Forefront Endpoint Protection 2010 ignores the "Only check alternative sources if definitions on the client computer are older than (days):" setting

Symptoms

Consider the following scenario:

• You deploy Microsoft Forefront Endpoint Protection 2010 Update Rollup 1 to client computers.

• On the Updates tab of the FEP policy properties dialog box, you select the Use Configuration Manager as primary source for definition updates option.

• You set a grace period by configuring the Only check alternative sources if definitions on the client computer are older than (days): setting.

In this scenario, Forefront Endpoint Protection does not apply the grace period and uses the alternative definition sources instead.

Note When the Use Configuration Manager as primary source for definition updates option is enabled, you expect the Forefront Endpoint Protection client to check whether the definitions were updated during the grace period. The Forefront Endpoint Protection client should fall back to alternative definition sources only if the definitions were not updated within the grace period.

Cause

This issue occurs because of the way that Forefront Endpoint Protection parses registry values.

Resolution

To resolve this issue, install the following hotfix on the Forefront Endpoint Protection site extension, on the Forefront Endpoint Protection console extension, and on the Forefront Endpoint Protection reporting server roles.

The following table describes the updates that are included in this hotfix, the folder in the package in which the updates are stored, and the computer on which you should install the updates.

Important This hotfix resets the Use Configuration Manager as primary source for definition updates option. Therefore, after you install this hotfix, you must re-enable this option for each policy that had this option selected. To do this, follow these steps:

1. Edit your Forefront Endpoint Protection policies in the Configuration Manager console.

2. On the Updates tab, click to select the Use Configuration Manager as primary source for definition updates check box.

3. Click Apply, and then click OK to close the window.

The Forefront Endpoint Protection clients will parse the registry values correctly during the next machine policy update cycle. By default, this behavior occurs every 60 minutes.

Note If you have already disabled the default FEP policy modification from parent status filter rule, you must also manually update the "Microsoft Corporation FEP – Policies 1.0" package on your distribution points. For more information, visit the following Microsoft website:

How to update package data on distribution points

Status

Microsoft has confirmed that this is a problem in the Microsoft products that are listed in the "Applies to" section.

More Information

For more information about Forefront Endpoint Protection2010Update Rollup 1, click the following article number to view the article in the Microsoft Knowledge Base

2551095 Update Rollup 1 for Forefront Endpoint Protection 2010 For more information about software update terminology, click the following article number to view the article in the Microsoft Knowledge Base:

824684 Description of the standard terminology that is used to describe Microsoft software updates