SCCM 2012 and FEP 2012

[localzuk]

I've now got my SCCM server installed and, well, doing nothing.

 

I can deploy the SCCM client manually, and I've set up a device collection and related policy for deploying FEP to clients.

 

However, if I then select this policy and click Deploy, nothing happens. SCEP doesn't end up on the client.

 

What have I missed?

 

Basically, I have a default SCCM install, and then have followed the guide here - http://msandbu.wordpress.com/2012/05/05/forefront-endpoint-protection-in-sccm-2012/

[FN-GM]

Have in install the Endpoint Protection roles and enabled it in the clinet policy?

 

PS: It isnt called FEP anymore but Endpoint Protection so you might be looking for the wrong thing.

[localzuk]

Have in install the Endpoint Protection roles and enabled it in the clinet policy?

 

PS: It isnt called FEP anymore but Endpoint Protection so you might be looking for the wrong thing.

 

Yup. Done that.

[MatthewL]

You have got the SCCM client deployed to the machines haven't you?

[localzuk]

You have got the SCCM client deployed to the machines haven't you?

 

How? The client is supposed to be deployed by SCCM... It gets added to the Client folder in the SCCM share on the server (ie. there is now a scepinstall.exe and ep_defaultpolicy.xml file). These are both supposed to be deployed according to the Client Settings.

 

Another set of instructions saying basically the same thing - http://www.petervanderwoude.nl/post/system-center-2012-endpoint-protection-point-in-system-center-2012-configuration-manager-rc/

 

EDIT: Misread... Yes, I have deployed the client to the test machine.

Edited July 23, 2012 by localzuk

[MatthewL]

I am talking about the SCCM client, each machine needs it on so it can pull the SCCM bits down. It needs to be on before any software can be deployed to the machine. We scripted ours manually on our login scripts.

[localzuk]

I installed it via SCCM (ie. right clicked on a machine and clicked install client). So the SCCM client is installed, yes.

[FN-GM]

Have you done a policy reresh on the clinet? Did you assign the client policy to a collection and is the test client in that collection?

[localzuk]

Have you done a policy reresh on the clinet? Did you assign the client policy to a collection and is the test client in that collection?

 

Yes to all 3.

[Theblacksheep]

Have you checked the SCCM logs on the client?

 

This will tell you what policies are being applied.

 

Do you have any client settings relating to BITS policies (in sccm) that are slowing downloading of the additional files?

 

Again, logs and the temp area can help here.

Edited July 23, 2012 by Theblacksheep

[localzuk]

Have you checked the SCCM logs on the client?

 

This will tell you what policies are being applied.

 

Do you have any client settings relating to BITS policies (in sccm) that are slowing downloading of the additional files?

 

Again, logs and the temp area can help here.

 

The SCCM logs make about as much sense to me as Swahili...

 

I've not set up any BITS policies at all.

 

Attached are the logs on the client I'm testing with.

Logs.zip

[Theblacksheep]

Have you got the ccmsetup.log for the PC in question?

 

Does it appear in the SCCM console listed as SCCM installed? and has Software Center in Start Menu? Is it in a enabled boundary? (and in turn group) Finally has it rebooted since install?

 

There's some SCCM log info here: Technical Reference for Log Files in Configuration Manager

 

Its worthwhile getting CMtrace if you've not already to help make sense of SCCM log, I say make sense, I mean 1% less confusing.

Edited July 23, 2012 by Theblacksheep

[localzuk]

Have you got the ccmsetup.log for the PC in question?

 

Attached

 

Does it appear in the SCCM console listed as SCCM installed? and has Software Center in Start Menu? Is it in a enabled boundary? Finally has it rebooted since install?

 

Yup, yup, yup, and yup.

 

There's some SCCM log info here: Technical Reference for Log Files in Configuration Manager

 

Its worthwhile getting CMtrace if you've not already to help make sense of SCCM log, I say make sense, I mean 1% less confusing.

 

I will take a look.

ccmsetup.txt

[Theblacksheep]

Attached

 

 

 

Yup, yup, yup, and yup.

 

 

 

I will take a look.

 

The old version of smstrace also works with their log files too. Couldnt see anything relating to scep.exe in your ccmsetup log.

 

Might be worth grabbing the version off the server and doing a manual install then compare the log files, I could have sworn it dives straight into scep setup afterwards. Will take a look at one of our logs tomo.

Edited July 23, 2012 by Theblacksheep

[sonofsanta]

Not in work to check my server today but I did this literally last week and didn't have a problem, so it is doable. Check your firewall connections, perhaps. Are you working with HTTP or HTTPS?

 

Also relevant: Technical Reference for Log Files in Configuration Manager (click on Endpoint Protection to expand the list and see the relevant logs; use CMTrace.exe in (iirc) the Tools folder of the install media top open the logs, it makes them readable. Look for red highlights and Google error codes, usually brings something up)

 

If you've not sorted it by tomorrow I'll see if I can have a nosy around my set up and dredge up some useful hints, but the power is off onsite today so I can't even remote in to check for you. Plus, y'know, sunshine. Need to take advantage of that while I can*.

 

*disclaimer: I'm more likely to start Borderlands up. Bit warm outside.

[localzuk]

Still not had any luck! We're using HTTP (eg. whatever is default out of the box).

 

Driving me mad now!

[Theblacksheep]

Your setup looked like it completed OK (according to your ccmsetup.log) but it doesn't reference scep at all, it just references the client.msi.

 

Can you confirm your site server has the endpoint protection role? is it ok in monitoring/system status/component status?

 

The ccmsetup.log should the following in this order but with loads of rubbish in between:

 

*Item 'SCEPInstall.exe' is applicable. Add to the list.

*Discovering whether item 'SCEPInstall.exe' exists.

*Item SCEPInstall.exe has not been installed yet. Put to pending install list.

*Adding file 'http://someserver:80/SMS_DP_SMSPKG$/sitecode00002/SCEPInstall.exe' to BITS job, saving as 'C:\Windows\ccmsetup\SCEPInstall.exe'.

*C:\Windows\ccmsetup\SCEPInstall.exe is Microsoft trusted.

 

In 2012 it downloads scep and dumps it in C:\windows\ccmsetup. On another machine, do an install and keep an eye in the windows\ccmsetup\ folder for the files are you tell it to install and keep an eye on the ccmseup.log. Does it copy over all the content? for instance it grabs silverlight, then scep, then windowsfirewallconfigurationprovider just after the client has downloaded.

 

Try doing a manual install by getting the files off the server (handy to have anyway), you have something you can compare logs with.

Edited July 24, 2012 by Theblacksheep
1603

[sonofsanta]

I can't remember how I told the EP client agent to install but I suspect that's because it happens automatically once you add the role. It happens automatically for me now on Windows 7 computers so try this... (this is a step towards production but I'm still halfway twixt XP and 7 so it's workable as a test environment still)

 

* Set up your discovery methods if you haven't already (ask if you're not sure but there are links about, search Google for windows-noob.com results for some good stuff)

* Set up a GPO that only applies to Windows 7 computers with a WMI filter:

select * from Win32_OperatingSystem where Version like "6.1%" and ProductType = "1"

- use this GPO to set your SCCm server as the WSUS server under Windows Update]

* In SCCM, under Administration, expand Site Configuration, click on Sites and click on Client Installation Settings in the ribbon abd choose Software Update-Based Client Installation. Tick the box and OK.

* Just below that, cick Servers and Site System Roles and make sure your server is set up as an Endpoint Protection Point (right click and Add Site System Roles if it's not listed at the bottom)

* After that it should all just... work. It does here, anyway, and I faffed about doing it the HTTPS way.

 

As @Theblacksheep says, you should see hints of it in ccmsetup.log that's in c:\windows\ccmsetup. It sometimes takes a while to download stuff using BITS but once you've set a computer running windows update (gpupdate /force, then wuauclt /reportnow then wuauclt/detectnow) it will just do it all quietly in the background, you'll just have to check the systray and look for the green shield to see if it's worked.

 

Further reading (including automatic approval & deployment of definition updates): using SCCM 2012 RC in a LAB - Part 5. Enable the Endpoint Protection Role and configure Endpoint Protection settings - Configuration Manager 2012 - Release Candidate - www.windows-noob.com

 

EDIT: further check: has FEP installed on your SCCM server? It should do as part of setup, if it's not running on that server yet then it won't deploy to clients

[localzuk]

Right. An update on this. I'm currently resolving some issues caused by the fact that we have a domain forest here, and the SCCM server was failing to publish to the AD as the permissions it had weren't good enough.

 

Also, there is an issue with our group policy somewhere as no registry settings are being applied for some reason. So, I'll work through those 2 issues and come back when it all works, with a description of exactly what caused all this!

[localzuk]

Aannddd.... Its working

 

I had to fix the AD publishing, and then add a Boundary Group.

 

I didn't at all do a fist pump or dance in the office...

[sonofsanta]

Aannddd.... Its working

 

I had to fix the AD publishing, and then add a Boundary Group.

 

I didn't at all do a fist pump or dance in the office...

 

Gratz

 

(I should add, as well, that the only reason I used the Windows 7 WMI filter earlier was because I'm rolling Win7 out at the moment and don't want to clog SCCM up with old XP clients that are about to die. It's not necessary)

[localzuk]

Gratz

 

(I should add, as well, that the only reason I used the Windows 7 WMI filter earlier was because I'm rolling Win7 out at the moment and don't want to clog SCCM up with old XP clients that are about to die. It's not necessary)

 

Indeed, I ignored it, as I don't care which machines get it. They'll all be Windows 7 by the end of next week.

 

Also found that something in our default domain policy was being weird too. Now fixed and all is as it should be. I shall reward myself with beer tonight!

[Theblacksheep]

Aannddd.... Its working

 

I had to fix the AD publishing, and then add a Boundary Group.

 

I didn't at all do a fist pump or dance in the office...

 

Glad you got it working.

 

The boundary group got me even after setting up. I had one range for testing and couldnt work out why a PC in new range (vlan) wasn't receiving the software. Low an behold SCCM2012 uses boundary groups to detect distribution groups and in turn content delivery. No boundary group, no content.

Edited July 26, 2012 by Theblacksheep