SCEP/SCCM Endpoint Security - new setup - definitions not updating

[gerardsweeney]

Hello, all.

 

Like others, I've started looking at SCEP as an alternative to our current AV.

 

I've followed assorted guides to configuring our SCCM setup so that it has Endpoint configured, and the definitions set to download via Automatic Deployment Rule.

 

I've done the following:

 

* Add role, Endpoint Protection Point

* Created a test collection with a couple of Windows 10 PCs (called Endpoint Protection test PCs)

* Created custom Client Settings (called Endpoint protection) with the following:

 

Device settings:

Manage endpoint: Yes

Install Endpoint protection: Yes

Automatically remove previously installed: Yes

Allow Endpoint proection clientinstall outside maintenance windows: No

Embedded - commit Endpoint install: Yes

Suppress any required restarts after Endpoint client install: Yes

Disable alternate sources for initial definition update: No

 

This is deployed to my test collection (Endpoint protection test PCs)

 

Use RCT to force policy checking - it doesn't uninstall our current AV.

 

On test PC1, I manually uninstall the current AV and reboot.

When I go into Defender on PC1, it shows the settings are controlled by admin

On SCCM console, Monitoring, Security, SCEP Protection Status, I see 2 PCs in the collection with 2 at risk

If I click on the at risk, PC1 shows as managed, PC2 shows as failed (see above)

 

 

* Create a custom anti-malware policy (Antimalware Policy 1)

Follow the exclusion options in https://support.microsoft.com/en-us/help/327453/recommended-antivirus-exclusions-for-configuration-manager-2012

Base the other settings from https://www.prajwaldesai.com/installing-and-configuring-endpoint-protection-role-in-sccm-2012-r2/

Initial settings:

Definition updates - Check every 6 hours

Sources - Updates distributed from Configuration Manager (that's the only box ticked)

Deployed to my test PC collection

 

* Download definition updates in Software Updates

Site Configuration, Sites, Software Update Point, Classifications = Definition Updates

Products = Forefront/System Center Endpoint Protection

Our sync schedule (from before we looked at Endpoint protection) is set to every 7 days.. I'm assuming that'll need to be changed.

Right click on All Software updates, Synch. Leave it plodding away

 

* Check the definitions are there

All software updates, search for "endpoint" - I see assorted KB2461484 with "Y" for downloaded

 

* Create Software update group

Call it "Endpoint protection definition updates"

 

 

* Create ADR

Collection = My test PC collection

Deployment Settings = Use WOL; Detail level = only errors

Deployment Schedule

 

Based on client local

Software available = ASAP (I also tried specific time, and changed the hours)

Install deadline = ASAP

Delay enforcement = unticked

 

User experience

Notification = show in Software Center, and only show notifications for restarts

Deadline Behaviour = Software Update install = checked, restart = unchecked

 

Restart behaviour

Supress for Servers and workstations (Our PCs shutdown at 6PM nightly)

 

Download settings

Download software updates from DP

Download software from DP in default boundary group

Download from Microsoft updates if not available (this won't work - our proxy won't let it out)

 

Deploy the created Deployment package to the DP which my test PCs use

 

And - that's as far as I get.

My test PC stubbornly refuses to download updates, and they don't appear in Software Center (which I'd assume they should from the settings above??).

 

 

I get the feeling I'm just missing one simple thing, but I'm blowed if I know what it is.

If someone can advise on the logs which would be helpful, I'm happy to put them up somewhere.

 

 

Many thanks!

Gerard

[Rnrjeff]

Did you ever get this figured out? I am running into a similar problem but some are all good and some say managed but won’t download definition updates.