Forefront Endpoint Protection – Resources

Below is a list of good links when you start deploying Forefront Endpoint Protection

• FEP Technet Documentation – http://technet.microsoft.com/en-us/library/ff823816.aspx
• FEP Capacity Planner – http://blogs.technet.com/b/clientsecurity/archive/2011/01/19/fep-capacity-planning-worksheet.aspx
• FEP Installation via OSD – http://social.technet.microsoft.com/wiki/contents/articles/how-to-deploy-fep2010-client-via-osd-and-test-deployment.aspx
• FEP Retention Settings – http://www.msfaq.se/2011/02/fep-changing-retention-period/
• FEP Console Permissions – http://social.technet.microsoft.com/wiki/contents/articles/setting-up-a-new-fep-administrator.aspx
• Pending Restart Issue when installing – http://ccmexec.com/?p=716 
• Predeployment of KB981889 – http://blogs.technet.com/b/clientsecurity/archive/2011/01/17/fep-2010-deploying-client-kb981889-ahead-of-time.aspx
• Technet Forums for FEP – http://social.technet.microsoft.com/Forums/en-us/FCSNext/threads

View FEP Policy Assigned on Client

The question came up today how can I see what policy that is applied to a local client on the local client itself ?

There are atleast 2 ways of doing this

1. GUI Option

Open the FEP Client

Press the little arrow to the right of Help and choose About Forefront Endpoint Protection

The About Screen will show up and at the bottom you see the applied policy.

2. Registry Option 

The second way is to look into the registry on this or the following registy key and String

 HKEY_LOCAL_MACHINESOFTWAREMicrosoftMicrosoft Security Client

“LastSuccessfullyAppliedPolicy”=”Default Desktop Policy”

You may also lookinto the log file on the client to troubleshoot eventuel errors for applying the policy and the log files is  listed below:

C:WindowstempFEP-ApplyPolicy-MACHINENAME.LOG

 Replace MACHINENAME with the local computername

FEP – Changing Retention Period

I have seen some question on the forums and heard from customers , is it possible to change the retention period on the databas how long data is saved for Forefront Endpoint Protection Managed by ConfigMgr, so I tried to find the information and I found it so Id though id share the information with you.

You need to open the SQL Management Studio and execute the following command on your FEP DW Database

XXX Corresponds to your ConfigMgr SiteCode and value is the retention period a value between 3 and 12 (months)

EXEC FEPDW_XXX.dbo.spAN_Common_Report_UpdateMaintenanceConfiguration value

So for a site with sitecode P01 and I want to keep tha data for 3 months its this command to execute.

EXEC FEPDW_P01.dbo.spAN_Common_Report_UpdateMaintenanceConfiguration 3