Introduction : Forefront EndPoint Protection with SCCM 2010

[Inigo]

Microsoft has launched in 2006 in the antivirus software with Windows Live OneCare. This software is designed for individuals had a particular licensing mode offers the possibility to install it on 3 PCs in one household. After renaming the first to integrate the Windows Live suite. Windows Live OneCare was arrested in November 2008. Microsoft, however, did not abandon the idea to enter the market until now mainly occupied by Symantec. In parallel, Microsoft's strategy then was different since the Redmond company has been dedicated to corporate antivirus market by offering Microsoft Client Protection in 2005. This first version was later renamed in 2007: Forefront Client Security (FCS). This virus containing the bases of OneCare was successful thanks to the aggressive strategy on the price of Microsoft licenses. In late 2009, Microsoft is relaunching in the adventure of antivirus dedicated individuals. Building on its success with FCS, Microsoft launches Windows Security Essentials, a free antivirus. The computer world was pleasantly surprised at the quality of the virus and its overall performance. Today, FCS is getting old and expectations are many. So that Microsoft announced in early 2010 the release of a new version of its antivirus company will be renamed: Forefront EndPoint Protection.

[Shanbaag]

Forefront EndPoint Protection 2010 mark a change in the functioning of the range of antivirus company Microsoft. Unlike Forefront Client Security (FCS) which was built on a specific version of Microsoft Operations Manager (MOM) 2005; EFF 2010 is built for it on the basis of the System Center. Thus, the product is separated into two modules:

• Forefront EndPoint Protection 2010: This module is the body of the product. It integrates with System Center Configuration Manager 2007 to provide the tools necessary to manage daily client (agent deployment, policy enforcement, ...).
• Forefront Security EndPoint Protection 2010 Management Pack, formerly known as EndPoint Protection for Forefront Server (S-EFF) during the beta phases. This module is a management pack (MP) that integrates with System Center Operations Manager 2007 to provide a layer of oversight alert services EFF of SQL Agent jobs that copy data from the database EFF EFF to the Data Warehouse, or events generated by servers EFF.

[Rock Villa]

Infrastructure Forefront EndPoint Protection 2010 consists of:

• The database Forefront EndPoint Protection 2010: The database stores all FEP status information returned by customers, collections, memberships collections, strategies, etc ...
• Database Reporting Forefront EndPoint Protection 2010: The database is the Reporting Data Warehouse (Data Warehouse) to store data required for reporting).
• The Configuration Manager site server and its extension to VET 2010: This role is the site server System Center Configuration Manager. It simply adds the components necessary for the administration of VET with SCCM. This includes collections EFF, packages and programs, the baselines for the management of VET configurations desired.
• EFF Alerts and Reporting 2010 allows the installation of monitoring components of the infrastructure EFF.
• The Configuration Manager console and its extension to EFF 2010 is an extension of System Center Configuration Manager 2007 for the integration of EFF.

[Pollock]

The administrator of the computer handles everything from the Configuration Manager administrative console. Strategies and operations are applied to the customer through the EFF SCCM client. The EFF began its client state using the base lines essential to the functioning of the product. These data are stored in the database EFF. In parallel, the administrator can also use the default baselines to determine the compliance status of the client. On a regular basis, a storage operation takes place to synchronize the database with the EFF data warehouse (Data Warehouse) used for reporting. As explained earlier, Forefront EndPoint Protection 2010 is an additional layer made to System Center Configuration Manager. This makes Forefront EndPoint Protection 2010 a poor student in high commodity prices available since it is dependent on the services of System Center Configuration Manager. Indeed, it is difficult to make highly available SCCM. You can make certain roles highly available as the Management Point, Software Update Point or the database. However, the site server can not be part of this plan. Microsoft recommends using:

• On a clustered SQL Server database for reporting Forefront EndPoint Protection
• Management Packs for System Center Operations Manager to oversee services Forefront EndPoint Protection

[Zeverto]

The business recovery plan should take into account the prior backup components such as System Center Configuration Manager 2007 . This is ensured by a maintenance task that backs up both the database but also all the necessary configuration files. As part of Forefront EndPoint Protection, this task backup strategies, settings made in SCCM and publications. You must also save the database reporting Forefront EndPoint Protection using SQL Server backup solution. Microsoft then suggests two restorative procedures. The first relates to site restoration System Center Configuration Manager when he suffered a "Crash", it is then necessary to replace it. You have to chain the following steps:

1. Restore System Center Configuration Manager
2. Restore the database if necessary Reporting
3. EndPoint Protection Forefront install using the option "reuse existing database"