Managing Forefront Endpoint Protection (FEP) with Microsoft Group Policy (GPO)

KB ID 0000604


FEP is Microsoft’s offering for antivirus, try to think of it as the corporate version of Security Essentials. Just about everything on the net for managing it seems to be geared to managing it with SCCM. Which is fine if you have SCCM, but what if you don’t? Thankfully you can manage it with group policy, even if information on how to do it is rarer than hens teeth!

With a Microsoft CoreCAL you can use the FEP client, so if you already have CoreCALs, then it’s a solution that can save you some cash on your corporate AV strategy.


Installing Forefront Endpoint Protection

Forefront Endpoint Protection

The client software is available in x64 and x86 bit flavours, it is installed from a single executable (FEPInstall.exe). There is no MSI installer (yeah thanks Microsoft!) So if you want to roll it out on mass, you need to either install it using a startup script, include the software in your ‘Master/Golden Image’ and re-image you machines, or tear your hair out trying to work out SCCM.

Managing Forefront Endpoint Protection with Group Policy

1. First you need to download the policy definitions, copy the FEP2010.admx file to %Systemroot%PolicyDefinitions.

Forefront Endpoint Protection ADMX File

2. Then copy the FEP2010.adml file to %Systemroot%PolicyDefinitionsEN-US

Forefront Endpoint Protection ADML File

Creating a Group Policy Central Store

3. If you have all your ADMX policy definitions in a central location, all your clients can use them. The correct place for them is in the sysvol directory, in a folder called policies (this is where your clients read their group policies from). To create the directory issue the following command;

MD “%logonserver%sysvol%userdnsdomain%policiesPolicyDefinitions”

ADMX PolicyDefinitions Folder

4. Now copy all your policy files into it, (from the folder we used earlier) with the following command;

xcopy %systemroot%policydefinitions*.* “%logonserver%sysvol%userdnsdomain%policiesPolicyDefinitions” /S /Y

Create Domain Policy Share

5. Then either create a new policy, or edit an existing one that’s linked to the COMPUTER objects you want to manage.

Forefront Group Policy

6. Navigate to;

Computer Configuration > Policies > Administrative Templates > System > Forefront Endpoint Protection 2010

Here you will find the policy settings you require.

GPO Forefront Endpoint

7. When you are controlling settings via GPO this is what you will see on the client machines.

FEP Policy

Importing and Exporting Forefront Policy Settings

8. From the files you extracted earlier locate and run the FEP2010GPTool.exe. From here you can import and export all the policy settings from a particular group policy. Microsoft have published a set of policy settings which you can download for various server roles.

Note: By default each policy you import will merge with the existing settings in the GPO, unless you tick the “clear the existing Forefront Endpoint Protection settings before import” option.

Import and Export FEP Settings

Updates for Forefront Endpoint Protection

9. Windows uses it’s existing ‘Windows updates’ path for getting updates. If you have a WSUS server you will need to enable the updates in the ‘Products and Classifications’ section.

WSUS and FEP Updates

10. If you DONT have WSUS but you are behind a proxy, you can manage FEP proxy settings from the following policy.

FEP Proxy Settings

Related Articles, References, Credits, or External Links


Author: Migrated

Share This Post On