Thanks to everyone that attended mine and Jörgens  session last week. As promised we will post some MBAM (Microsoft Bitlocker and Administration) Blog posts the coming weeks.

To start with here are the links that we had in our presentation. We will post more thing related to MBAM along the way so please stay tuned here for more MBAM information.

General

MBAM MP for Operations Manager
http://www.microsoft.com/download/en/details.aspx?id=26796
Bitlocker FAQ
http://technet.microsoft.com/en-us/library/ee449438(WS.10).aspx
MBAM in WinPE
http://myitforum.com/cs2/blogs/nbrady/archive/2011/09/06/how-can-i-retrieve-my-bitlocker-recovery-key-from-mbam-in-windows-pe.aspx
KBs
http://support.microsoft.com/kb/2612822

Handling of TPM

HP
http://itbloggen.se/cs/blogs/micke/archive/2010/10/18/enable-tpm-via-task-sequence-on-hp-boxes.aspx
Dell
Http://www.nullsession.com/2010/12/02/enable-tpm-in-task-sequence-with-sccm-and-cctk/
Lenovo
http://blog.coretech.dk/mip/enable-lenovo-tpm-security-chip-and-other-stuff-from-a-ts/

TechNet Whats New ! – http://technet.microsoft.com/en-us/library/hh211541.aspx

Download – http://www.microsoft.com/download/en/details.aspx?id=26583

Config Mgr 2012 – Overview

Don’t forget to set the advertisement to always rerun. Its also a good idea to keep track of the advertisement to make sure you don’t have clients that end up in a loop.

Note: I have seen some cases where there is an issue with clients ending up in this collection without having the client uninstalled. Usually triggering a Hardware Inventory resolves this.

Usually the issue comes if you have your users as local administrators on their PCs they have full control over their PC.

So there are different ways to go around this. My first way to handle this is to configure a GPO that controls the Microsoft Antimalware Service. And set the Service to automatically start and only your real administrators to have the Start and Stop Rights.

My option 2 is to have a advertisement with a reoccurring script or startup script to set the service to start automatically and start the service it if its stopped. The target is the Built-in Collection

strComputer = "."
Set objWMIService = GetObject("winmgmts:\" & strComputer & "rootcimv2")

Set colServiceList = objWMIService.ExecQuery _
("Select * from Win32_Service where Name = ‘MsMpSvc’")
For Each objService in colServiceList
objService.ChangeStartMode("Automatic")
Wscript.Sleep 5000
errReturnCode = objService.StartService()
Next

At the url posted below you will find the latest information about definitions and the ability to download them manually.

http://www.microsoft.com/security/portal/Definitions/ADL.aspx

The intended action is that the MOM Agent should get uninstalled although there has been some minor issues detected with this. But the normal behavior should be that the MOM Agent should get uninstalled! Although if the MOM agent is multihomed uninstallation will prompt  for this. If you encounter the behavior where the client is not uninstalled please contact Microsoft Support.

http://technet.microsoft.com/en-us/library/gg477033.aspx

Below you will find a link with the presentation as promised. At the end you will find the links discussed in the presentation. For those of you who have other question feel free to contact me.

I forgot to mention our Swedish based System Center User Group that is  found @ www.scug.se

Best Regards
Stefan Schörling
stefan@msfaq.se

ALL CODE IS PROVIDED AS IS WITH NO WARRANTIES

Presentation: Managing Forefront Endpoint Protection with System Center Configuration Manager

http://download.windowsupdate.com
https://*.windowsupdate.microsoft.com
http://*.windowsupdate.microsoft.com
http://update.microsoft.com
http://*.windowsupdate.com
http://download.microsoft.com
http://windowsupdate.microsoft.com
http://ntservicepack.microsoft.com
http://wustat.windows.com
https://update.microsoft.com