Thursday, April 17, 2014

Windows XP Endpoint Protection April 16 2014 Definition update issue

I came in to work today to a plethora of phone calls from people saying that their computers had crashed. After digging a bit into the issue I noticed the only machines that were affected were Windows XP machines. I noticed that the MsMPEng.exe process had crashed on startup and would keep throwing errors. 
I traced this down to System Center Endpoint Protection and did some digging. I found this link:
http://msmvps.com/blogs/kenlin/archive/2014/04/16/winxp-and-or-win2003-with-sc-forefront-endpoint-protection-installed-msmpeng-exe-crashes-after-definition-update.aspx
This shows that the latest Endpoint definition update causes an error that crashes the scanning engine of Endpoint. I disabled the update so further machines wouldn't be affected.  I made the suggested changes that the above article recommended, but on some machines the damage had already been done.
My remedy for the affected machines was to uninstall SCEP, reboot the machine, and reinstall.  Since there is a cached version of SCEP stored on each computer that has the CCM client installed, you can access the installer easily. The path is c:\windows\ccmsetup\scepinstall.exe
Now we wait on a fix from Microsoft. 

1 comment:

  1. Thanks for sharing this great and knowledgeable blog. We are also working with widow migration services.
    windows 8 to 10 migration
    windows 10 packaging

    ReplyDelete