IT Evangelist

Configure Alerts in SCEP

5.0 Validate SCEP Settings on Client

2012-02-12T19:45:00.001-08:00

To be performed by SCCM Administrators and security team

Once the SCEP Client is installed on a client, it will show up under Start -> All Programs.

You can also view the latest defintion status and policy details by clicking on Help -> About System Center End Point Protection

The deployed Antivirus Definitions Version can also be located in the registry settings under:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Microsoft Antimalware\Signature Updates\ASSignatureVersion

Details of the Antimalware Client Agent can be accessed at the following registry key:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{0C243024-B7AF-478B-B6F1-574A4AB0E07C}

Other guides:

Validate SCEP Settings on Client

4.0 Configure and Install Antivirus Definition

2012-02-12T19:40:00.001-08:00

To be performed by SCCM Administrators and security team

SCCM ASUP Server will be configured to download the antivirus definitions on a daily basis. The Antivirus definitions are downloaded by the ASUP component of the SCCM Server.
In order to configure the ASUP server to download antivirus defintions, log on to the central adminiration site server

open the SCCM Console -> Go to Administration -> Sites -> Central Administration Site Server ->Settings -> Configure Site Components -> Software update Point
Click on Classifications and select Definition Updates
Click on Products and select Forefront EndPOint Protection
Click on Sync Schedule and set the synchronization schedule as desired

Once configured, SCCM will sync the patches with Microsoft website and all antivirus definitions will show up under Software Library -> All Software updates

Manage Antivirus Definitions

To be performed by SCCM Administrators and security team
Once the definitions show up in SCCM, the next logical steps include:

Create a grouping of relevant updates. These are referred as Software Update Groups
Download the definitions in SCCM
Deploy the definitions on a target collection

Operationally this entire process will be automated by utilizing the Automatic Deployment Rules feature of SCCM. Ensure the following entities are available before creating an Autotic Deployment Rule:

A common share to deploy the defintions
Target collection to deploy the definitions

Follow the following steps to create Automatic Deployment Rules for SCEP:

On the SCCM Console, go to Software Library -> Automatic Deployment Rule-> Right Click and Click on Create Automatic Deployment Rule
Name the Deployment Rule and link it to an appropriate collection. Ther are two options to select either to add the definitions to existing software update group or to create a new one. Select to create a new software update group so that a new update gets created periodically and the security team can monitor which definition gets deployed when. There is an additional overhead to delete earlier software update groups which can be automated.

Click Next and Select appropriate deployment settings
Click Next and select the Filter for deploying the Antivirus Defintions.
Click Next, and set the Evaluation Schedule. Ensure that the evaluation is scheduled to run after the patches are synced up by the Activue Software update Point e.g. in our case the update sync happens at 10:00am and the evaluation happens at 2:00pm everyday.
Click Next and set the deployment schedule for the definitions. The defintions will be available as soon as possible while the installation deadline will be set to expire 2 hours after the deployment.
Click Next and set the User Experience and Alerts as required
Click Next and set the Download Settings. For the first time that we create the automated rule, a new deployment package can be created a linked to the share where all the definitions should be downloaded.
Click Next and specify the Distribution Points where the defintions should be distributed. In a production environment, a defintion should go to all the DPs in the environment.
Once the rule is set, the definitions will start getting downloaded at the location specified

Other guides:

Configure and Install Antivirus Definition

3.0 Configure and Install SCEP Antimalware Policies

2012-02-12T19:39:00.001-08:00

To be performed by SCCM Administrators and security team

SCEP Client policies define where the client can obtain the defintion updates, when does it perform scans, and what files are scanned.
In order to create a new policy, right click on Assets and Compliance and click on Create Antimalware Policy. As a best practice, a new policy should be created and deployed to a limited number of computers using a collection.

The SCCM Antimalware Policy allows us to set the following options:

Scheduled Scans
Scan Settings
Default Actions
Real-Time Protection
Exclusion Settings
Advanced Settings
Threat Overrides
Microsoft Active Protection Service
Definition updates

The section below provides the best practice settings for the Antimalware Policy settings. The details of each scan setting are available at the following link:
http://www.microsoft.com/sqlserver/en/us/get-sql-server/try-it.aspx

Scheduled Scans
The schedules scans settings enable to specify the behavior of the scan details for a client.

Setting Description	Setting	Default
Scan time	4:00pm	2:00am
Check for the latest definitions updates before running a scan	True	False
Randomize the scheduled scan start time (within 30 minutes)	True	False

Scan Settings

The scans settings specify the content that should be scanned on a client.

Setting Description	Setting	Default
Scan email and email attachments	True	False
Scan archived files	True	False
Randomize the scheduled scan start time (within 30 minutes)	True	False

Default Actions
The default actions allow SCEP to respond to certain threats in a specified manner.

Real-Time Protection
The real-time protection settings allow SCEP to ascertain whether to scan real time files such as program activity, scripts, and system files etc.

Exclusion Settings
The exclusion settings allows SCEP to exclude certain files and file types from Antivirus scans

The following files are excluded from any antivirus scans.

Advanced Settings

Advances settings allow SCEP to configure additional settings such as user interaction with the agent and other antivirus settings.

Threat Overrides

Threat Override settings allow SCEP to define remediation actions that can be taken for a specified threat name when detected during a scheduled scan.

All the threats are enlisted in SCEP and an appropriate action can be ascertained.

Microsoft Active Protection Service
The Microsoft Active Protection Service enables MS to collect and send information about and detected Malware.

Definition updates

The defintion updates setting allows SCEP to determine the methodology to deploy definitions.

Setting Description	Setting	Default
Check for EndPoint	6 hours	8 hours
Check for end point protection definitions daily at	12 PM	3 PM
Set sources and Order for Endpoint Protection definition updates	3 Updates from SCCM Updates from UNC Share Updates from Malware Protection Center	1

Antivirus definitions will also be downloaded manually to a UNC path on the Primary Site Server such that the definitions are available to all clients even if the SCCM CAS server goes down and is not able to dync the latest definitions from Microsoft.

Other guides:

Configure and Install SCEP Antimalware Policies

2.0 Configure and Install SCEP Client Agent

2012-02-12T19:36:00.001-08:00

To be performed by SCCM Administrators and security team

This section provides details on the steps necessary to install the SCEP Client Agent on an end user computing device. There are 2 options to install the SCEP Agent:

As part of the Task Sequence / Image Install
Automated fashion using SCCM Client Agent Settings

Deploy SCEP using Task Sequence
SCEP can be deployed using a Task Sequence for all end user computing devices using a command to install the SCEP agent.
The application should have a deployment type with the following command:
Scepinstall.exe /s /q
Refer to the following link for more details on how to deploy SCEP using command line:
http://technet.microsoft.com/en-us/library/gg412485.aspx

Deploy SCEP using SCCM Client Agent
SCEP can also be deployed automatically using SCCM Client Agent policies.
Open Administration -> Client Settings in SCCM 2012 and create a new policy for End Point Protection.
It is a good practice to create a new policy for end point protection and not integrate with the default client settings since you can deploy the customized policies on a handful of computers to ensure it works as desired before making a production rollout.

Set the Manage EndPoint Protection client on Client Computers to TRUE. Setting this value to true will
push the SCEP client on any client that has a healthy SCCM Client agent working. You can manage the scope of the SCEP installation by deploying the policy to a collection with a restricted set of computers.

The best practice settings are as follows:

Client Settings	Values
Manage Endpoint Protection client on client computers	True
Install Endpoint Protection client on client computers	True
Automatically remove previously installed antimalware software before Endpoint Protection is installed	False
Suppress any required computer restarts after the Endpoint Protection client is installed	False
Allowed period of time users can postpone a required restart to complete the Endpoint Protection installation (hours)	24 hours (default)
Disable alternate sources (such as Windows Update, Microsoft Windows Server Update Services or UNC shares) for the initial definition update on client computers	True

Refer to the following link on description for each setting:
http://technet.microsoft.com/en-us/library/hh508770.aspx

With the following settings in place:

SCEP will be installed on an end user computing device that has SCCM Installed
The command that SCCM uses for the SCEP client installation is "C:\Windows\ccmsetup\SCEPInstall.exe" /s /q /noreplace /NoSigsUpdateAtInitialExp /policy "C:\Windows\CCM\EPAMPolicy.xml"
Here EPAMPolicy.xml refers to the SCCM policy being pushed to the client. SCCM Policy will be covered in the subsequent section
The EndpointProtectionAgentLog file on http://www.blogger.com/ shows the following entries:
- End point is triggered by WMI notification
- It installs the command line "SCEPINstall.exe"

Other guides:

Configure and Install SCEP Client Agent