Update Rollup 1 for Forefront Endpoint Protection 2010

Summary

This article describes the Forefront Endpoint Protection 2010 issues that are fixed in Update Rollup 1.

For additional information on Update Rollup 1, including how to download and install the update, see the following TechNet articles:

Introduction


List of server-side changes

  • Additional information was added to malware detection alerts, including threat name, file name, and remediation action.


  • New functionality to enable deployment of Forefront Endpoint Protection definition updates through Microsoft System Center Configuration Manager 2007 software update points (SUP) was added.


  • An installation failure was fixed when the DNS suffix of the computer differs from the DNS name of the domain to which it belongs.


  • An issue was corrected where threat overrides are removed when a policy is edited and saved prior to user interface being populated.


  • A crash in server setup was corrected when setup is cancelled but not properly rolled back.




List of client-side changes

  • The following Windows 7 Embedded operating systems are now supported

    • Windows Embedded Standard 7 SP1

    • Windows Embedded POSReady 7

    • Windows ThinPC

    Note: Forefront Endpoint protection is only supported on the above operating systems when the write filter is not enabled.



  • A problem with the competitive uninstall feature was fixed that should now allow it to properly remove certain localized versions of the Forefront Client Security State Assessment and Microsoft Operations Manager 2005 agents.


  • A fix was made to the antimalware client to correct a condition where it logs an incorrect detection identifier. This issue may result in SQL Server Integration Services job failures, reported through the FEP Best Practice Analyzer(BPA) or the SQL Management Pack for System Center Operations Manager.


  • Features were added to the MpCmdRun command line utility, including:

    • Ability to specify a UNC share with the -SignatureUpdate switch


    • Ability to perform a custom scan of an entire folder in addition to individual files


  • A performance improvement was made to the definition update process to correct an issue on computers with exceedingly large number of files.


  • A fix was made to correct an access violation in the antimalware service.

Hotfix information

The following file is available for download from the Microsoft Download Center:

Download Download the update package now.

Release Date: June 28, 2011

For more information about how to download Microsoft support files, click the following article number to view the article in the Microsoft Knowledge Base:

119591 How to obtain Microsoft support files from online services
Microsoft scanned this file for viruses. Microsoft used the most current virus-detection software that was available on the date that the file was posted. The file is stored on security-enhanced servers that help prevent any unauthorized changes to the file.

Prerequisites

Before you install this update, you must install hotfix KB2554364 for your operating system architecture. For more information, see:

2554364 Reporting update prerequisite for Forefront Endpoint Protection 2010 Update Rollup 1

Restart requirement

You do not have to restart the computer after you apply this update.

Hotfix replacement information

This hotfix does not replace a previously released hotfix.

Registry information

To use the hotfix in this package, you do not have to make any changes to the registry.

File information

This hotfix may not contain all the files that you must have to fully update a product to the latest build. This hotfix contains only the files that you must have to resolve the issue that is listed in this article.

The English version of this hotfix package uses a Microsoft Windows Installer package to install the hotfix package. The dates and the times for these files are listed in Coordinated Universal Time (UTC) in the following table. When you view the file information, the date is converted to local time. To find the difference between UTC and local time, use the Time Zone tab in the Date and Time item in Control Panel.

x86

Download information

File name

File version

File size

Date

Time

Fep2010-update-rollup-kb2551095-x86-enu.exe

2.1.1116.0

23,562,152

16-Jun-2011

04:35



Microsoft Windows Installer .msp file information
The download contains three Windows installer MSP files listed in the following table:

File name

File version

File size

Date

Time

Fep2010-fepext-kb2551095-x86-enu.msp

Not Applicable

20,299,776

16-Jun-2011

00:42

Fep2010-fepreport-kb2551095-x86-enu.msp

Not Applicable

1,925,120

16-Jun-2011

00:42

Fep2010-fepux-kb2551095-x86-enu.msp

Not Applicable

733,184

16-Jun-2011

00:42




The English version of the Fep2010-fepext-kb2551095-x86-enu.msp has the file attributes that are listed in the following table:

File name

File version

File size

Date

Time

Commonsetuputils.dll

2.1.1116.0

68,808

15-Jun-2011

21:11

Fepinstall.exe

2.1.1116.0

20,036,968

15-Jun-2011

22:31

Fepregistrator.exe

2.1.1116.0

122,368

15-Jun-2011

21:11

Ux.policydistribution.dll

2.1.1116.0

217,128

15-Jun-2011

21:11

Ux.policydistribution.resources.dll

2.1.1116.0

52,328

15-Jun-2011

21:16

Ux.serverconstants.dll

2.1.1116.0

81,168

15-Jun-2011

21:11

Ux.serverutils.dll

2.1.1116.0

278,928

15-Jun-2011

21:11




The Fep2010-fepext-kb2551095-x86-enu.msp contains a revision to the FEP client installation package. For information on the client file attributes see the Client Update section below.



The English version of the Fep2010-fepreport-kb2551095-x86-enu.msp has the file attributes that are listed in the following table:

File name

File version

File size

Date

Time

Alertsmanager.dll

2.1.1116.0

89,408

15-Jun-2011

21:11

Alertsmanager.resources.dll

2.1.1116.0

35,840

15-Jun-2011

21:11

Commonsetuputils.dll

2.1.1116.0

68,808

15-Jun-2011

21:11

Fepreportregistrator.exe

2.1.1116.0

48,208

15-Jun-2011

21:11

Fepserviceevents.dll

2.1.1116.0

18,360

15-Jun-2011

21:16

Policydistribution.dll

2.1.1116.0

217,128

15-Jun-2011

21:11

Policydistribution.resources.dll

2.1.1116.0

52,328

15-Jun-2011

21:16

Serverconstants.dll

2.1.1116.0

81,168

15-Jun-2011

21:11

Serverutils.dll

2.1.1116.0

278,928

15-Jun-2011

21:11

Ux.policydistribution.dll

2.1.1116.0

217,128

15-Jun-2011

21:11

Ux.policydistribution.resources.dll

2.1.1116.0

52,328

15-Jun-2011

21:16

Ux.serverconstants.dll

2.1.1116.0

81,168

15-Jun-2011

21:11

Ux.serverutils.dll

2.1.1116.0

278,928

15-Jun-2011

21:11




The English version of the Fep2010-fepux-kb2551095-x86-enu.msp has the file attributes that are listed in the following table:

File name

File version

File size

Date

Time

Adminui.fep.common.dll

2.1.1116.0

538,488

15-Jun-2011

21:11

Adminui.fep.policymanagement.dll

2.1.1116.0

719,768

15-Jun-2011

21:11

Adminui.fep.policymanagement.resources.dll

2.1.1116.0

538,488

15-Jun-2011

21:16

Fep_default_ocs.xml

Not Applicable

12,751

19-May-2011

21:26

Fep_default_tmg.xml

Not Applicable

11,336

19-May-2011

21:26

Ux.policydistribution.dll

2.1.1116.0

217,128

15-Jun-2011

21:11

Ux.policydistribution.resources.dll

2.1.1116.0

52,328

15-Jun-2011

21:16

Ux.serverconstants.dll

2.1.1116.0

81,168

15-Jun-2011

21:11

Ux.serverutils.dll

2.1.1116.0

278,928

15-Jun-2011

21:11





x64

Download information

File name

File version

File size

Date

Time

Fep2010-update-rollup-kb2551095-x64-enu.exe

2.1.1116.0

23,665,152

16-Jun-2011

07:41



Microsoft Windows Installer .msp file information
The download contains three Windows installer MSP files listed in the following table:

File name

File version

File size

Date

Time

Fep2010-fepext-kb2551095-x64-enu.msp

Not Applicable

20,299,776

16-Jun-2011

03:50

Fep2010-fepreport-kb2551095-x64-enu.msp

Not Applicable

1,925,120

16-Jun-2011

03:50

Fep2010-fepux-kb2551095-x64-enu.msp

Not Applicable

733,184

16-Jun-2011

03:50




The English version of the Fep2010-fepext-kb2551095-x64-enu.msp has the file attributes that are listed in the following table:

File name

File version

File size

Date

Time

Commonsetuputils.dll

2.1.1116.0

68,808

15-Jun-2011

20:14

Fepinstall.exe

2.1.1116.0

20,036,968

15-Jun-2011

22:31

Fepregistrator.exe

2.1.1116.0

122,368

15-Jun-2011

20:15

Ux.policydistribution.dll

2.1.1116.0

217,128

15-Jun-2011

20:15

Ux.policydistribution.resources.dll

2.1.1116.0

52,328

15-Jun-2011

20:18

Ux.serverconstants.dll

2.1.1116.0

81,168

15-Jun-2011

20:15

Ux.serverutils.dll

2.1.1116.0

278,928

15-Jun-2011

20:15


The Fep2010-fepext-kb2551095-x64-enu.msp contains a revision to the FEP client installation package. For information on the client file attributes see the Client Update section below.

The English version of the Fep2010-fepreport-kb2551095-x64-enu.msp has the file attributes that are listed in the following table:

File name

File version

File size

Date

Time

Platform

Alertsmanager.dll

2.1.1116.0

89,408

15-Jun-2011

20:14

x86

Alertsmanager.resources.dll

2.1.1116.0

35,840

15-Jun-2011

20:14

x86

Commonsetuputils.dll

2.1.1116.0

68,808

15-Jun-2011

20:14

x86

Fepreportregistrator.exe

2.1.1116.0

48,208

15-Jun-2011

20:14

x86

Fepserviceevents.dll

2.1.1116.0

18,360

15-Jun-2011

20:18

x64

Policydistribution.dll

2.1.1116.0

217,128

15-Jun-2011

20:15

x86

Policydistribution.resources.dll

2.1.1116.0

52,328

15-Jun-2011

20:18

x86

Serverconstants.dll

2.1.1116.0

81,168

15-Jun-2011

20:15

x86

Serverutils.dll

2.1.1116.0

278,928

15-Jun-2011

20:15

x86

Ux.policydistribution.dll

2.1.1116.0

217,128

15-Jun-2011

20:15

x86

Ux.policydistribution.resources.dll

2.1.1116.0

52,328

15-Jun-2011

20:18

x86

Ux.serverconstants.dll

2.1.1116.0

81,168

15-Jun-2011

20:15

x86

Ux.serverutils.dll

2.1.1116.0

278,928

15-Jun-2011

20:15

x86



The English version of the Fep2010-fepux-kb2551095-x64-enu.msp has the file attributes that are listed in the following table:



File name

File version

File size

Date

Time

Adminui.fep.common.dll

2.1.1116.0

538,488

15-Jun-2011

20:14

Adminui.fep.policymanagement.dll

2.1.1116.0

719,768

15-Jun-2011

20:14

Adminui.fep.policymanagement.resources.dll

2.1.1116.0

538,488

15-Jun-2011

20:18

Fep_default_ocs.xml

Not Applicable

12,751

19-May-2011

21:26

Fep_default_tmg.xml

Not Applicable

11,336

19-May-2011

21:26

Ux.policydistribution.dll

2.1.1116.0

217,128

15-Jun-2011

20:15

Ux.policydistribution.resources.dll

2.1.1116.0

52,328

15-Jun-2011

20:18

Ux.serverconstants.dll

2.1.1116.0

81,168

15-Jun-2011

20:15

Ux.serverutils.dll

2.1.1116.0

278,928

15-Jun-2011

20:15




Client Update


A new version of the Configuration Manager FEP – Deployment package is installed as part of this update. For more information on how to deploy the Client Update, see the "Installing FEP 2010 Update Rollup 1" TechNet article in the References section of this article.

The FEP – Deployment package will install the FepInstall.exe as show in the above tables. FepInstall.exe contains several MSI files listed below. The English version of these packages have the file attributes that are listed in the following tables according to architecture:

x86

FEPClient.msi

File name

File version

File size

Date

Time

Ameventconsumer_cleanup.mof

Not Applicable

722

19-May-2011

21:26

Dcmnotifier.exe

2.1.1116.0

267,656

15-Jun-2011

19:16



EPP.msi

File name

File version

File size

Date

Time

Ammonitoringinstall.mof

Not Applicable

7,036

19-May-2011

21:26

Ammonitoringprovider.dll

2.1.1116.0

179,040

15-Jun-2011

19:16

Amstatusinstall.mof

Not Applicable

18,175

19-May-2011

21:26

Cleanuppolicy.xml

Not Applicable

370

19-May-2011

21:26

Clientwmiinstall.mof

Not Applicable

2,460

19-May-2011

21:26

Configsecuritypolicy.exe

2.1.1116.0

287,720

15-Jun-2011

19:16

Fepunregister.mof

Not Applicable

505

19-May-2011

21:26

Firewallconfigurationnamespace.mof

Not Applicable

869

19-May-2011

21:26

Firewallconfigurationprofile.mof

Not Applicable

9,242

19-May-2011

21:26

Firewallconfigurationprovider.mof

Not Applicable

6,560

19-May-2011

21:26

Firewallconfigurationrule.mof

Not Applicable

1,243

19-May-2011

21:26

Firewallstateinstall.mof

Not Applicable

4,616

19-May-2011

21:26

Firewallstateprovider.dll

2.1.1116.0

137,840

15-Jun-2011

19:16

Legitlib.dll

1.9.43.0

707,448

19-May-2011

21:24

Mpprovider.dll

2.1.1116.0

177,504

15-Jun-2011

19:16

Msesysprep.dll

2.1.1116.0

41,056

15-Jun-2011

19:16

Msmpres.dll

2.1.1116.0

427,264

15-Jun-2011

19:16

Msmpres.dll.mui_enus

2.1.1116.0

85,304

15-Jun-2011

19:16

Msseces.exe

2.1.1116.0

997,920

15-Jun-2011

19:16

Msseoobe.exe

2.1.1116.0

514,344

15-Jun-2011

19:16

Msseooberes.dll

2.1.1116.0

16,816

15-Jun-2011

19:16

Msseooberes.dll.mui_enus

2.1.1116.0

16,816

15-Jun-2011

19:21

Mssewat.dll

2.1.1116.0

78,648

15-Jun-2011

19:16

Shellext.dll

2.1.1116.0

301,128

15-Jun-2011

19:16

Shellext.dll.mui_enus

2.1.1116.0

9,592

15-Jun-2011

19:21

Windowsfirewallconfigurationprovider.dll

2.1.1116.0

234,672

15-Jun-2011

19:16



mp_ambits.msi

File name

File version

File size

Date

Time

Msmpeng.exe

3.0.8402.0

11,736

27-Apr-2011

19:39

Msmplics.dll

3.0.8402.0

9,088

27-Apr-2011

19:37

Ipsconsumer.dll

3.0.8402.0

147,328

27-Apr-2011

19:37

Mpasdesc.dll

3.0.8402.0

46,976

10-May-2011

14:02

Mpasdesc.dll.mui

3.0.8402.0

44,416

10-May-2011

14:02

Mpclient.dll

3.0.8402.0

538,496

27-Apr-2011

19:37

Mpcmdrun.exe

3.0.8402.0

228,520

27-Apr-2011

19:39

Mpcommu.dll

3.0.8402.0

245,120

27-Apr-2011

19:37

Mpevmsg.dll

3.0.8402.0

34,176

10-May-2011

14:06

Mpevmsg.dll.mui

3.0.8402.0

34,176

10-May-2011

14:07

Mpfilter.sys

3.0.8239.0

165,648

18-Apr-2011

17:18

Mpnwmon.sys

3.0.8239.0

43,392

18-Apr-2011

17:18

Mpoav.dll

3.0.8402.0

67,968

27-Apr-2011

19:37

Mprtp.dll

3.0.8402.0

414,080

27-Apr-2011

19:37

Mpsvc.dll

3.0.8402.0

925,568

27-Apr-2011

19:37

Mputil.dll

1.5.3074.0

173,952

27-Apr-2011

19:37

Msmpcom.dll

3.0.8402.0

66,432

27-Apr-2011

19:37

Nisdrvtdi.sys

3.0.5807.0

46,752

25-Oct-2010

02:25

Nisdrvwfp.sys

3.0.8239.0

65,024

27-Apr-2011

19:25

Nisipsplugin.dll

3.0.8402.0

69,504

27-Apr-2011

19:37

Nislog.dll

3.0.8402.0

41,856

27-Apr-2011

19:37

Nisnetip.dll

3.0.8402.0

79,744

27-Apr-2011

19:37

Nisperformanceprovider.dll

3.0.8402.0

56,704

27-Apr-2011

19:37

Nisres.dll

3.0.8402.0

14,208

27-Apr-2011

19:37

Nissrv.exe

3.0.8402.0

208,944

27-Apr-2011

19:39

Niswfp.dll

3.0.8402.0

55,168

27-Apr-2011

19:37




x64

FEPClient.msi

File name

File version

File size

Date

Time

Ameventconsumer_cleanup.mof

Not Applicable

722

19-May-2011

21:26

Dcmnotifier.exe

2.1.1116.0

347,496

15-Jun-2011

18:35



epp.msi

File name

File version

File size

Date

Time

Ammonitoringinstall.mof

Not Applicable

7,036

19-May-2011

21:26

Ammonitoringprovider.dll

2.1.1116.0

220,288

15-Jun-2011

18:35

Amstatusinstall.mof

Not Applicable

18,175

19-May-2011

21:26

Cleanuppolicy.xml

Not Applicable

370

19-May-2011

21:26

Clientwmiinstall.mof

Not Applicable

2,460

19-May-2011

21:26

Configsecuritypolicy.exe

2.1.1116.0

381,456

15-Jun-2011

18:35

Fepunregister.mof

Not Applicable

505

19-May-2011

21:26

Firewallconfigurationnamespace.mof

Not Applicable

869

19-May-2011

21:26

Firewallconfigurationprofile.mof

Not Applicable

9,242

19-May-2011

21:26

Firewallconfigurationprovider.mof

Not Applicable

6,560

19-May-2011

21:26

Firewallconfigurationrule.mof

Not Applicable

1,243

19-May-2011

21:26

Firewallstateinstall.mof

Not Applicable

4,616

19-May-2011

21:26

Firewallstateprovider.dll

2.1.1116.0

157,952

15-Jun-2011

18:35

Mpprovider.dll

2.1.1116.0

214,608

15-Jun-2011

18:35

Msesysprep.dll

2.1.1116.0

46,736

15-Jun-2011

18:35

Msmpres.dll

2.1.1116.0

427,264

15-Jun-2011

18:35

Msmpres.dll.mui_enus

2.1.1116.0

85,304

15-Jun-2011

18:35

Msseces.exe

2.1.1116.0

1,436,736

15-Jun-2011

18:35

Msseoobe.exe

2.1.1116.0

671,440

15-Jun-2011

18:35

Msseooberes.dll

2.1.1116.0

16,816

15-Jun-2011

18:35

Msseooberes.dll.mui_enus

2.1.1116.0

16,816

15-Jun-2011

18:39

Mssewat.dll

2.1.1116.0

78,648

15-Jun-2011

18:35

Shellext.dll

2.1.1116.0

395,912

15-Jun-2011

18:35

Shellext.dll.mui_enus

2.1.1116.0

9,592

15-Jun-2011

18:39

Windowsfirewallconfigurationprovider.dll

2.1.1116.0

310,904

15-Jun-2011

18:35



mp_ambits.msi

File name

File version

File size

Date

Time

Msmpeng.exe

3.0.8402.0

12,784

27-Apr-2011

21:21

Msmplics.dll

3.0.8402.0

9,088

27-Apr-2011

21:19

Msmplics.dll (x86 directory)

3.0.8402.0

9,088

27-Apr-2011

19:37

Ipsconsumer.dll

3.0.8402.0

203,648

27-Apr-2011

21:19

Mpasdesc.dll

3.0.8402.0

48,512

10-May-2011

15:35

Mpasdesc.dll.mui

3.0.8402.0

44,416

10-May-2011

15:35

Mpasdesc.dll.mui (x86 directory)

3.0.8402.0

44,416

27-Apr-2011

19:51

Mpasdesc.dll (x86 directory)

3.0.8402.0

46,976

27-Apr-2011

19:50

Mpclient.dll

3.0.8402.0

759,680

27-Apr-2011

21:19

Mpclient.dll (x86 directory)

3.0.8402.0

538,496

27-Apr-2011

19:37

Mpcmdrun.exe

3.0.8402.0

273,352

27-Apr-2011

21:21

Mpcommu.dll

3.0.8402.0

338,304

27-Apr-2011

21:19

Mpcommu.dll (x86 directory)

3.0.8402.0

245,120

27-Apr-2011

19:37

Mpevmsg.dll

3.0.8402.0

34,176

10-May-2011

15:39

Mpevmsg.dll.mui

3.0.8402.0

34,176

10-May-2011

15:39

Mpfilter.sys

3.0.8239.0

189,440

18-Apr-2011

17:18

Mpnwmon.sys

3.0.8239.0

40,832

18-Apr-2011

17:18

Mpoav.dll

3.0.8402.0

63,360

27-Apr-2011

21:19

Mpoav.dll (x86 directory)

3.0.8402.0

67,968

27-Apr-2011

19:37

Mprtp.dll

3.0.8402.0

581,504

27-Apr-2011

21:19

Mpsvc.dll

3.0.8402.0

1,373,568

27-Apr-2011

21:19

Mputil.dll

1.5.3074.0

217,472

27-Apr-2011

21:19

Msmpcom.dll

3.0.8402.0

75,648

27-Apr-2011

21:19

Nisdrvtdi.sys

3.0.5807.0

62,176

25-Oct-2010

02:25

Nisdrvwfp.sys

3.0.8239.0

84,864

27-Apr-2011

19:25

Nisipsplugin.dll

3.0.8402.0

85,376

27-Apr-2011

21:19

Nislog.dll

3.0.8402.0

45,440

27-Apr-2011

21:19

Nisnetip.dll

3.0.8402.0

103,808

27-Apr-2011

21:19

Nisperformanceprovider.dll

3.0.8402.0

70,016

27-Apr-2011

21:19

Nisres.dll

3.0.8402.0

15,232

27-Apr-2011

21:19

Nissrv.exe

3.0.8402.0

288,272

27-Apr-2011

21:21

Niswfp.dll

3.0.8402.0

68,480

27-Apr-2011

21:19



Known Issues

  • When upgrading the FEP client (FEPInstall.exe) on 64-bit Windows 7 or Windows Server 2008 R2 computers, either manually or through System Center Configuration Manager, two shortcut icons may appear in the Start > All programs menu: one named “Forefront Endpoint Protection” the other “Forefront Endpoint Protection 2010”. Both shortcuts properly launch the client user interface. The “Forefront Endpoint Protection 2010” shortcut can be safely deleted.


  • This update adds additional information to policies created in the Forefront Endpoint Protection console. When installing this update in your environment you should deploy it to all Forefront Endpoint Protection management consoles. Modification of a policy created with this update on a Forefront Endpoint Protection console without this update may result in loss of the new policy information.



  • You may be prompted for your original CD media if you originally installed the Forefront Endpoint Protection release and then applied this update.


  • The additional information added to alerts required changes to the events logged by the site server to the event log. After this update is applied, parameter data for prior malware detection events in the event log is not populated or is associated with different text. This is expected behavior and does not affect the proper operation of prior or future alerts.


  • You can customize the data retention value by using the steps outlined in FEP 2010 Reporting Database Maintenance. However, after running a repair on your FEP installation, or after applying an Update Rollup, the data retention value is reset to the default value of 12 months. You must perform the steps in FEP 2010 Reporting Database Maintenance in order to reset the data retention value to what is required in your organization.

References

Before you install this update, you must install hotfix KB2554364 for your operating system architecture. For more information, see:

2554364 Reporting update prerequisite for Forefront Endpoint Protection 2010 Update Rollup 1

For additional information on Update Rollup 1, including how to download and install the update, see the following TechNet articles:


Need more help?

Expand your skills
Explore Training
Get new features first
Join Microsoft Insiders

Was this information helpful?

Thank you for your feedback!

Thank you for your feedback! It sounds like it might be helpful to connect you to one of our Office support agents.

×