2

EP 4.2.223.1 is installed, version is higher than expected installer version 4.1.522.0

Has anyone see that in the EndpointProtectionAgent.log on a system they have been trying to push the SCCM client to before? We have a number of servers that haven't reported back to SCCM that their Endpoint Protection is being managed. Looking at the log noted above has that error.

A snipped from the log:

 <![LOG[Service startup notification received]LOG]!><time="16:43:43.819+240" date="06-26-2013" component="EndpointProtectionAgent" context="" type="1" thread="3924" file="fepsettingendpoint.cpp:291">
<![LOG[Endpoint is triggered by CCMTask Execute.]LOG]!><time="16:43:43.819+240" date="06-26-2013" component="EndpointProtectionAgent" context="" type="1" thread="2804" file="fepsettingendpoint.cpp:265">
<![LOG[Deployment WMI is NOT ready.]LOG]!><time="16:43:43.835+240" date="06-26-2013" component="EndpointProtectionAgent" context="" type="1" thread="2804" file="epagentimpl.cpp:725">
<![LOG[Endpoint is triggered by WMI notification.]LOG]!><time="16:43:59.482+240" date="06-26-2013" component="EndpointProtectionAgent" context="" type="1" thread="3556" file="fepsettingendpoint.cpp:154">
<![LOG[Failed to get EP event code under registry key SOFTWARE\Microsoft\CCM\EPAgent]LOG]!><time="16:43:59.498+240" date="06-26-2013" component="EndpointProtectionAgent" context="" type="2" thread="3556" file="epagentimpl.cpp:1334">
<![LOG[Failed to get EP event message under registry key SOFTWARE\Microsoft\CCM\EPAgent]LOG]!><time="16:43:59.498+240" date="06-26-2013" component="EndpointProtectionAgent" context="" type="2" thread="3556" file="epagentimpl.cpp:1339">
<![LOG[EP State and Error Code didn't get changed, skip resend state message.]LOG]!><time="16:43:59.498+240" date="06-26-2013" component="EndpointProtectionAgent" context="" type="1" thread="3556" file="epagentimpl.cpp:153">
<![LOG[Failed to get EP event code under registry key SOFTWARE\Microsoft\CCM\EPAgent]LOG]!><time="16:43:59.498+240" date="06-26-2013" component="EndpointProtectionAgent" context="" type="2" thread="3556" file="epagentimpl.cpp:1334">
<![LOG[Failed to get EP event message under registry key SOFTWARE\Microsoft\CCM\EPAgent]LOG]!><time="16:43:59.498+240" date="06-26-2013" component="EndpointProtectionAgent" context="" type="2" thread="3556" file="epagentimpl.cpp:1339">
<![LOG[State 1, error code 0 and detail message are not changed, skip updating registry value]LOG]!><time="16:43:59.498+240" date="06-26-2013" component="EndpointProtectionAgent" context="" type="1" thread="3556" file="epagentimpl.cpp:205">
<![LOG[File C:\Windows\ccmsetup\SCEPInstall.exe version is 4.1.522.0.]LOG]!><time="16:43:59.498+240" date="06-26-2013" component="EndpointProtectionAgent" context="" type="1" thread="3556" file="epagentutil.cpp:519">
<![LOG[EP version 4.2.223.1 is already installed.]LOG]!><time="16:43:59.498+240" date="06-26-2013" component="EndpointProtectionAgent" context="" type="1" thread="3556" file="epagentutil.cpp:232">
<![LOG[EP 4.2.223.1 is installed, version is higher than expected installer version 4.1.522.0.]LOG]!><time="16:43:59.498+240" date="06-26-2013" component="EndpointProtectionAgent" context="" type="1" thread="3556" file="epagentutil.cpp:265">

A few of these systems were previously manged under a dev SCCM 2012 SP1 install, and some under FEP 2010. Now we are deploying from a new SCCM site that we have setup to these servers. Does this indicate that we need to update the EP install that we are pushing out?

Chadddada
  • 1,670
  • 1
  • 19
  • 26
  • Any SCCM 2012 SP1 users out there? – Chadddada Jul 08 '13 at 17:02
  • We're not using Endpoint Protection however I've had all kinds of weird issues when some systems were managed under a testing implementation of SCCM and then rolled into a new implementation. Let me think about this one, maybe I can generate some leads for you... –  Jul 13 '13 at 20:47
  • Found the issue. We broke the Endpoint management out from the default client settings. Even though the new endpoint client settings were applied to that collection, and of course had a higher pri than the default, the settings were not taking affect. Might be a bug... we have contacted MS about it. – Chadddada Jul 24 '13 at 14:42

1 Answers1

2

Buggy acting client settings. Pulling back the client settings and redeploying them seemed to fix it. We also deployed directly to a sub collection, vs just to a base, and it worked.

Chadddada
  • 1,670
  • 1
  • 19
  • 26