Notice: This website is an unofficial Microsoft Knowledge Base (hereinafter KB) archive and is intended to provide a reliable access to deleted content from Microsoft KB. All KB articles are owned by Microsoft Corporation. Read full disclaimer for more details.

Update Rollup 1 for Forefront Endpoint Protection 2010


Summary

This article describes the Forefront Endpoint Protection 2010 issues that are fixed in Update Rollup 1.

For additional information on Update Rollup 1, including how to download and install the update, see the following TechNet articles:

↑ Back to the top


Introduction


List of server-side changes

  • Additional information was added to malware detection alerts, including threat name, file name, and remediation action.

  • New functionality to enable deployment of Forefront Endpoint Protection definition updates through Microsoft System Center Configuration Manager 2007 software update points (SUP) was added.

  • An installation failure was fixed when the DNS suffix of the computer differs from the DNS name of the domain to which it belongs.

  • An issue was corrected where threat overrides are removed when a policy is edited and saved prior to user interface being populated.

  • A crash in server setup was corrected when setup is cancelled but not properly rolled back.



List of client-side changes

  • The following Windows 7 Embedded operating systems are now supported
    • Windows Embedded Standard 7 SP1
    • Windows Embedded POSReady 7
    • Windows ThinPC
    Note: Forefront Endpoint protection is only supported on the above operating systems when the write filter is not enabled.


  • A problem with the competitive uninstall feature was fixed that should now allow it to properly remove certain localized versions of the Forefront Client Security State Assessment and Microsoft Operations Manager 2005 agents.

  • A fix was made to the antimalware client to correct a condition where it logs an incorrect detection identifier. This issue may result in SQL Server Integration Services job failures, reported through the FEP Best Practice Analyzer(BPA) or the SQL Management Pack for System Center Operations Manager.

  • Features were added to the MpCmdRun command line utility, including:
    • Ability to specify a UNC share with the -SignatureUpdate switch

    • Ability to perform a custom scan of an entire folder in addition to individual files

  • A performance improvement was made to the definition update process to correct an issue on computers with exceedingly large number of files.

  • A fix was made to correct an access violation in the antimalware service.

↑ Back to the top


Hotfix information

The following file is available for download from the Microsoft Download Center:

Download Download the update package now.

Release Date: June 28, 2011

For more information about how to download Microsoft support files, click the following article number to view the article in the Microsoft Knowledge Base:
119591 How to obtain Microsoft support files from online services
Microsoft scanned this file for viruses. Microsoft used the most current virus-detection software that was available on the date that the file was posted. The file is stored on security-enhanced servers that help prevent any unauthorized changes to the file.

Prerequisites

Before you install this update, you must install hotfix KB2554364 for your operating system architecture. For more information, see:

2554364 Reporting update prerequisite for Forefront Endpoint Protection 2010 Update Rollup 1

Restart requirement

You do not have to restart the computer after you apply this update.

Hotfix replacement information

This hotfix does not replace a previously released hotfix.

Registry information

To use the hotfix in this package, you do not have to make any changes to the registry.

File information

This hotfix may not contain all the files that you must have to fully update a product to the latest build. This hotfix contains only the files that you must have to resolve the issue that is listed in this article.

The English version of this hotfix package uses a Microsoft Windows Installer package to install the hotfix package. The dates and the times for these files are listed in Coordinated Universal Time (UTC) in the following table. When you view the file information, the date is converted to local time. To find the difference between UTC and local time, use the Time Zone tab in the Date and Time item in Control Panel.

x86

Download information

File nameFile versionFile sizeDateTime
Fep2010-update-rollup-kb2551095-x86-enu.exe2.1.1116.023,562,15216-Jun-201104:35


Microsoft Windows Installer .msp file information
The download contains three Windows installer MSP files listed in the following table:
File nameFile versionFile sizeDateTime
Fep2010-fepext-kb2551095-x86-enu.mspNot Applicable20,299,77616-Jun-201100:42
Fep2010-fepreport-kb2551095-x86-enu.mspNot Applicable1,925,12016-Jun-201100:42
Fep2010-fepux-kb2551095-x86-enu.mspNot Applicable733,18416-Jun-201100:42



The English version of the Fep2010-fepext-kb2551095-x86-enu.msp has the file attributes that are listed in the following table:

File nameFile versionFile sizeDateTime
Commonsetuputils.dll2.1.1116.068,80815-Jun-201121:11
Fepinstall.exe2.1.1116.020,036,96815-Jun-201122:31
Fepregistrator.exe2.1.1116.0122,36815-Jun-201121:11
Ux.policydistribution.dll2.1.1116.0217,12815-Jun-201121:11
Ux.policydistribution.resources.dll2.1.1116.052,32815-Jun-201121:16
Ux.serverconstants.dll2.1.1116.081,16815-Jun-201121:11
Ux.serverutils.dll2.1.1116.0278,92815-Jun-201121:11



The Fep2010-fepext-kb2551095-x86-enu.msp contains a revision to the FEP client installation package. For information on the client file attributes see the Client Update section below.



The English version of the Fep2010-fepreport-kb2551095-x86-enu.msp has the file attributes that are listed in the following table:

File nameFile versionFile sizeDateTime
Alertsmanager.dll2.1.1116.089,40815-Jun-201121:11
Alertsmanager.resources.dll2.1.1116.035,84015-Jun-201121:11
Commonsetuputils.dll2.1.1116.068,80815-Jun-201121:11
Fepreportregistrator.exe2.1.1116.048,20815-Jun-201121:11
Fepserviceevents.dll2.1.1116.018,36015-Jun-201121:16
Policydistribution.dll2.1.1116.0217,12815-Jun-201121:11
Policydistribution.resources.dll2.1.1116.052,32815-Jun-201121:16
Serverconstants.dll2.1.1116.081,16815-Jun-201121:11
Serverutils.dll2.1.1116.0278,92815-Jun-201121:11
Ux.policydistribution.dll2.1.1116.0217,12815-Jun-201121:11
Ux.policydistribution.resources.dll2.1.1116.052,32815-Jun-201121:16
Ux.serverconstants.dll2.1.1116.081,16815-Jun-201121:11
Ux.serverutils.dll2.1.1116.0278,92815-Jun-201121:11



The English version of the Fep2010-fepux-kb2551095-x86-enu.msp has the file attributes that are listed in the following table:

File nameFile versionFile sizeDateTime
Adminui.fep.common.dll2.1.1116.0538,48815-Jun-201121:11
Adminui.fep.policymanagement.dll2.1.1116.0719,76815-Jun-201121:11
Adminui.fep.policymanagement.resources.dll2.1.1116.0538,48815-Jun-201121:16
Fep_default_ocs.xmlNot Applicable12,75119-May-201121:26
Fep_default_tmg.xmlNot Applicable11,33619-May-201121:26
Ux.policydistribution.dll2.1.1116.0217,12815-Jun-201121:11
Ux.policydistribution.resources.dll2.1.1116.052,32815-Jun-201121:16
Ux.serverconstants.dll2.1.1116.081,16815-Jun-201121:11
Ux.serverutils.dll2.1.1116.0278,92815-Jun-201121:11




x64

Download information

File nameFile versionFile sizeDateTime
Fep2010-update-rollup-kb2551095-x64-enu.exe2.1.1116.023,665,15216-Jun-201107:41


Microsoft Windows Installer .msp file information
The download contains three Windows installer MSP files listed in the following table:
File nameFile versionFile sizeDateTime
Fep2010-fepext-kb2551095-x64-enu.mspNot Applicable20,299,77616-Jun-201103:50
Fep2010-fepreport-kb2551095-x64-enu.mspNot Applicable1,925,12016-Jun-201103:50
Fep2010-fepux-kb2551095-x64-enu.mspNot Applicable733,18416-Jun-201103:50



The English version of the Fep2010-fepext-kb2551095-x64-enu.msp has the file attributes that are listed in the following table:

File nameFile versionFile sizeDateTime
Commonsetuputils.dll2.1.1116.068,80815-Jun-201120:14
Fepinstall.exe2.1.1116.020,036,96815-Jun-201122:31
Fepregistrator.exe2.1.1116.0122,36815-Jun-201120:15
Ux.policydistribution.dll2.1.1116.0217,12815-Jun-201120:15
Ux.policydistribution.resources.dll2.1.1116.052,32815-Jun-201120:18
Ux.serverconstants.dll2.1.1116.081,16815-Jun-201120:15
Ux.serverutils.dll2.1.1116.0278,92815-Jun-201120:15

The Fep2010-fepext-kb2551095-x64-enu.msp contains a revision to the FEP client installation package. For information on the client file attributes see the Client Update section below.

The English version of the Fep2010-fepreport-kb2551095-x64-enu.msp has the file attributes that are listed in the following table:

File nameFile versionFile sizeDateTimePlatform
Alertsmanager.dll2.1.1116.089,40815-Jun-201120:14x86
Alertsmanager.resources.dll2.1.1116.035,84015-Jun-201120:14x86
Commonsetuputils.dll2.1.1116.068,80815-Jun-201120:14x86
Fepreportregistrator.exe2.1.1116.048,20815-Jun-201120:14x86
Fepserviceevents.dll2.1.1116.018,36015-Jun-201120:18x64
Policydistribution.dll2.1.1116.0217,12815-Jun-201120:15x86
Policydistribution.resources.dll2.1.1116.052,32815-Jun-201120:18x86
Serverconstants.dll2.1.1116.081,16815-Jun-201120:15x86
Serverutils.dll2.1.1116.0278,92815-Jun-201120:15x86
Ux.policydistribution.dll2.1.1116.0217,12815-Jun-201120:15x86
Ux.policydistribution.resources.dll2.1.1116.052,32815-Jun-201120:18x86
Ux.serverconstants.dll2.1.1116.081,16815-Jun-201120:15x86
Ux.serverutils.dll2.1.1116.0278,92815-Jun-201120:15x86


The English version of the Fep2010-fepux-kb2551095-x64-enu.msp has the file attributes that are listed in the following table:



File nameFile versionFile sizeDateTime
Adminui.fep.common.dll2.1.1116.0538,48815-Jun-201120:14
Adminui.fep.policymanagement.dll2.1.1116.0719,76815-Jun-201120:14
Adminui.fep.policymanagement.resources.dll2.1.1116.0538,48815-Jun-201120:18
Fep_default_ocs.xmlNot Applicable12,75119-May-201121:26
Fep_default_tmg.xmlNot Applicable11,33619-May-201121:26
Ux.policydistribution.dll2.1.1116.0217,12815-Jun-201120:15
Ux.policydistribution.resources.dll2.1.1116.052,32815-Jun-201120:18
Ux.serverconstants.dll2.1.1116.081,16815-Jun-201120:15
Ux.serverutils.dll2.1.1116.0278,92815-Jun-201120:15



Client Update


A new version of the Configuration Manager FEP – Deployment package is installed as part of this update. For more information on how to deploy the Client Update, see the "Installing FEP 2010 Update Rollup 1" TechNet article in the References section of this article.

The FEP – Deployment package will install the FepInstall.exe as show in the above tables. FepInstall.exe contains several MSI files listed below. The English version of these packages have the file attributes that are listed in the following tables according to architecture:

x86

FEPClient.msi

File nameFile versionFile sizeDateTime
Ameventconsumer_cleanup.mofNot Applicable72219-May-201121:26
Dcmnotifier.exe2.1.1116.0267,65615-Jun-201119:16


EPP.msi

File nameFile versionFile sizeDateTime
Ammonitoringinstall.mofNot Applicable7,03619-May-201121:26
Ammonitoringprovider.dll2.1.1116.0179,04015-Jun-201119:16
Amstatusinstall.mofNot Applicable18,17519-May-201121:26
Cleanuppolicy.xmlNot Applicable37019-May-201121:26
Clientwmiinstall.mofNot Applicable2,46019-May-201121:26
Configsecuritypolicy.exe2.1.1116.0287,72015-Jun-201119:16
Fepunregister.mofNot Applicable50519-May-201121:26
Firewallconfigurationnamespace.mofNot Applicable86919-May-201121:26
Firewallconfigurationprofile.mofNot Applicable9,24219-May-201121:26
Firewallconfigurationprovider.mofNot Applicable6,56019-May-201121:26
Firewallconfigurationrule.mofNot Applicable1,24319-May-201121:26
Firewallstateinstall.mofNot Applicable4,61619-May-201121:26
Firewallstateprovider.dll2.1.1116.0137,84015-Jun-201119:16
Legitlib.dll1.9.43.0707,44819-May-201121:24
Mpprovider.dll2.1.1116.0177,50415-Jun-201119:16
Msesysprep.dll2.1.1116.041,05615-Jun-201119:16
Msmpres.dll2.1.1116.0427,26415-Jun-201119:16
Msmpres.dll.mui_enus2.1.1116.085,30415-Jun-201119:16
Msseces.exe2.1.1116.0997,92015-Jun-201119:16
Msseoobe.exe2.1.1116.0514,34415-Jun-201119:16
Msseooberes.dll2.1.1116.016,81615-Jun-201119:16
Msseooberes.dll.mui_enus2.1.1116.016,81615-Jun-201119:21
Mssewat.dll2.1.1116.078,64815-Jun-201119:16
Shellext.dll2.1.1116.0301,12815-Jun-201119:16
Shellext.dll.mui_enus2.1.1116.09,59215-Jun-201119:21
Windowsfirewallconfigurationprovider.dll2.1.1116.0234,67215-Jun-201119:16


mp_ambits.msi
File nameFile versionFile sizeDateTime
Msmpeng.exe3.0.8402.011,73627-Apr-201119:39
Msmplics.dll3.0.8402.09,08827-Apr-201119:37
Ipsconsumer.dll3.0.8402.0147,32827-Apr-201119:37
Mpasdesc.dll3.0.8402.046,97610-May-201114:02
Mpasdesc.dll.mui3.0.8402.044,41610-May-201114:02
Mpclient.dll3.0.8402.0538,49627-Apr-201119:37
Mpcmdrun.exe3.0.8402.0228,52027-Apr-201119:39
Mpcommu.dll3.0.8402.0245,12027-Apr-201119:37
Mpevmsg.dll3.0.8402.034,17610-May-201114:06
Mpevmsg.dll.mui3.0.8402.034,17610-May-201114:07
Mpfilter.sys3.0.8239.0165,64818-Apr-201117:18
Mpnwmon.sys3.0.8239.043,39218-Apr-201117:18
Mpoav.dll3.0.8402.067,96827-Apr-201119:37
Mprtp.dll3.0.8402.0414,08027-Apr-201119:37
Mpsvc.dll3.0.8402.0925,56827-Apr-201119:37
Mputil.dll1.5.3074.0173,95227-Apr-201119:37
Msmpcom.dll3.0.8402.066,43227-Apr-201119:37
Nisdrvtdi.sys3.0.5807.046,75225-Oct-201002:25
Nisdrvwfp.sys3.0.8239.065,02427-Apr-201119:25
Nisipsplugin.dll3.0.8402.069,50427-Apr-201119:37
Nislog.dll3.0.8402.041,85627-Apr-201119:37
Nisnetip.dll3.0.8402.079,74427-Apr-201119:37
Nisperformanceprovider.dll3.0.8402.056,70427-Apr-201119:37
Nisres.dll3.0.8402.014,20827-Apr-201119:37
Nissrv.exe3.0.8402.0208,94427-Apr-201119:39
Niswfp.dll3.0.8402.055,16827-Apr-201119:37



x64

FEPClient.msi

File nameFile versionFile sizeDateTime
Ameventconsumer_cleanup.mofNot Applicable72219-May-201121:26
Dcmnotifier.exe2.1.1116.0347,49615-Jun-201118:35


epp.msi

File nameFile versionFile sizeDateTime
Ammonitoringinstall.mofNot Applicable7,03619-May-201121:26
Ammonitoringprovider.dll2.1.1116.0220,28815-Jun-201118:35
Amstatusinstall.mofNot Applicable18,17519-May-201121:26
Cleanuppolicy.xmlNot Applicable37019-May-201121:26
Clientwmiinstall.mofNot Applicable2,46019-May-201121:26
Configsecuritypolicy.exe2.1.1116.0381,45615-Jun-201118:35
Fepunregister.mofNot Applicable50519-May-201121:26
Firewallconfigurationnamespace.mofNot Applicable86919-May-201121:26
Firewallconfigurationprofile.mofNot Applicable9,24219-May-201121:26
Firewallconfigurationprovider.mofNot Applicable6,56019-May-201121:26
Firewallconfigurationrule.mofNot Applicable1,24319-May-201121:26
Firewallstateinstall.mofNot Applicable4,61619-May-201121:26
Firewallstateprovider.dll2.1.1116.0157,95215-Jun-201118:35
Mpprovider.dll2.1.1116.0214,60815-Jun-201118:35
Msesysprep.dll2.1.1116.046,73615-Jun-201118:35
Msmpres.dll2.1.1116.0427,26415-Jun-201118:35
Msmpres.dll.mui_enus2.1.1116.085,30415-Jun-201118:35
Msseces.exe2.1.1116.01,436,73615-Jun-201118:35
Msseoobe.exe2.1.1116.0671,44015-Jun-201118:35
Msseooberes.dll2.1.1116.016,81615-Jun-201118:35
Msseooberes.dll.mui_enus2.1.1116.016,81615-Jun-201118:39
Mssewat.dll2.1.1116.078,64815-Jun-201118:35
Shellext.dll2.1.1116.0395,91215-Jun-201118:35
Shellext.dll.mui_enus2.1.1116.09,59215-Jun-201118:39
Windowsfirewallconfigurationprovider.dll2.1.1116.0310,90415-Jun-201118:35


mp_ambits.msi

File nameFile versionFile sizeDateTime
Msmpeng.exe3.0.8402.012,78427-Apr-201121:21
Msmplics.dll3.0.8402.09,08827-Apr-201121:19
Msmplics.dll (x86 directory)3.0.8402.09,08827-Apr-201119:37
Ipsconsumer.dll3.0.8402.0203,64827-Apr-201121:19
Mpasdesc.dll3.0.8402.048,51210-May-201115:35
Mpasdesc.dll.mui3.0.8402.044,41610-May-201115:35
Mpasdesc.dll.mui (x86 directory)3.0.8402.044,41627-Apr-201119:51
Mpasdesc.dll (x86 directory)3.0.8402.046,97627-Apr-201119:50
Mpclient.dll3.0.8402.0759,68027-Apr-201121:19
Mpclient.dll (x86 directory)3.0.8402.0538,49627-Apr-201119:37
Mpcmdrun.exe3.0.8402.0273,35227-Apr-201121:21
Mpcommu.dll3.0.8402.0338,30427-Apr-201121:19
Mpcommu.dll (x86 directory)3.0.8402.0245,12027-Apr-201119:37
Mpevmsg.dll3.0.8402.034,17610-May-201115:39
Mpevmsg.dll.mui3.0.8402.034,17610-May-201115:39
Mpfilter.sys3.0.8239.0189,44018-Apr-201117:18
Mpnwmon.sys3.0.8239.040,83218-Apr-201117:18
Mpoav.dll3.0.8402.063,36027-Apr-201121:19
Mpoav.dll (x86 directory)3.0.8402.067,96827-Apr-201119:37
Mprtp.dll3.0.8402.0581,50427-Apr-201121:19
Mpsvc.dll3.0.8402.01,373,56827-Apr-201121:19
Mputil.dll1.5.3074.0217,47227-Apr-201121:19
Msmpcom.dll3.0.8402.075,64827-Apr-201121:19
Nisdrvtdi.sys3.0.5807.062,17625-Oct-201002:25
Nisdrvwfp.sys3.0.8239.084,86427-Apr-201119:25
Nisipsplugin.dll3.0.8402.085,37627-Apr-201121:19
Nislog.dll3.0.8402.045,44027-Apr-201121:19
Nisnetip.dll3.0.8402.0103,80827-Apr-201121:19
Nisperformanceprovider.dll3.0.8402.070,01627-Apr-201121:19
Nisres.dll3.0.8402.015,23227-Apr-201121:19
Nissrv.exe3.0.8402.0288,27227-Apr-201121:21
Niswfp.dll3.0.8402.068,48027-Apr-201121:19


↑ Back to the top


Known Issues

  • When upgrading the FEP client (FEPInstall.exe) on 64-bit Windows 7 or Windows Server 2008 R2 computers, either manually or through System Center Configuration Manager, two shortcut icons may appear in the Start > All programs menu: one named “Forefront Endpoint Protection” the other “Forefront Endpoint Protection 2010”. Both shortcuts properly launch the client user interface. The “Forefront Endpoint Protection 2010” shortcut can be safely deleted.

  • This update adds additional information to policies created in the Forefront Endpoint Protection console. When installing this update in your environment you should deploy it to all Forefront Endpoint Protection management consoles. Modification of a policy created with this update on a Forefront Endpoint Protection console without this update may result in loss of the new policy information.



  • You may be prompted for your original CD media if you originally installed the Forefront Endpoint Protection release and then applied this update.

  • The additional information added to alerts required changes to the events logged by the site server to the event log. After this update is applied, parameter data for prior malware detection events in the event log is not populated or is associated with different text. This is expected behavior and does not affect the proper operation of prior or future alerts.

  • You can customize the data retention value by using the steps outlined in FEP 2010 Reporting Database Maintenance. However, after running a repair on your FEP installation, or after applying an Update Rollup, the data retention value is reset to the default value of 12 months. You must perform the steps in FEP 2010 Reporting Database Maintenance in order to reset the data retention value to what is required in your organization.

↑ Back to the top


References

Before you install this update, you must install hotfix KB2554364 for your operating system architecture. For more information, see:

2554364 Reporting update prerequisite for Forefront Endpoint Protection 2010 Update Rollup 1


For additional information on Update Rollup 1, including how to download and install the update, see the following TechNet articles:

↑ Back to the top


Keywords: kbqfe, kbhotfixserver, kbfix, kb

↑ Back to the top

Article Info
Article ID : 2551095
Revision : 3
Created on : 3/30/2017
Published on : 3/30/2017
Exists online : False
Views : 432