Security (MS)

FCS uses the MOM infrastructure for event and alert gathering. The version of MOM 2005 included with Forefront Client Security is stripped down and customized quite a bit during the installation of the collection server role. This is part of the reason why you cannot use your existing MOM 2005 infrastructure for FCS v1.

A few important notes:
1. If you have an existing MOM infrastructure, you cannot use it for FCS. Your existing MOM infrastructure and FCS's use of MOM are completely separate.

2. If you do have MOM, you cannot share the One Point (Operations DB) or SystemCenterReporting (Data warehouse DB) with FCS. The two pairs of DB's must always remain separate!

3. If you have an existing MOM infrastructure, you can still monitor those machines using FCS (MOM supports multi-homing the agents).

It may be easier to not think about MOM as a separate prerequisite (like SQL), as the FCS setup handles all the MOM configuration details. If you already have MOM, just remember that you can't use it for FCS and if you don't have MOM, you don't have to worry about installing it, as the setup handles that for you.

Originally gleamed from here, with some of my own notes added.

Sometimes I forgot what roles does what with FCS v1, especially if I haven't touched it for a few weeks. Based on a post in the Forefront forums here, I've developed this little cheat sheet.

Management role
This hosts the MOM, FCS consoles and signature service. Populates the console drop downs with the latest malware threats.

Collection role
This hosts the customized/specialized MOM 2005 installation and is the collection point for data coming up from machines and for sending tasks to machines.

Collection DB role
This hosts the OnePoint database used by the MOM service.

Reporting role
This hosts the SQL Reporting Services/MOM reporting and generates all the FCS reports.

Reporting DB role
This hosts the SystemCenterReporting database. Used by MOM reporting and stores all the long-term data.

Distribution role
Hosts WSUS and is used to distribute signatures and the FCS client package. For small installations, Windows Update can be used instead for updates.

Two worldwide FCS promotions in Open & Select:
25% off FCS Subscriptions
35% off FCS Subscriptions for SMS/SCCM Customers

Your LAR (Large Account Reseller - someone like CDW) will have information on the promotion including part numbers. The promotion ends July 31st, 2008.

Full details can be found in the Promotion Data Sheet.

Originally spotted here.

If you are going to this event, and see a guy that looks like the picture in the upper right hand corner of my website, say Hi.

I'm excited to be going because it will be the first demo of Forefront codename Stirling, plus I can pick the brains of the Microsoft folks.

It looks like some people inside MS are talking about it here too.