An anti-malware platform update for Endpoint Protection clients is available from Microsoft Support

Update information

This anti-malware platform update contains the following improvements:

• Updates the platform to network real-time behavior monitoring functionality
  
  Provides a new protection capability that combines suspicious network activity with other suspicious behavior monitoring already included in the product triggering telemetry and sample submission for suspicious files that may require further analysis.
  
  For information about how to configure this feature, see the following Windows website:
  
  

  WMI Providers
  For more information, see the following System Center Configuration Manager Team Blog website:
  
  

  Enhancements to Behavior Monitoring and Network Inspection System in the Microsoft anti-malware platform
  

• Adds support of more operating systems
  
  This update adds support for the following operating systems:

  • Windows 8.1 Enterprise

  • Windows 8.1 Pro

  • Windows Server 2012 R2 Datacenter

  • Windows Server 2012 R2 Enterprise

  
  

• Adds manageability support
  
  A WMIv2 provider is now available that enables programmatic management of functions in the user experience, such as disabling user interfaces on unattended terminals.
  
  For information about the provider and for the API description, see the following Microsoft website:
  
  

  WMI Providers
  For information about PowerShell cmdlets that are also available for administrative scripting, see the following Microsoft TechNet topic:
  
  

  Windows and Windows Server Automation with Windows PowerShell

• Adds anti-tampering functionality to reduce the risk that malware will disable or bypass anti-malware scanning
  
  For example, access to registry and services that are used by the anti-malware platform can be managed only directly through supported administrative options (trusted channels) through the System Center Configuration Manager console.
  
  

• Improves overall performance of the anti-malware platform
  
  The anti-malware performance is improved compared to previous platform versions. Improvements are made for signatures that are delivered through the Microsoft Active Protection Service (MAPS). These changes contain no configurable or customer-facing effects.
  
  For more information about MAPS, see the following Microsoft website:
  
  

  Description of the Microsoft Active Protection Service Community

• Adds more language support to the anti-malware platform
  
  The following new languages are supported:

  • Chinese (Hong Kong SAR) (zh-HK)

  • Chinese (PRC) (zh-CN)

  • Chinese (Taiwan) (zh-TW)

  • English (en-US)

  • French (fr-FR)

  • German (de-DE)

  • Italian (it-IT)

  • Japanese (ja-JP)

  • Korean (ko-KR)

  • Portuguese (Brazil) (pt-BR)

  • Russian (ru-RU)

  • Spanish (es-ES)

  
  

• Adds a configurable automatic sample submission option
  
  By default, if your computer is opted in to MAPS, you may be prompted to send suspicious files to Microsoft for further analysis. This update enables new configuration options for this sample collection by providing an option to automatically send such files as .exe files without you being prompted. Be aware that all files that potentially contain personally identifiable information will continue to prompt you.
  
  Notes about this option

  • This option includes an updated Microsoft Software License Terms and Privacy statement that discusses this functionality.

  • This option setting is configurable through Windows Management Instrumentation (WMI).

  • This option currently provides no user-configurable capability in the System Center Configuration Manager console or the Administrative Template (.admx) files.

  • This option requires MAPS membership.

  
  
  For policy configuration information, see the following Microsoft TechNet topic:
  
  

  FEP ADMX Reference

• Makes several client fixes
  
  In addition to the improvements that are listed here, this release fixes the following client issues:

  • Microsoft Exchange Server 2003 interoperability
    
    The installation of the Endpoint Protection client on Exchange Server 2003 may cause ActiveSync failures such as Event ID 3005. To prevent this problem, create the following registry value:
    
    

    Registry location: HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\mpfilter\Parameters
    DWORD name: DisableReadHooking
    DWORD Value: 1
    Notes about this setting

    • Restart the Exchange Server 2003 for the change to take effect.

    • This value setting alters how Endpoint Protection client handles file access. However, it does not affect detection ability.

  • Incorrect Environment Variable
    
    Installing the Endpoint Protection agent creates an additional PSModulePath environment variable that contains a trailing space. This is listed as a duplicate environment variable.
    
    

  • Alternative drive installation
    
    The /drive parameter does not change the product's AppDataPath value to the specified drive. It changes only the Program Data path.