successfully]LOG]!><time="09:38:00.086+240" date="05-30-2014" component="InstallSoftware" context="" type="0" thread="2136" file="policyutil.cpp:7660">
<![LOG[RequestedConfig policy instance(s) : 0]LOG]!><time="09:38:00.102+240" date="05-30-2014" component="InstallSoftware" context="" type="0" thread="2136" file="policyutil.cpp:7653">
<![LOG[Locked \\.\ROOT\ccm\Policy\Machine\RequestedConfig for source SMS:PR1 successfully]LOG]!><time="09:38:00.102+240" date="05-30-2014" component="InstallSoftware" context="" type="0" thread="2136" file="policyutil.cpp:7463">
<![LOG[Namespace: \\.\ROOT\ccm\Policy\Machine\RequestedConfig, Query: SELECT PolicyID FROM CCM_Policy_Policy5 WHERE (PolicySource = "SMS:PR1") AND (PolicyState = "Active") AND (PolicyType = "Machine")]LOG]!><time="09:38:00.102+240" date="05-30-2014" component="InstallSoftware" context="" type="1" thread="2136" file="policyutil.cpp:7511">
<![LOG[There is no ccm_policy_policy instance, skipping addition to realinst map]LOG]!><time="09:38:00.102+240" date="05-30-2014" component="InstallSoftware" context="" type="1" thread="2136" file="policyutil.cpp:7512">
<![LOG[Unlocked \\.\ROOT\ccm\Policy\Machine\RequestedConfig for source SMS:PR1 successfully]LOG]!><time="09:38:00.102+240" date="05-30-2014" component="InstallSoftware" context="" type="0" thread="2136" file="policyutil.cpp:7660">
<![LOG[RequestedConfig policy instance(s) : 0]LOG]!><time="09:38:00.102+240" date="05-30-2014" component="InstallSoftware" context="" type="0" thread="2136" file="policyutil.cpp:7653">
<![LOG[Locked \\.\ROOT\ccm\Policy\Machine\RequestedConfig for source CcmPortal successfully]LOG]!><time="09:38:00.102+240" date="05-30-2014" component="InstallSoftware" context="" type="0" thread="2136" file="policyutil.cpp:7463">
<![LOG[Namespace: \\.\ROOT\ccm\Policy\Machine\RequestedConfig, Query: SELECT PolicyID FROM CCM_Policy_Policy5 WHERE (PolicySource = "CcmPortal") AND (PolicyState = "Active") AND (PolicyType = "Machine")]LOG]!><time="09:38:00.102+240" date="05-30-2014" component="InstallSoftware" context="" type="1" thread="2136" file="policyutil.cpp:7511">
<![LOG[There is no ccm_policy_policy instance, skipping addition to realinst map]LOG]!><time="09:38:00.102+240" date="05-30-2014" component="InstallSoftware" context="" type="1" thread="2136" file="policyutil.cpp:7512">
<![LOG[Unlocked \\.\ROOT\ccm\Policy\Machine\RequestedConfig for source CcmPortal successfully]LOG]!><time="09:38:00.102+240" date="05-30-2014" component="InstallSoftware" context="" type="0" thread="2136" file="policyutil.cpp:7660">
<![LOG[RequestedConfig policy instance(s) : 0]LOG]!><time="09:38:00.117+240" date="05-30-2014" component="InstallSoftware" context="" type="0" thread="2136" file="policyutil.cpp:7653">
<![LOG[Locked \\.\ROOT\ccm\Policy\Machine\RequestedConfig for source Local successfully]LOG]!><time="09:38:00.117+240" date="05-30-2014" component="InstallSoftware" context="" type="0" thread="2136" file="policyutil.cpp:7463">
<![LOG[RequestedConfig policy instance(s) : 9]LOG]!><time="09:38:00.117+240" date="05-30-2014" component="InstallSoftware" context="" type="0" thread="2136" file="policyutil.cpp:7653">
<![LOG[Unlocked \\.\ROOT\ccm\Policy\Machine\RequestedConfig for source Local successfully]LOG]!><time="09:38:00.117+240" date="05-30-2014" component="InstallSoftware" context="" type="0" thread="2136" file="policyutil.cpp:7660">
<![LOG[RequestedConfig policy instance(s) : 15]LOG]!><time="09:38:00.133+240" date="05-30-2014" component="InstallSoftware" context="" type="0" thread="2136" file="policyutil.cpp:7653">
<![LOG[Locked \\.\ROOT\ccm\Policy\Machine\RequestedConfig for source CcmTaskSequence successfully]LOG]!><time="09:38:00.133+240" date="05-30-2014" component="InstallSoftware" context="" type="0" thread="2136" file="policyutil.cpp:7463">
<![LOG[Namespace: \\.\ROOT\ccm\Policy\Machine\RequestedConfig, Query: SELECT PolicyID FROM CCM_Policy_Policy5 WHERE (PolicySource = "CcmTaskSequence") AND (PolicyState = "Active") AND (PolicyType = "Machine")]LOG]!><time="09:38:00.258+240" date="05-30-2014" component="InstallSoftware" context="" type="1" thread="2136" file="policyutil.cpp:7511">
<![LOG[There is no ccm_policy_policy instance, skipping addition to realinst map]LOG]!><time="09:38:00.258+240" date="05-30-2014" component="InstallSoftware" context="" type="1" thread="2136" file="policyutil.cpp:7512">
<![LOG[Unlocked \\.\ROOT\ccm\Policy\Machine\RequestedConfig for source CcmTaskSequence successfully]LOG]!><time="09:38:00.258+240" date="05-30-2014" component="InstallSoftware" context="" type="0" thread="2136" file="policyutil.cpp:7660">
<![LOG[Total RequestedConfig policy instance(s) : 461]LOG]!><time="09:38:00.336+240" date="05-30-2014" component="InstallSoftware" context="" type="0" thread="2136" file="policyutil.cpp:8186">
<![LOG[Locked ActualConfig successfully]LOG]!><time="09:38:00.336+240" date="05-30-2014" component="InstallSoftware" context="" type="0" thread="2136" file="policyutil.cpp:8199">
<![LOG[New/Changed ActualConfig policy instance(s) : 1]LOG]!><time="09:38:00.382+240" date="05-30-2014" component="InstallSoftware" context="" type="0" thread="2136" file="policyutil.cpp:8278">
<![LOG[[1] Added/updated setting 'ccm_softwaredistribution:adv_advertisementid=it120019:pkg_packageid=it100043:prg_programid=install nis definitions'.]LOG]!><time="09:38:00.382+240" date="05-30-2014" component="InstallSoftware" context="" type="0" thread="2136" file="policyutil.cpp:8307">
<![LOG[Unlocked ActualConfig successfully]LOG]!><time="09:38:00.382+240" date="05-30-2014" component="InstallSoftware" context="" type="0" thread="2136" file="policyutil.cpp:8333">
<![LOG[Unlocked policy transaction lock successfully]LOG]!><time="09:38:00.382+240" date="05-30-2014" component="InstallSoftware" context="" type="0" thread="2136" file="policyutil.cpp:8339">
<![LOG[Raising event:
instance of CCM_PolicyAgent_SettingsEvaluationComplete
ClientID = "GUID:d69a4ca6-a93a-479d-89aa-c85113eaef67";
DateTime = "20140530133800.382000+000";
PolicyNamespace = "\\\\.\\root\\ccm\\policy\\machine\\actualconfig";
ProcessID = 1084;
ThreadID = 2136;
]LOG]!><time="09:38:00.382+240" date="05-30-2014" component="InstallSoftware" context="" type="1" thread="2136" file="event.cpp:715">
<![LOG[Successfully submitted event to the Status Agent.]LOG]!><time="09:38:00.398+240" date="05-30-2014" component="InstallSoftware" context="" type="0" thread="2136" file="event.cpp:733">
<![LOG[End TS policy evaluation]LOG]!><time="09:38:00.398+240" date="05-30-2014" component="InstallSoftware" context="" type="1" thread="2136" file="policyutil.cpp:10969">
<![LOG[Policy evaluation initiated]LOG]!><time="09:38:00.398+240" date="05-30-2014" component="InstallSoftware" context="" type="1" thread="2136" file="utils.cpp:4253">
<![LOG[Waiting for policy to be compiled in 'root\ccm\policy\machine' namespace ]LOG]!><time="09:38:00.398+240" date="05-30-2014" component="InstallSoftware" context="" type="1" thread="2136" file="installsoftware.cpp:383">
<![LOG[Query path = 'CCM_SoftwareDistribution.ADV_AdvertisementID="PR120019",PRG_ProgramID="Install NIS Definitions",PKG_PackageID="PR100043"']LOG]!><time="09:38:00.398+240" date="05-30-2014" component="InstallSoftware" context="" type="1" thread="2136" file="installsoftware.cpp:414">
<![LOG[Verified policy is compiled in 'root\ccm\policy\machine' namespace]LOG]!><time="09:38:00.445+240" date="05-30-2014" component="InstallSoftware" context="" type="1" thread="2136" file="installsoftware.cpp:439">
<![LOG[content location count = 1]LOG]!><time="09:38:00.507+240" date="05-30-2014" component="InstallSoftware" context="" type="1" thread="2136" file="installsoftware.cpp:231">
<![LOG[Checking if the active request handle: {66096B8A-60B8-4CC3-ABBA-D0CD624938C4} is valid.]LOG]!><time="09:38:00.507+240" date="05-30-2014" component="InstallSoftware" context="" type="0" thread="2136" file="utils.cpp:5052">
<![LOG[CoCreateInstance succeeded]LOG]!><time="09:38:00.507+240" date="05-30-2014" component="InstallSoftware" context="" type="0" thread="2136" file="utils.cpp:5074">
<![LOG[Active request handle: {66096B8A-60B8-4CC3-ABBA-D0CD624938C4} is valid.]LOG]!><time="09:38:00.507+240" date="05-30-2014" component="InstallSoftware" context="" type="0" thread="2136" file="utils.cpp:5082">
<![LOG[Invoking Execution Manager to install software ]LOG]!><time="09:38:00.507+240" date="05-30-2014" component="InstallSoftware" context="" type="0" thread="2136" file="installsoftware.cpp:246">
<![LOG[Installing software for PackageID='PR100043' ProgramID='Install NIS Definitions' AdvertID='PR120019' has started, jobID='{F528EBD4-1270-44E5-9539-5B5346BAE5A4}']LOG]!><time="09:38:00.803+240" date="05-30-2014" component="InstallSoftware" context="" type="1" thread="2136" file="installsoftware.cpp:268">
<![LOG[Setting TSEnv variable 'SMSTSInstallSoftwareJobID_PR100043_PR120019_Install NIS Definitions'='{F528EBD4-1270-44E5-9539-5B5346BAE5A4}']LOG]!><time="09:38:00.803+240" date="05-30-2014" component="InstallSoftware" context="" type="1" thread="2136" file="installsoftware.cpp:52">
<![LOG[Waiting for installation job to complete..]LOG]!><time="09:38:00.803+240" date="05-30-2014" component="InstallSoftware" context="" type="1" thread="2136" file="installsoftware.cpp:873">
<![LOG[CompleteExecution received]LOG]!><time="09:38:03.033+240" date="05-30-2014" component="InstallSoftware" context="" type="0" thread="1524" file="installsoftware.cpp:580">
<![LOG[CompleteExecution processed]LOG]!><time="09:38:03.033+240" date="05-30-2014" component="InstallSoftware" context="" type="0" thread="1524" file="installsoftware.cpp:593">
<![LOG[Received job completion notification from Execution Manager]LOG]!><time="09:38:03.033+240" date="05-30-2014" component="InstallSoftware" context="" type="1" thread="2136" file="installsoftware.cpp:923">
<![LOG[Installation completed with exit code 0x80004005]LOG]!><time="09:38:03.033+240" date="05-30-2014" component="InstallSoftware" context="" type="1" thread="2136" file="installsoftware.cpp:940">
<![LOG[Installation failed with error (0x80004005)]LOG]!><time="09:38:03.033+240" date="05-30-2014" component="InstallSoftware" context="" type="3" thread="2136" file="installsoftware.cpp:967">
<![LOG[Setting TSEnv variable 'SMSTSInstallSoftwareJobID_PR100043_PR120019_Install NIS Definitions'='']LOG]!><time="09:38:03.033+240" date="05-30-2014" component="InstallSoftware" context="" type="1" thread="2136" file="installsoftware.cpp:52">
<![LOG[GetExecRequestMgrInterface successful]LOG]!><time="09:38:03.033+240" date="05-30-2014" component="InstallSoftware" context="" type="0" thread="2136" file="installsoftware.cpp:187">
<![LOG[Releasing job request, jobID='{F528EBD4-1270-44E5-9539-5B5346BAE5A4}']LOG]!><time="09:38:03.033+240" date="05-30-2014" component="InstallSoftware" context="" type="0" thread="2136" file="installsoftware.cpp:339">
<![LOG[Releasing of Job Request successful]LOG]!><time="09:38:03.033+240" date="05-30-2014" component="InstallSoftware" context="" type="1" thread="2136" file="installsoftware.cpp:348">
<![LOG[CompleteJob successful]LOG]!><time="09:38:03.033+240" date="05-30-2014" component="InstallSoftware" context="" type="1" thread="2136" file="installsoftware.cpp:997">
<![LOG[ReleaseSource() for C:\_SMSTaskSequence\Packages\PR100043.]LOG]!><time="09:38:03.033+240" date="05-30-2014" component="InstallSoftware" context="" type="1" thread="2136" file="resolvesource.cpp:3564">
<![LOG[reference count 1 for the source C:\_SMSTaskSequence\Packages\PR100043 before releasing]LOG]!><time="09:38:03.033+240" date="05-30-2014" component="InstallSoftware" context="" type="1" thread="2136" file="resolvesource.cpp:3574">
<![LOG[Released the resolved source C:\_SMSTaskSequence\Packages\PR100043]LOG]!><time="09:38:03.033+240" date="05-30-2014" component="InstallSoftware" context="" type="1" thread="2136" file="resolvesource.cpp:3612">
<![LOG[pInstall->Install(sPackageID, sProgramName), HRESULT=80004005 (e:\nts_sccm_release\sms\client\osdeployment\installsoftware\main.cpp,361)]LOG]!><time="09:38:03.033+240" date="05-30-2014" component="InstallSoftware" context="" type="0" thread="2136" file="main.cpp:361">
<![LOG[Install Software failed, hr=0x80004005]LOG]!><time="09:38:03.033+240" date="05-30-2014" component="InstallSoftware" context="" type="3" thread="2136" file="main.cpp:361">
<![LOG[Process completed with exit code 2147500037]LOG]!><time="09:38:03.049+240" date="05-30-2014" component="TSManager" context="" type="1" thread="540" file="commandline.cpp:1123">
<![LOG[!--------------------------------------------------------------------------------------------!]LOG]!><time="09:38:03.049+240" date="05-30-2014" component="TSManager" context="" type="1" thread="540" file="instruction.cxx:804">
<![LOG[Failed to run the action: Install SCEP 2012 NIS Defs.
Unspecified error (Error: 80004005; Source: Windows)]LOG]!><time="09:38:03.049+240" date="05-30-2014" component="TSManager" context="" type="3" thread="540" file="instruction.cxx:895">
<![LOG[MP server https://SCCMSRV.domain.local. Ports 80,443. CRL=false.]LOG]!><time="09:38:03.049+240" date="05-30-2014" component="TSManager" context="" type="1" thread="540" file="utils.cpp:5881">
<![LOG[Setting authenticator]LOG]!><time="09:38:03.064+240" date="05-30-2014" component="TSManager" context="" type="1" thread="540" file="utils.cpp:5903">
<![LOG[Set authenticator in transport]LOG]!><time="09:38:03.064+240" date="05-30-2014" component="TSManager" context="" type="0" thread="540" file="libsmsmessaging.cpp:7734">
<![LOG[Sending StatusMessage]LOG]!><time="09:38:03.080+240" date="05-30-2014" component="TSManager" context="" type="1" thread="540" file="libsmsmessaging.cpp:4023">
<![LOG[Setting message signatures.]LOG]!><time="09:38:03.096+240" date="05-30-2014" component="TSManager" context="" type="0" thread="540" file="libsmsmessaging.cpp:1295">
<![LOG[Setting the authenticator.]LOG]!><time="09:38:03.096+240" date="05-30-2014" component="TSManager" context="" type="0" thread="540" file="libsmsmessaging.cpp:1325">
<![LOG[CLibSMSMessageWinHttpTransport::Send: URL: SCCMSRV.domain.local:443 CCM_POST /ccm_system_AltAuth/request]LOG]!><time="09:38:03.096+240" date="05-30-2014" component="TSManager" context="" type="1" thread="540" file="libsmsmessaging.cpp:8604">
<![LOG[In SSL, but with no client cert]LOG]!><time="09:38:03.096+240" date="05-30-2014" component="TSManager" context="" type="1" thread="540" file="libsmsmessaging.cpp:8738">
<![LOG[Request was successful.]LOG]!><time="09:38:03.111+240" date="05-30-2014" component="TSManager" context="" type="0" thread="540" file="libsmsmessaging.cpp:8939">
<![LOG[Set a global environment variable _SMSTSLastActionRetCode=-2147467259]LOG]!><time="09:38:03.111+240" date="05-30-2014" component="TSManager" context="" type="0" thread="540" file="executionenv.cxx:668">
<![LOG[Set a global environment variable _SMSTSLastActionSucceeded=false]LOG]!><time="09:38:03.111+240" date="05-30-2014" component="TSManager" context="" type="0" thread="540" file="executionenv.cxx:668">
<![LOG[Clear local default environment]LOG]!><time="09:38:03.111+240" date="05-30-2014" component="TSManager" context="" type="0" thread="540" file="executionenv.cxx:807">
<![LOG[Let the parent group (Install Endpoint Protection) decides whether to continue execution]LOG]!><time="09:38:03.111+240" date="05-30-2014" component="TSManager" context="" type="0" thread="540" file="instruction.cxx:1004">
<![LOG[Let the parent group (Setup Operating System) decide whether to continue execution]LOG]!><time="09:38:03.111+240" date="05-30-2014" component="TSManager" context="" type="0" thread="540" file="instruction.cxx:254">
<![LOG[The execution of the group (Setup Operating System) has failed and the execution has been aborted. An action failed.
Operation aborted (Error: 80004004; Source: Windows)]LOG]!><time="09:38:03.111+240" date="05-30-2014" component="TSManager" context="" type="3" thread="540" file="instruction.cxx:217">
<![LOG[Failed to run the last action: Install SCEP 2012 NIS Defs. Execution of task sequence failed.
Unspecified error (Error: 80004005; Source: Windows)]LOG]!><time="09:38:03.111+240" date="05-30-2014" component="TSManager" context="" type="3" thread="540" file="engine.cxx:213">
Find this post helpful? Does this post answer your question? Be sure to mark it appropriately to help others find answers to their searches.

SCEP 2012 definition updates makes no sense

Hi, i´m trying to figure out how SCEP updates are working, we are evaluating SCEP on some servers and workstations at the moment and some clients have the latest updates, some have one version old, and som have even older.
For example.
This morning at 04:00 we had an SUP sync and a ADR was created at 04:02 with definition version 1.169.1999.0.
Today at 10:27 one of the clients updated its definition, but to version 1.169.1904.0. Why did it choose an old update? Several clients had already updated to the .1999 version. And why so late? Our antimalware policy is set to check for updates every 1 hour.
The computer powered on at 07:45.
I have looked in the MPlog.log file, but it doesnt make sense either, according to one machine it updated to definition v.1.169.1258.0 mars 31. it is the latest record, but when i check SCEP gui on that machine it have updated to 1.169.2028.0 today.
What am i missing?
Regards Erik

1: And with this configuration all your clients gets all definitions that MS releases during a day?
It looks to me with that config that you will only get definitions that releases before 5AM and then if it arrives 2 more definitions that day you will not recieve them until the next day. is that correct?
2&3: Yeah, i need to do more trouble shooting, yesterday before I went home i made sure that we used Client Notification and that the FW port was open. I set antimalware policy to: update interval: 0. Two sources (configmgr and ms update). Daily update
check at 12 AM. And force to look outside ConfigMgr if no definitions have come within 24 hours from the last update.
It still goes outside to update definitions from MS Update.
I have now set "If ConfigMgr is used as a source for definition updates, clients will only update form alternative source if a definition is older than _ hours" to 720, so hopefully it will start getting updates from only ConfigMgr so i see that it
works.
5: The SCEP ADR is targeted to a collection that includes two other collections.
Client collection: A query that gets all windows 8.1 workstations.
Server collection: A query that gets group membership from Active Directory
6: One more thing, how is it about multiple antimalware policys? we have the default policy at order 10000 and then we have an others at order 1 and 2. For server the default and the one at order 2 active. both have different definition updates entries, but
the one i want to win is in the policy with order 2. the policy with order 2 will always win, right?

Windows 8.1 store apps aren't running after definition update of windows defender!!!

I am currently running windows 8.1 pro with media centre. 15 days back I installed this update
"Definition Update for Windows Defender - KB2267602 (Definition 1.189.752.0)"
after which my all windows apps(precisely metro apps/windows store apps) stoped working. Whenever I open such apps they dont get open. Sadly this update not uninstallable. I restored my system to the previous date. and all the apps started working
again. But now yesterday my windows updated again & now again I am in the same situation and this time I am unable to restore my windows as there is not restore point left. :/
Can any body help me out with this? I have scanned my Pc with Kapsersky2014, no viruses are found on system.

Hi,
Before returning the system to a previous restore point, we can first do some troubleshooting and see whether it KB2267602 that case this issue.
First, I suggest you run wsreset.exe to clear the Windows Store cache, most issues are caused by the cache, then you can also chec other solutions in the link below:
http://blogs.technet.com/b/askperf/archive/2013/10/11/what-to-do-if-your-windows-8-modern-app-fails-to-start.aspx
http://blogs.technet.com/b/ouc1too/archive/2013/10/19/windows-app-store-doesn-t-load-after-8-1-upgrade.aspx
Please post back if issue persist.
Yolanda Zhu
TechNet Community Support

Using a script to automate UNC definition updates for FEP 2010

Hi all,
I tested the script mentioned in this article
http://blogs.technet.com/b/clientsecurity/archive/2010/09/16/using-a-script-to-automate-unc-definition-updates.aspx with no success. I am getting the following error:
Line: 11
Char: 5
Error: The operation timed out
Code: 80072EE2
Source: WinHttp.WinHttpRequest
the script content is as follows:
strMSEx86URL = "http://go.microsoft.com/fwlink/?LinkID=121721&clcid=0x409&arch=x86"
strMSEx86Location = "D:\defs\Updates\x86\mpam-fe.exe"
strNISX86URL = "http://go.microsoft.com/fwlink/?LinkId=197095"
strNISX86Location = "D:\defs\Updates\x86\nis_full.exe"
strMSEx64URL = "http://go.microsoft.com/fwlink/?LinkID=121721&clcid=0x409&arch=x64"
strMSEx64Location = "D:\defs\Updates\x64\mpam-fe.exe"
strNISX64URL = "http://go.microsoft.com/fwlink/?LinkId=197094"
strNISX64Location = "D:\defs\Updates\x64\nis_full.exe"
Set objWINHTTP = CreateObject("WinHttp.WinHttpRequest.5.1")
    objWINHTTP.open "GET", strMSEx86URL, false
    objWINHTTP.send
If objWINHTTP.Status = 200 Then
Set objADOStream = CreateObject("ADODB.Stream")
   objADOStream.Open
objADOStream.Type = 1 'adTypeBinary
objADOStream.Write objWINHTTP.ResponseBody
objADOStream.Position = 0 'Set the stream position to the Start
Set objFSO = Createobject("Scripting.FileSystemObject")
    'check if file exists if so delete
    If objFSO.Fileexists(strMSEx86Location) Then objFSO.DeleteFile strMSEx86Location
objADOStream.SaveToFile strMSEx86Location
objADOStream.Close
end if
Anybody can help?

This is the script that I use and it works:
strMSEx86URL = "http://go.microsoft.com/fwlink/?LinkID=121721&clcid=0x409&arch=x86"
strMSEx86Location = "C:\defs\Updates\x86\mpam-fe.exe"
strNISX86URL = "http://download.microsoft.com/download/DefinitionUpdates/x86/nis_full.exe"
strNISX86Location = "C:\defs\Updates\x86\nis_full.exe"
strMSEx64URL = "http://go.microsoft.com/fwlink/?LinkID=121721&clcid=0x409&arch=x64"
strMSEx64Location = "C:\defs\Updates\x64\mpam-fe.exe"
strNISX64URL = "http://download.microsoft.com/download/DefinitionUpdates/amd64/nis_full.exe"
strNISX64Location = "C:\defs\Updates\x64\nis_full.exe"
Set objWINHTTP = CreateObject("WinHttp.WinHttpRequest.5.1")
    objWINHTTP.open "GET", strMSEx86URL, false
    objWINHTTP.send
If objWINHTTP.Status = 200 Then
Set objADOStream = CreateObject("ADODB.Stream")
    objADOStream.Open
    objADOStream.Type = 1 'adTypeBinary
    objADOStream.Write objWINHTTP.ResponseBody
    objADOStream.Position = 0 'Set the stream position to
Set objFSO = Createobject("Scripting.FileSystemObject")
    'check if file exists if so delete
    If objFSO.Fileexists(strMSEx86Location) Then objFSO.DeleteFile(strMSEx86Location)
objADOStream.SaveToFile strMSEx86Location
objADOStream.Close
End IF
Set objWINHTTP = CreateObject("WinHttp.WinHttpRequest.5.1")
    objWINHTTP.open "GET", strNISx86URL, false
    objWINHTTP.send
If objWINHTTP.Status = 200 Then
Set objADOStream = CreateObject("ADODB.Stream")
    objADOStream.Open
    objADOStream.Type = 1 'adTypeBinary
    objADOStream.Write objWINHTTP.ResponseBody
    objADOStream.Position = 0 'Set the stream position to
Set objFSO = Createobject("Scripting.FileSystemObject")
    'check if file exists if so delete
    If objFSO.Fileexists(strNISx86Location) Then objFSO.DeleteFile (strNISx86Location)
objADOStream.SaveToFile strNISx86Location
objADOStream.Close
END IF
Set objWINHTTP = CreateObject("WinHttp.WinHttpRequest.5.1")
    objWINHTTP.open "GET", strNISx64URL, false
    objWINHTTP.send
If objWINHTTP.Status = 200 Then
Set objADOStream = CreateObject("ADODB.Stream")
    objADOStream.Open
    objADOStream.Type = 1 'adTypeBinary
    objADOStream.Write objWINHTTP.ResponseBody
    objADOStream.Position = 0 'Set the stream position to
Set objFSO = Createobject("Scripting.FileSystemObject")
    'check if file exists if so delete
    If objFSO.Fileexists(strNISx64Location) Then objFSO.DeleteFile (strNISx64Location)
objADOStream.SaveToFile strNISx64Location
objADOStream.Close
END IF
Set objWINHTTP = CreateObject("WinHttp.WinHttpRequest.5.1")
    objWINHTTP.open "GET", strMSEx64URL, false
    objWINHTTP.send
If objWINHTTP.Status = 200 Then
Set objADOStream = CreateObject("ADODB.Stream")
    objADOStream.Open
    objADOStream.Type = 1 'adTypeBinary
    objADOStream.Write objWINHTTP.ResponseBody
    objADOStream.Position = 0 'Set the stream position to
Set objFSO = Createobject("Scripting.FileSystemObject")
    'check if file exists if so delete
    If objFSO.Fileexists(strMSEx64Location) Then objFSO.DeleteFile(strMSEx64Location)
objADOStream.SaveToFile strMSEx64Location
objADOStream.Close
END IF

SCEP definition updates for clients in DMZ via UNC is not working.

Hello,
I have configured SCEP definition updates via UNC method for my Win 8.1 clients in DMZ and its not working.
Script is properly associated with task scheduler and downloading definition to shared folder properly.
Even running the mpcmdrun.exe -SignatureUpdate, gives the below error:
C:\Program Files\Microsoft Security Client>mpcmdrun.exe -SignatureUpdate
Signature update started . . .
ERROR: Signature Update failed with hr=80070002
CmdTool: Failed with hr = 0x80070002.
MpCmdRun: Command Line: mpcmdrun.exe -SignatureUpdate
Start Time: ‎Sun ‎Jul ‎06 ‎2014 11:05:09
Start: MpSignatureUpdate()
Update started
Search Started (UNC share) (Path: \\sccm\SCEP_UNC_DEFS\Updates\x64)...
Search Completed
Download Started...
Download Completed
Installation Started...
Installation Completed
Update completed with hr: 0x80070002
ERROR: Signature Update failed with hr=80070002
MpCmdRun: End Time: ‎Sun ‎Jul ‎06 ‎2014 11:05:17

Hi,
Please check logs on the client to see whether there are any helpful information.(ScanAgent.log, Windowsupdate.log and UpdatesHandler.log)
Best Regards,
Joyce
We
are trying to better understand customer views on social support experience, so your participation in this
interview project would be greatly appreciated if you have time.
Thanks for helping make community forums a great place.

Some computers download and install the two approved updates, others only download Windows Update Agent and not the approved updates.

Some computers download and install the two approved updates, others only download Windows Update Agent and not the approved updates.

UN-successful Windows Update Log:
2014-05-07 09:33:56:180
1036 e70
Misc =========== Logging initialized (build: 7.6.7600.256, tz: -0400) ===========
2014-05-07 09:33:56:220
1036 e70
Misc = Process: C:\Windows\system32\svchost.exe
2014-05-07 09:33:56:221
1036 e70
Misc = Module: c:\windows\system32\wuaueng.dll
2014-05-07 09:33:56:180
1036 e70
Service *************
2014-05-07 09:33:56:221
1036 e70
Service ** START ** Service: Service startup
2014-05-07 09:33:56:222
1036 e70
Service *********
2014-05-07 09:33:56:544
1036 e70
Agent * WU client version 7.6.7600.256
2014-05-07 09:33:56:545
1036 e70
Agent * Base directory: C:\Windows\SoftwareDistribution
2014-05-07 09:33:56:546
1036 e70
Agent * Access type: No proxy
2014-05-07 09:33:56:547
1036 e70
Agent * Network state: Connected
2014-05-07 09:33:57:315
1036 e70
Setup Service restarting after SelfUpdate
2014-05-07 09:33:57:545
1036 e70
Setup Client version: Core: 7.6.7600.256 Aux: 7.6.7600.256
2014-05-07 09:33:57:592
1036 e70
Report CWERReporter::Init succeeded
2014-05-07 09:33:58:326
1036 e70
Report *********** Report: Initializing static reporting data ***********
2014-05-07 09:33:58:376
1036 e70
Report * OS Version = 6.1.7601.1.0.65792
2014-05-07 09:33:58:376
1036 e70
Report * OS Product Type = 0x00000030
2014-05-07 09:33:58:394
1036 e70
Report * Computer Brand = Hewlett-Packard
2014-05-07 09:33:58:444
1036 e70
Report * Computer Model = HP Compaq 4000 Pro SFF PC
2014-05-07 09:33:58:455
1036 e70
Report * Bios Revision = 786H7 v02.00
2014-05-07 09:33:58:504
1036 e70
Report * Bios Name = Default System BIOS
2014-05-07 09:33:58:554
1036 e70
Report * Bios Release Date = 2011-01-31T00:00:00
2014-05-07 09:33:58:554
1036 e70
Report * Locale ID = 1033
2014-05-07 09:34:03:562
1036 f08
Report REPORT EVENT: {082D455B-6E51-4238-A997-1D27D9214A72}
2014-05-07 09:33:58:565-0400 1
199 101
{0011B9ED-9189-4D58-BE25-FA2F13FC3D6C}
1 240005
SelfUpdate Success
Content Install Installation successful and restart required for the following update: Windows Update Aux
2014-05-07 09:34:03:614
1036 f08
Report CWERReporter finishing event handling. (00000000)
2014-05-07 09:34:42:049
1036 e70
Agent *********** Agent: Initializing Windows Update Agent ***********
2014-05-07 09:34:42:049
1036 e70
Agent *********** Agent: Initializing global settings cache ***********
2014-05-07 09:34:42:049
1036 e70
Agent * WSUS server: http://csd26.csd.local:80
2014-05-07 09:34:42:049
1036 e70
Agent * WSUS status server: http://csd26.csd.local:80
2014-05-07 09:34:42:049
1036 e70
Agent * Target group: CO
2014-05-07 09:34:42:049
1036 e70
Agent * Windows Update access disabled: No
2014-05-07 09:34:42:063
1036 e70
DnldMgr Download manager restoring 0 downloads
2014-05-07 09:34:42:089
1036 e70
AU ########### AU: Initializing Automatic Updates ###########
2014-05-07 09:34:42:089
1036 e70
AU AU setting next detection timeout to 2014-05-07 13:34:42
2014-05-07 09:34:42:090
1036 e70
AU AU setting next sqm report timeout to 2014-05-07 13:34:42
2014-05-07 09:34:42:090
1036 e70
AU # WSUS server: http://csd26.csd.local:80
2014-05-07 09:34:42:090
1036 e70
AU # Detection frequency: 22
2014-05-07 09:34:42:090
1036 e70
AU # Target group: CO
2014-05-07 09:34:42:090
1036 e70
AU # Approval type: Scheduled (Policy)
2014-05-07 09:34:42:090
1036 e70
AU # Scheduled install day/time: Every day at 3:00
2014-05-07 09:34:42:090
1036 e70
AU # Auto-install minor updates: Yes (User preference)
2014-05-07 09:34:42:105
1036 e70
AU Initializing featured updates
2014-05-07 09:34:42:116
1036 e70
AU Found 0 cached featured updates
2014-05-07 09:34:42:116
1036 e70
AU Successfully wrote event for AU health state:0
2014-05-07 09:34:42:117
1036 e70
AU Successfully wrote event for AU health state:0
2014-05-07 09:34:42:117
1036 e70
AU AU finished delayed initialization
2014-05-07 09:34:42:117
1036 e70
AU AU setting next sqm report timeout to 2014-05-08 13:34:42
2014-05-07 09:34:42:117
1036 e70
AU #############
2014-05-07 09:34:42:117
1036 e70
AU ## START ## AU: Search for updates
2014-05-07 09:34:42:117
1036 e70
AU #########
2014-05-07 09:34:42:291
1036 e70
AU <<## SUBMITTED ## AU: Search for updates [CallId = {5AA2F00A-8964-4543-A740-EC45C5FD5752}]
2014-05-07 09:34:42:341
1036 f08
Agent *************
2014-05-07 09:34:42:341
1036 f08
Agent ** START ** Agent: Finding updates [CallerId = AutomaticUpdates]
2014-05-07 09:34:42:341
1036 f08
Agent *********
2014-05-07 09:34:42:341
1036 f08
Agent * Online = Yes; Ignore download priority = No
2014-05-07 09:34:42:341
1036 f08
Agent * Criteria = "IsInstalled=0 and DeploymentAction='Installation' or IsPresent=1 and DeploymentAction='Uninstallation' or IsInstalled=1 and DeploymentAction='Installation' and RebootRequired=1 or IsInstalled=0
and DeploymentAction='Uninstallation' and RebootRequired=1"
2014-05-07 09:34:42:341
1036 f08
Agent * ServiceID = {3DA21691-E39D-4DA6-8A4B-B43877BCB1B7} Managed
2014-05-07 09:34:42:341
1036 f08
Agent * Search Scope = {Machine}
2014-05-07 09:34:42:341
1036 f08
Setup Checking for agent SelfUpdate
2014-05-07 09:34:42:342
1036 f08
Setup Client version: Core: 7.6.7600.256 Aux: 7.6.7600.256
2014-05-07 09:34:42:349
1036 f08
Misc Validating signature for C:\Windows\SoftwareDistribution\SelfUpdate\wuident.cab:
2014-05-07 09:34:42:392
1036 f08
Misc Microsoft signed: Yes
2014-05-07 09:34:44:669
1036 f08
Misc Validating signature for C:\Windows\SoftwareDistribution\SelfUpdate\wuident.cab:
2014-05-07 09:34:44:676
1036 f08
Misc Microsoft signed: Yes
2014-05-07 09:34:44:754
1036 f08
Misc Validating signature for C:\Windows\SoftwareDistribution\SelfUpdate\wsus3setup.cab:
2014-05-07 09:34:44:777
1036 f08
Misc Microsoft signed: Yes
2014-05-07 09:34:44:781
1036 f08
Misc Validating signature for C:\Windows\SoftwareDistribution\SelfUpdate\wsus3setup.cab:
2014-05-07 09:34:44:788
1036 f08
Misc Microsoft signed: Yes
2014-05-07 09:34:44:837
1036 f08
Setup Determining whether a new setup handler needs to be downloaded
2014-05-07 09:34:44:855
1036 f08
Misc Validating signature for C:\Windows\SoftwareDistribution\SelfUpdate\Handler\WuSetupV.exe:
2014-05-07 09:34:44:862
1036 f08
Misc Microsoft signed: Yes
2014-05-07 09:34:44:862
1036 f08
Misc WARNING: Digital Signatures on file C:\Windows\SoftwareDistribution\SelfUpdate\Handler\WuSetupV.exe are not trusted: Error 0x800b0001
2014-05-07 09:34:44:862
1036 f08
Setup WARNING: Trust verification failed for WuSetupV.exe. It will be deleted and downloaded, error = 0x800B0001
2014-05-07 09:34:44:863
1036 f08
Setup SelfUpdate handler update required: Current version: 7.6.7600.256, required version: 7.6.7600.256
2014-05-07 09:34:44:873
1036 f08
Setup Evaluating applicability of setup package "WUClient-SelfUpdate-ActiveX~31bf3856ad364e35~x86~~7.6.7600.256"
2014-05-07 09:34:44:932
1036 f08
Setup Setup package "WUClient-SelfUpdate-ActiveX~31bf3856ad364e35~x86~~7.6.7600.256" is already installed.
2014-05-07 09:34:44:933
1036 f08
Setup Evaluating applicability of setup package "WUClient-SelfUpdate-Aux-TopLevel~31bf3856ad364e35~x86~~7.6.7600.256"
2014-05-07 09:34:45:048
1036 f08
Setup Setup package "WUClient-SelfUpdate-Aux-TopLevel~31bf3856ad364e35~x86~~7.6.7600.256" is already installed.
2014-05-07 09:34:45:048
1036 f08
Setup Evaluating applicability of setup package "WUClient-SelfUpdate-Core-TopLevel~31bf3856ad364e35~x86~~7.6.7600.256"
2014-05-07 09:34:45:234
1036 f08
Setup Setup package "WUClient-SelfUpdate-Core-TopLevel~31bf3856ad364e35~x86~~7.6.7600.256" is already installed.
2014-05-07 09:34:45:235
1036 f08
Setup SelfUpdate check completed. SelfUpdate is NOT required.
2014-05-07 09:34:48:415
1036 f08
PT +++++++++++ PT: Synchronizing server updates +++++++++++
2014-05-07 09:34:48:415
1036 f08
PT + ServiceId = {3DA21691-E39D-4DA6-8A4B-B43877BCB1B7}, Server URL = http://csd26.csd.local:80/ClientWebService/client.asmx
2014-05-07 09:34:48:424
1036 f08
PT WARNING: Cached cookie has expired or new PID is available
2014-05-07 09:34:48:424
1036 f08
PT Initializing simple targeting cookie, clientId = 97287ab2-5824-44d2-bf93-8a98da659f77, target group = CO, DNS name = c18714.csd.local
2014-05-07 09:34:48:424
1036 f08
PT Server URL = http://csd26.csd.local:80/SimpleAuthWebService/SimpleAuth.asmx
2014-05-07 09:34:48:454
1036 f08
PT WARNING: GetCookie failure, error = 0x8024400D, soap client error = 7, soap error code = 300, HTTP status code = 200
2014-05-07 09:34:48:454
1036 f08
PT WARNING: SOAP Fault: 0x00012c
2014-05-07 09:34:48:454
1036 f08
PT WARNING: faultstring:Fault occurred
2014-05-07 09:34:48:454
1036 f08
PT WARNING: ErrorCode:ConfigChanged(2)
2014-05-07 09:34:48:454
1036 f08
PT WARNING: Message:(null)
2014-05-07 09:34:48:454
1036 f08
PT WARNING: Method:"http://www.microsoft.com/SoftwareDistribution/Server/ClientWebService/GetCookie"
2014-05-07 09:34:48:454
1036 f08
PT WARNING: ID:cb5babad-3a1d-4e6b-946e-736ed4746e3f
2014-05-07 09:34:48:464
1036 f08
PT WARNING: Cached cookie has expired or new PID is available
2014-05-07 09:34:48:464
1036 f08
PT Initializing simple targeting cookie, clientId = 97287ab2-5824-44d2-bf93-8a98da659f77, target group = CO, DNS name = c18714.csd.local
2014-05-07 09:34:48:464
1036 f08
PT Server URL = http://csd26.csd.local:80/SimpleAuthWebService/SimpleAuth.asmx
2014-05-07 09:35:06:497
1036 e70
AU Forced install timer expired for scheduled install
2014-05-07 09:35:06:497
1036 e70
AU UpdateDownloadProperties: 0 download(s) are still in progress.
2014-05-07 09:35:06:497
1036 e70
AU Setting AU scheduled install time to 2014-05-08 07:00:00
2014-05-07 09:35:06:498
1036 e70
AU Successfully wrote event for AU health state:0
2014-05-07 09:35:14:236
1036 f08
PT +++++++++++ PT: Synchronizing extended update info +++++++++++
2014-05-07 09:35:14:236
1036 f08
PT + ServiceId = {3DA21691-E39D-4DA6-8A4B-B43877BCB1B7}, Server URL = http://csd26.csd.local:80/ClientWebService/client.asmx
2014-05-07 09:35:20:118
1036 f08
Agent * Found 0 updates and 79 categories in search; evaluated appl. rules of 859 out of 1494 deployed entities
2014-05-07 09:35:20:194
1036 f08
Agent *********
2014-05-07 09:35:20:194
1036 f08
Agent ** END ** Agent: Finding updates [CallerId = AutomaticUpdates]
2014-05-07 09:35:20:194
1036 f08
Agent *************
2014-05-07 09:35:20:209
1036 f08
Report CWERReporter finishing event handling. (00000000)
2014-05-07 09:35:20:209
1036 f08
Report CWERReporter finishing event handling. (00000000)
2014-05-07 09:35:20:209
1036 bb8
AU >>## RESUMED ## AU: Search for updates [CallId = {5AA2F00A-8964-4543-A740-EC45C5FD5752}]
2014-05-07 09:35:20:209
1036 bb8
AU # 0 updates detected
2014-05-07 09:35:20:209
1036 bb8
AU #########
2014-05-07 09:35:20:209
1036 bb8
AU ## END ## AU: Search for updates [CallId = {5AA2F00A-8964-4543-A740-EC45C5FD5752}]
2014-05-07 09:35:20:209
1036 bb8
AU #############
2014-05-07 09:35:20:210
1036 bb8
AU Successfully wrote event for AU health state:0
2014-05-07 09:35:20:210
1036 bb8
AU Featured notifications is disabled.
2014-05-07 09:35:20:211
1036 bb8
AU AU setting next detection timeout to 2014-05-08 11:19:46
2014-05-07 09:35:20:211
1036 bb8
AU Setting AU scheduled install time to 2014-05-08 07:00:00
2014-05-07 09:35:20:212
1036 bb8
AU Successfully wrote event for AU health state:0
2014-05-07 09:35:20:212
1036 bb8
AU Successfully wrote event for AU health state:0
2014-05-07 09:35:25:183
1036 f08
Report REPORT EVENT: {C1B39107-F517-4477-AAE3-9B1F1D6002BF}
2014-05-07 09:35:20:193-0400 1
147 101
{00000000-0000-0000-0000-000000000000}
0 0 AutomaticUpdates
Success Software Synchronization
Windows Update Client successfully detected 0 updates.
2014-05-07 09:35:25:183
1036 f08
Report REPORT EVENT: {669B9537-BB71-4190-BA58-A97F725AE4D8}
2014-05-07 09:35:20:194-0400 1
156 101
{00000000-0000-0000-0000-000000000000}
0 0 AutomaticUpdates
Success Pre-Deployment Check
Reporting client status.
2014-05-07 09:35:25:184
1036 f08
Report CWERReporter finishing event handling. (00000000)
2014-05-07 09:37:32:440
1036 f08
Report Uploading 3 events using cached cookie, reporting URL = http://csd26.csd.local:80/ReportingWebService/ReportingWebService.asmx
2014-05-07 09:37:32:454
1036 f08
Report Reporter successfully uploaded 3 events.

SCEP Definition Updates from WSUS

I am currently using ConfigMgr (SUP) for all update patching including SCEP definitions (the 3 times a day scenario) but I was wondering if I can configure the clients so they just get their SCEP definitions from a stand-alone WSUS yet continue to receive
all other updates from ConfigMgr (SUP)? I've been successful with pointing the clients to Microsoft Update, Microsoft Malware Protection Center and UNC file shares by changing the Definition Update Source using a custom Antimalware Policy but
I haven't figured out how to point the SCEP client to a WSUS server? There is a setting in the Antimalware policy to set the UNC path so I was expecting to see a setting to set the WSUS URL. It's hard for me to believe the SCEP client can't be independaly
re-directed to a local WSUS since you can configure the SCEP client it to go directly to Microsoft or the Protection Center which is basically the WSUS mothership.

I understand that. I just assumed that since I can change the Definition Update Source and pull the definitions down from "Updates distributed from Microsoft Update" or "Updates distributed from Microsoft Malware Protection Center"
or "Updates distributed from UNC file shares", all which worked fine for me providing the SCEP client (using WUA) can pull definitions down from a different source
while all other updates come down normally via the SUP/WSUS, that the "Updates distributed from WSUS" option would allow a separate WSUS to work as well.
Jason: You asked "What's your end goal or reason for wanting to have separate sources?"
I would rather not discuss this via the forum so feel free to contact me at
[email protected] and we can continue this conversation and update the thread at a later time.

Some clients not receiving SCEP definition updates

I have a collection for some of our application servers that is used in conjunction with an ADR to deploy the SCEP definition updates. 12 of the servers in this collection recently had the SCCM 2012 R2 client installed on them. (The collection has a total
of 23 servers in it)
I can see that these 12 servers have the Antimalware policy applied, but are not getting the SCEP updates. The summary for SCEP is: Service started without any malware protection engine; AV signatures out of date; AS signatures out
of date.
The policy application state is "Succeeded" with the recent date and time.
When I view the status of the deployment, the enforcement state is "Failed to install update(s) " with an error code of 0X87D00667 - No current or future service window exists to install software updates.
These servers are members of another collection that is used for deploying the Monthly updates. This "update" collection does have a maintenance window on it specific to software updates, with no recurrence schedule.
Do maintenance windows apply to the machine then, regardless of what collection they are in?
These 12 servers, for the Endpoint Protection client settings have the "Allow EP client installation and restarts outside MW" set to No, and the Suppress any required computer restarts after the EP client is installed set to Yes.
For the Software Updates client setting, the update scan schedule and deployment re-evaluation is set to every 7 days.
So, in looking at this, it appears that these servers will never get any SCEP updates because they are members of another collection that has a MW, even though the SCEP collection does not have a MW?
Is that correct?

I added a MW on the collection that is used for SCEP updates. I made the MW effective yesterday, but the MW hours were from 5:30am-7:30am daily (which should have started this morning, 1/30, at 5:30am).
In the updatesdeployment.log, I see the MW starting:
CUpdateAssignmentsManager received a SERVICEWINDOWEVENT START Event UpdatesDeploymentAgent 1/30/2015 5:30:00 AM 3004 (0x0BBC)
No current service window available to run updates assignment with time required = 1 UpdatesDeploymentAgent 1/30/2015 5:30:00 AM 3004 (0x0BBC)
CUpdateAssignmentsManager received a SERVICEWINDOWEVENT END Event UpdatesDeploymentAgent 1/30/2015 7:30:00 AM 3312 (0x0CF0)
No current service window available to run updates assignment with time required = 1 UpdatesDeploymentAgent 1/30/2015 7:30:00 AM 3312 (0x0CF0)
Attempting to cancel any job started at non-business hours. UpdatesDeploymentAgent 1/30/2015 7:30:00 AM 3312 (0x0CF0)
However, the definitions are not installed. These 12 servers have the SCEP client, but no definitions installed.
There are 11 servers in this collection that are getting the definition updates, but the 12 servers in this collection that have recently had the SCCM client installed on it are not getting the updates. So I know that the ADR is working.
What am I missing to get these 12 servers to install/update the definitions?

SCEP definition update through Automate Deployment Rule

Hi all. Got a question on deploying SCEP 2012 definition updates to client PC through SCCM2012 R2 by using Automate Deployment Rule. It looks like the client PC is not receiving the definition updates immediately. The ADR seems working
fine, it completed the synchronization successfully, no error on "PatchDownloader.log" and "ruleengine.log"; deployment folder got filled up with new definition updates. However, the client is not receiving the new SCEP definition
updates immediately, although I've configured ADR to install the update as soon as possible, yet nothing happens for the past 2 hours. I ended up launch the SCEP console on the client PC and then click the "update" button manually, and this
launch the update process. I just wondering how much time we need to wait for the SCEP definition update to apply onto the client PC. Microsoft seems release 3 - 4 definition update per day, I am afraid we might not using the latest definition
update due to the time waiting issue. Thank you.

I've configured the polling interval to take place every 3 hours. I guess this contribute to the waiting time. I will keep an eye on it to see if the definition in deed installs automatically.
Yes that's one of the delay which is the major Contribution also there would be some delay for the updates when they are downloading and getting updated to the distribution points. You can check the 'Content Status' for that package to verify if it got updated.
Umair Khan
Microsoft Support Escalation Engineer
Blog: http://blogs.technet.com/umairkhan
Facebook:
Note: Posts are provided “AS IS” without warranty of any kind, either expressed or implied, including but not limited to the implied warranties of merchantability and/or fitness for a particular purpose.

SCEP Definition Updates showing as 'not required'

I've seen this posted a couple of times by other people already, but in both cases there was never any response - so I'm trying again in the hope that somebody has seen it and figured it out now...
I have set-up and ADR for SCEP 2012 definition updates and it is fully working as expected.
However - if I do a Run Summarization on the Software Updates node, all the definition updates report 100% compliance BUT report back as 'not required' for all machines. Surely these should report as 'Installed'?
Other updates are correctly showing as 'Installed' - it's just the defs delivered through the ADR process that are wrong.

Yes, I know this is an old post, but I’m trying to clean them up. Did you solve this problem, if so what was the solution?
Personally I never look at the console for numbers, I only look at the report, the console will always be behind. The report will always reflect the current situation.
Remember that SCEP SU are released 3 or 4 times a day, as soon as a new SU is released for SCEP the old SU will be no required. Since the console only get updated once every 24 hours, IMO it is easy to see why the number within the console will show as not
required.
Garth Jones | My blogs: Enhansoft and
Old Blog site | Twitter:
@GarthMJ

SCEP definition updates for clients in DMZ

Hello,
I do want to enable SCEP definition updates for small group of clients in DMZ (apprx 30 -40)
I have created a separate AD OU and SCCM collection for such computers.
Google shows me different ways like using Definition Update Automation Tool, WSUS, scripts, shares etc, and I am quite confused for which way to adopt.
can any one suggest me which is the best automated way?
I do have SCCM 2012 sp1 and all win 8 cleints.
Thanks in Advance

You can use whathever method you prefer. All will most likely work. As there's already Configmgr in place I'd use it to do this job. ADRs (automatic deployment rules) can be used to automate this process.
Torsten Meringer | http://www.mssccmfaq.de

Delaying Endpoint definition updates by one week

Hi,
We would like to update our Endpoint Definitions with a one week-lag.
I.e. the clients in our environment should never download definitions that were just released.
Instead every definition update should be quarantined for one week, where we can perform tests in a non-production environment to be 100% sure that it does not impact our systems negatively.
What is the easiest way to accomplish this? We are running Windows 7 and SCCM 2012 R2.

You should first configure SCEP NOT to download and install update automatically and only do it for one or few machines which you do testing. Once everything was fine, then you could do manual deployment every week.
Or you could only add share folder as resource to deploy update and disable other sources and once you tested, download the latest definition from Microsoft Malware Protection Center and put it inside the share folder.
For more information about updating definition, take a look at:
https://technet.microsoft.com/en-us/library/jj822983.aspx
Just I am wondering why you want to delay downloading definition? It is not recommended and might put your PCs at risk. If you are facing any compatibility issues with definition update and your programs, you may add those programs to exception list instead.

Windows Update prompt for definition updates

I have a FEP 2010 client that is prompting the end user with a Windows Update dialog when definition updates are available. I checked his WU settings and he is currently set to download update, but let him choose when to install. I thought this
was the issue, but a Win 7 computer has the same settings and doesn't prompt for the definition updates. I have approximately 500 FEP clients installed and this is the only case where the end user is being prompted for definition updates.
Thanks for the help
John

This is old post and successor of FEP is System Center Endpoint Protection (SCEP), I suggest try reproduce this issue in SCEP and check if it exist or not and if it exist, then post it as a new question.
You may also configure Endpoints to use directly update their Endpoint Protection and disable updating through Microsoft Update and see if that solve the problem.

Why after two new updates can I know longer watch or download movies?

This morning firefox updater advised me that two new addons would be installed as soon as I restarted Firefox, which I did straight away. When I opened up a webpage and clicked on a movie to watch everything froze. I couldn't open any other tabs either. Earlier I didn't have a problem with watching movies. It was only when the two new updates were installed and I do not know what they were. I even unistalled Firefox and reinstalled the latest version (which I already had anyway) but this made no difference. It seems that it is only happening when I try to watch or download things. I haven't had this trouble in the past. Although Firefox does crash fairly regularly.

You can try these steps in case of issues with web pages:
Reload web page(s) and bypass the cache to refresh possibly outdated or corrupted files.
*Hold down the Shift key and left-click the Reload button
*Press "Ctrl + F5" or press "Ctrl + Shift + R" (Windows,Linux)
*Press "Command + Shift + R" (Mac)
Clear the cache and cookies only from websites that cause problems.
"Clear the Cache":
*Firefox/Tools > Options > Advanced > Network > Cached Web Content: "Clear Now"
"Remove Cookies" from sites causing problems:
*Firefox/Tools > Options > Privacy > Cookies: "Show Cookies"
Start Firefox in <u>[[Safe Mode|Safe Mode]]</u> to check if one of the extensions (Firefox/Tools > Add-ons > Extensions) or if hardware acceleration is causing the problem (switch to the DEFAULT theme: Firefox/Tools > Add-ons > Appearance).
*Do NOT click the Reset button on the Safe Mode start window.
*https://support.mozilla.org/kb/Safe+Mode
*https://support.mozilla.org/kb/Troubleshooting+extensions+and+themes

Two definition updates dueling

Similar Messages

Maybe you are looking for