Windows 8.1 will not get Forefront Client Updates from WSUS

Question

Recently I noticed that my Windows 8.1 clients were not getting updates from WSUS 3.2.  After some searching I found it was an issue with HTTPS and the solution was to disable HTTPS or enable TLS.  So I enabled TLS on the Server 2008 R2 WSUS server
and that fixed the issue with my 8.1 clients not getting updates except for Forefront Endpoint Protection 2010.   My SCCM server deploys the client fine but it is version 2.1 and normally the client and definition updates come from WSUS with the
latest client version being 4.5.  However, my Windows 8.1 machines will not get the client updates even though they are automatically approved for all machines.
I am just wondering what else I can check or change to make sure my Windows 8.1 clients get the Forefront client updates as they should??   I am wondering if I manually install the 4.1 client update if it will take the client updates after that.  
I only have about eight Windows 8.1 machines so if I have to do that by hand for now then I will and I think my organization will be moving to Server 2012 and SCCM 2012 this summer sometime.

Answer 1

I reread your post and have another suggestion. If your SCCM 2007 server is still deploying the old 2.1 FEP client version, then you should install the latest anti-malware platform update for the SCCM server so you can deploy it from there instead of WSUS:
http://support.microsoft.com/kb/2952678
http://blogs.msdn.com/b/minfangl/archive/2013/08/15/guidance-on-install-anti-malware-platform-updates-for-fep-2010-su1-and-scep-2012-sp1.aspx
Also, you may be affected by this:
"Anti-malware platform updates on MU will use special detection logic and applicability rules to make the anti-malware platform updates available only on computers with previous N-2 anti-malware platforms installed. For example, on April 8^th,
anti-malware platform of version 4.5.x will be released on MU, and it will only be offered to computers where anti-malware platform version 4.3.x or 4.4.x is available. If a computer has FEP or SCEP client with version 4.1.x, it has to be upgraded to version
4.3.x first, then to the latest version (4.5.x). If a computer has FEP or SCEP client with version older than 4.1.x, because of the same N-2 rule, it has to be upgraded to 4.1.x first, then to 4.3.x, and then to the latest version (4.5.x). Required updates
will be kept on MU to ensure that this upgrade process is available for computers running older versions of the Microsoft anti-malware platform."
http://blogs.technet.com/b/configmgrteam/archive/2014/03/27/anti-malware-platform-updates-for-endpoint-protection-will-be-released-to-mu.aspx