Update Rollup 1 for Forefront Endpoint Protection 2010

List of server-side changes

• Additional information was added to malware detection alerts, including threat name, file name, and remediation action.
  
  
• New functionality to enable deployment of Forefront Endpoint Protection definition updates through Microsoft System Center Configuration Manager 2007 software update points (SUP) was added.
  
  
• An installation failure was fixed when the DNS suffix of the computer differs from the DNS name of the domain to which it belongs.
  
  
• An issue was corrected where threat overrides are removed when a policy is edited and saved prior to user interface being populated.
  
  
• A crash in server setup was corrected when setup is cancelled but not properly rolled back.
  
  

List of client-side changes

• The following Windows 7 Embedded operating systems are now supported
• • Windows Embedded Standard 7 SP1
  • Windows Embedded POSReady 7
  • Windows ThinPC
  Note: Forefront Endpoint protection is only supported on the above operating systems when the write filter is not enabled.
  
  
  
• A problem with the competitive uninstall feature was fixed that should now allow it to properly remove certain localized versions of the Forefront Client Security State Assessment and Microsoft Operations Manager 2005 agents.
  
  
• A fix was made to the antimalware client to correct a condition where it logs an incorrect detection identifier. This issue may result in SQL Server Integration Services job failures, reported through the FEP Best Practice Analyzer(BPA) or the SQL Management Pack for System Center Operations Manager.
  
  
• Features were added to the MpCmdRun command line utility, including:
• • Ability to specify a UNC share with the -SignatureUpdate switch
    
    
  • Ability to perform a custom scan of an entire folder in addition to individual files
    
    
• A performance improvement was made to the definition update process to correct an issue on computers with exceedingly large number of files.
  
  
• A fix was made to correct an access violation in the antimalware service.
  

• When upgrading the FEP client (FEPInstall.exe) on 64-bit Windows 7 or Windows Server 2008 R2 computers, either manually or through System Center Configuration Manager, two shortcut icons may appear in the Start > All programs menu: one named “Forefront Endpoint Protection” the other “Forefront Endpoint Protection 2010”. Both shortcuts properly launch the client user interface. The “Forefront Endpoint Protection 2010” shortcut can be safely deleted.
  
  
• This update adds additional information to policies created in the Forefront Endpoint Protection console. When installing this update in your environment you should deploy it to all Forefront Endpoint Protection management consoles. Modification of a policy created with this update on a Forefront Endpoint Protection console without this update may result in loss of the new policy information.
  
  
  
  
• You may be prompted for your original CD media if you originally installed the Forefront Endpoint Protection release and then applied this update.
  
  
• The additional information added to alerts required changes to the events logged by the site server to the event log. After this update is applied, parameter data for prior malware detection events in the event log is not populated or is associated with different text. This is expected behavior and does not affect the proper operation of prior or future alerts.
  
  
• You can customize the data retention value by using the steps outlined in FEP 2010 Reporting Database Maintenance. However, after running a repair on your FEP installation, or after applying an Update Rollup, the data retention value is reset to the default value of 12 months. You must perform the steps in FEP 2010 Reporting Database Maintenance in order to reset the data retention value to what is required in your organization.