Defender

There is an update available for Forefront Client Security that could, potentially, result in less help desk phone calls for existing and future deployments. You will want to look into KB 940060.

Why less support calls? Mainly due to a change in "end-user notification when allowing an application that is blocked by default" and the fact that the FCS icon will no longer turn red for the user when the program has been marked by the Administrator to be "ignored".

Real world example: Numerous places use VNC everyday to administer pre-XP machines. VNC by default, the last I checked, gets marked as a suspicious program by FCS and Windows Defender. Most IT admins that are using VNC do not want their FCS icon to be red all the time, even though they have specifically set VNC to 'ignore'.

In a nutshell, this update fixes that issue plus a few others!

You can read more in-depth analysis about the update from the FCS guys here and read the actual KB article here.

Thankfully, the list of hotfixes is currently very small, but it may increase as time goes on. It is a good idea to bookmark this KB article for any future FCS deployments.

I always keep the recommended Windows 2003 SP1/SP2 cluster hotfix list bookmarked for any cluster deployments I do. It is just a good practice to follow. I like being over informed than under informed.

In the crazy days of June 2007, I took this exam while it was in beta. I like taking exams early to give me an edge and as a personal challenge.

In my never ending quest to find out if I actually passed 70-238 (the last Exchange 2007 exam), I found out by accident that I had passed 70-557, the Forefront Client and Server certification exam.

I am not sure if 70-557 is live yet, but I suspect it will be shortly if the results are posting. I still have no idea if I passed 70-238 or not. I'm getting pretty ticked off at Prometric about this.

Good to see Beta 2 retired and the final version (for now) released.
Download it here.

I mentioned previously that the new Beta 2 build allowed you to turn on the system tray icon again, but left out the details of where. It is under Tools under Options. I've also included a quick screenshot. I would have before but I was stretched for time then. I'm not doing much better today but I figured I would post this since I am working with Defender at the moment.

Windows Defender has been updated with a tweaked UI (again) and marks the return of the system tray icon if you want it there all the time. Believe it or not, this was a hot topic in some circles.

http://blogs.technet.com/antimalware/archive/2006/04/13/425175.aspx

Someone on the Anti-spyware team still posts on Something Awful from time to time as 'Microsoft Spy', thankfully, that usually gives us a heads-up when a new build is coming.

I tried to do a brute force install of the Novell client tools for XP in my Vista VM box to see if it would work without too much hassle. The setup program balked so I did the usual "Install client thru Network connections" trick. That worked for the most part until Defender kicked in and started flagging kernel drivers as potential malware and other funnies.

If anything, I found it amusing. EU attorneys would most likely have a field day with that one over anti-trust issues, even though it is completely unintentional.

A good chunk of the engine runs as a service now tool, which is good news for people forced to run it on Terminal Servers. Previous versions used to spawn 3 processes per user per login. That type of overhead adds up really quick. I'm also happy that Microsoft Spy, who works on the Windows Defender team, is back on Something Awful forums, giving updates and help as much as he can.

Download URL:
http://www.microsoft.com/downloads/details.aspx?FamilyID=435bfce7-da2b-4a6a-afa4-f7f14e605a0d&displaylang=en

aka

http://tinyurl.com/c9p2f

I'm hoping it keeps the same cool old school sound effects from Williams. Oh wait, wrong Defender. I'm still waiting for Windows Robotron:2084.

Actually, I loved the original Robotron to death. I almost bought a standup version of it a few years ago.

But, back on topic, one of the good things they are working on for the definition updates, is to use the same BITS technology that is used in Windows Update. I think that's a really good idea. I've seen so many various versions of 're-inventing the wheel' on various parts of Windows that it is refreshing to see a little bit of code reuse from time to time.

I still don't agree with them marking Gator as 'acceptable' in the original MS AntiSpyware though.

MS AntiSpyware is a Terminal Server killer, since it launches 3 processes per user session. That's just a bad idea on a fully loaded server.
I'm hoping it will just be a few threads and maybe a couple standalone executables.