Wednesday 12 March 2014

Setup was unable to compile the file DiscoveryStatus.mof



You start client Installation and realize that install fails with error code 80041002, even cleaning up install directories or repairing WMI doesn’t help

Symptoms: sms setup starts and finishes with error and clients will not be installed, the ccmsetup.log shows the error “Setup was unable to compile the file DiscoveryStatus.mof”

Applies to:  SCCM 2012

Troubleshooting Steps:
1.       Open CMD in the administrator command prompt
2.       Navigate to C:\Program Files\Microsoft Policy Platform
3.       mofcomp ExtendedStatus.mof
4.       Retry the CM client installation

Root Cause Analysis: Configuration manager 2012 clients will depend on the Lantern Services Microsoft Policy platform Processor

Tuesday 11 March 2014

Endpoint Protection 2012 on Windows Hyper V Cores- utilizing MPCMDRUN.exe



Well you are good to go with System Center Endpoint Protection 2012, once you have got the role enabled and client rolled out, now while its pretty simple to manage the client with the client interface available in task bar, but how do you manage Hyper V Core server without GUI.
Seems a challenge right, well here is a tool you can leverage.

One of the most vital tools for an SCEP admin is MpCmdRun.exe. With this command-line utility, you can perform a definition rollback, force a signature update, restore a file from quarantine, or kick off a scan. Almost any operational scripting tasks you wish to perform will center on MpCmdRun.exe.

Getting Ready…
By default, MpcmdRun is stored in the C:\Program Files\Microsoft Security Client\ Antimalware directory. Although MpcmdRun can be used to accomplish many tasks with SCEP, this recipe will only describe how to launch a full scan from the command line.

How to do it…
1.       Open the Command Prompt window.
2.       Navigate to C:\Program Files\Microsoft Security Client\Antimalware directory.
3.       Enter the following command:
4.       MpCmdRun  -scan -2
5.       Once the full scan is completed, close the Command Prompt window.

How it works…
To view all options available for the utility, enter MpCmdRun -? in the Command Prompt window. A partial output is included for reference in the following example. The full contents of the Mpcmdrun help file can be found in the appendix.

Usage:
MpCmdRun.exe [command] [-options]
Command Description
   -? / -h                                    Displays all available
options for this tool
   -Scan [-ScanType #] [-File  [-DisableRemediation]]  Scans for
malicious                                                           
   -Scan [-ScanType value]
        0  Default, according to your configuration
        1  Quick scan
        2  Full system scan
        3  File and directory custom scan
           [-File ]

Monday 10 March 2014

Management Point Component stops working on SCCM after you rebuilt/reset sccm site



Symptoms: Logs indicate “MP Control Manager detected MPsetup has failed to create the CCM_Incoming Virtual Directory”

Applies to: SCCM 2007

Troubleshooting Steps:
1.       Remove the MP as a site system role (if it is still installed), wait for it to finish
2.       Run a ccmclean /all (this is a tool you can find in the SMS 2003 Toolkit 2)
3.       Remove IIS completely with all components
4.       Reboot
5.       Stop the Task Scheduler Service
6.       Rename the %windir%\Tasks folder to something else (or move it)
7.       Start the Task Scheduler Service (this will recreate the %windir%\Tasks folder)
8.       Optional: Enable auditing on the \inetpub\wwwroot folder (and subfolders). Make sure to set local security policy to trap failures of file access.  We will need this in case we see the same security failure.
9.       Reinstall IIS, BITS, WebDAV
10.    Insure BITS and WebDAV are enabled
11.    Reinstall the MP

Root Cause Analysis:
The Site had crashed and was rebuilt, the Task scheduler had issues with creation of Tasks for MP, hence MP is not able to create Incoming folders and hence the management point component will not work. MP needs to be removed and also recreated along with IIS, once MP is removed the Task Scheduler Service needs to be stopped after the reboot and the tasks folder needs to be renamed. Once the service is enabled the Tasks folder is recreated in Windows directory. Later install the IIS and then the MP.