125 replies to this topic

[Kman]

You can use the server version (business pro) for WHS 2011. That is what I have been running since RTM and works great. It supports 2008R2 but not officially WHS although I have not had one stitch of issues with it.

But outch that's a very heavy price if I read the site correctly

Are there any good free at least not costing more then WHS2011

What I would like to find is a product that can run on ALL my pc's and then feed any alerts to my WHS2011 this why I watch WHS2011 and know if someone's PC is not updated or has some alerts things like that

a long time ago Avast has this on WHSv1 but then they changed the client version and it started giving me all types of problems and in the middle of this my superscription expried and I never renewed and moved clients to MSE....

I have noticed on my clients MSE does not always update it self properly but as long as I keep check it seems to be good

When I try and install MSE on WHS2011 I get "Microsoft Security Essentials cannot be installed on your operating system"

Edited by Kman, 10 September 2011 - 06:39 PM.

[daveyboy37]

Kman For MSE to work on WHS2011 u need to look for the beta version 2.0.375.0. It runs without any issues.

[tinkererguy]

Good news!

I got Microsoft Forefront Client Security to run (well) in Windows Home Server 2011 tonight, looking forward to hearing what you think. I put together detailed instructions here:
http://tinkertry.com/antivirus4whs2011

[tinkererguy]

I suspect most Windows Home Server v1 users who wished to find an antivirus solution have already found one by one. But note, turns out Forefront Client Security also works fine on Windows Home Server v1 as well.
http://tinkertry.com/antivirus4whs

[Kman]

this sounds good but do you think it would be better then the MSE that I now have installed?

[Commodore]

Thank you Tinkererguy for posting the instructions. It worked perfectly for me.

[tinkererguy]

Don't know yet if it's better than MSE, but for me, it's better than nothing, especially if it doesn't get in my way. So far, it doesn't seem to slow down my overnight backups, that's a good preliminary sign.

But probably only the real test of time will tell.

[Joe_Miner]

Thanks for the post! I had been going thru the TechNET literature and had found a few places that gave instructions for experimental installations (i.e. manual installation for test purposes ) as in http://technet.micro...y/ff823774.aspx -- but none of them work (for me any way). Your instructions did the thing for both V1 and 2011 --

V1 went very easy exactly per your instructions

2011 wasn't so straightforward -- I ended up downloading from the KB and forcing a definition update -- don't know yet if it will update automatically in it's own yet.

Running both in clones of my test set-up in Virtual Box to see what happens -- could be interesting.

I've seen where other's hve loaded Forefront Client by

http://www.missingre...tivirus-whs2011

which seems to be backed by

http://technet.micro...y/bb625083.aspx

[tinkererguy]

2011 wasn't so straightforward -- I ended up downloading from the KB and forcing a definition update -- don't know yet if it will update automatically in it's own yet.

David (who didn't wish to sign up for this forum) kindly emailed me today with the following info, I'm note quite sure about all of it, since my installs went well, and David used the RTM EVAL download instead of the MSDN/TechNet download I documented. Pay particularly close attention to what I bolded below. Can you try that and see if you have reliable automatic updates?

Hi, Good post. I have had some success with the forefront client on WHS and now on WHS 2011. I have used the command line method to install, very quick and easy.
In the Forefront download (the one I have from technet is labeled FCS_RTM_EVAL_en-us_1703.0.iso), drill down to the client install directory, to the folder with CLIENTSETUP.exe, (or x64/CLIENTSETUP.exe). Save those directories, the rest of the disk is unneeded.
I usually copy the directory to the root of the C:drive so it is easy to navigate to (c:\\x64).
Then I copy and paste:

clientsetup.exe /I \ "C:\Program Files\MS Forefront Client" /L "C:\Program Files\MS Forefront Client\logs" /nomom

The only problem that I have had is that it does not always auto update itself. I had found that sometimes it would and sometimes not. Going to the online manual update page would also not bring joy even after installing 20 or more manual downloads. Then sometimes it would be mysteriously updated a day or two later.

The trick turned out to be getting Windows Update to be configured to also check for other Microsoft product updates. Go to the Windows Update screen, find and click on the Change Settings link. This should give you a view of option of what and when to downlaod Updates. Make sure that the Microsoft Update checkbox is selected. Thats it. You should get any and all needed updates for the Forefront Client the next time you have it Check for Updates.

I went the the Home Server site to share this, but I apparently need a Twitter account to post. Too complicated for me. Let me know if this helps. If it does please feel free to share it with the world. It was devilishly hard for me to discover this, and I would have loved to find a clean, simple post like the kind you make. Thanks,
David

If there's good info in this email, I'll go ahead and add it to my instructions, of course. But getting the forum reader's feedback is key.

[Joe_Miner]

David (who didn't wish to sign up for this forum) kindly emailed me today with the following info, I'm note quite sure about all of it, since my installs went well, and David used the RTM EVAL download instead of the MSDN/TechNet download I documented. Pay particularly close attention to what I bolded below. Can you try that and see if you have reliable automatic updates?

Hi, Good post. I have had some success with the forefront client on WHS and now on WHS 2011. I have used the command line method to install, very quick and easy.
In the Forefront download (the one I have from technet is labeled FCS_RTM_EVAL_en-us_1703.0.iso), drill down to the client install directory, to the folder with CLIENTSETUP.exe, (or x64/CLIENTSETUP.exe). Save those directories, the rest of the disk is unneeded.
I usually copy the directory to the root of the C:drive so it is easy to navigate to (c:\\x64).
Then I copy and paste:

clientsetup.exe /I \ "C:\Program Files\MS Forefront Client" /L "C:\Program Files\MS Forefront Client\logs" /nomom

The only problem that I have had is that it does not always auto update itself. I had found that sometimes it would and sometimes not. Going to the online manual update page would also not bring joy even after installing 20 or more manual downloads. Then sometimes it would be mysteriously updated a day or two later.

The trick turned out to be getting Windows Update to be configured to also check for other Microsoft product updates. Go to the Windows Update screen, find and click on the Change Settings link. This should give you a view of option of what and when to downlaod Updates. Make sure that the Microsoft Update checkbox is selected. Thats it. You should get any and all needed updates for the Forefront Client the next time you have it Check for Updates.

I went the the Home Server site to share this, but I apparently need a Twitter account to post. Too complicated for me. Let me know if this helps. If it does please feel free to share it with the world. It was devilishly hard for me to discover this, and I would have loved to find a clean, simple post like the kind you make. Thanks,
David

If there's good info in this email, I'll go ahead and add it to my instructions, of course. But getting the forum reader's feedback is key.

After posting last night I read thru some of the material I had collected -- in particular the info on TechNET.

One article in particular: http://technet.micro...y/bb625083.aspx involved installing FF on home computers. A few parts of that article are worth quoting IMHO.


=====

• Home-use installations must use Microsoft Update to download definition updates, rather than a corporate WSUS server. Consequently, the home computers must be opted into Microsoft Update manually.

Configuring your computer to use Microsoft Update

For the home computer to receive definition updates, you must configure it to use Microsoft Update. It is highly recommended you do this first, so that the Client Security agent can immediately connect to Microsoft Update and get definition updates.

The steps to do this are different for Windows Vista and Windows XP.

To configure a computer running Windows Vista to use Microsoft Update

• Click Start, point to All Programs, and click Windows Update.

• In the Windows Update window, next to You receive updates, verify that it states For Windows and other products from Microsoft Update Service.

  The presence of this statement indicates that the computer is configured to use Microsoft Update. No further steps are necessary.

• If the statement For Windows only is present, click Get updates for more products.

• In Internet Explorer, read the Terms of Use, select the I accept the Terms of Use check box, and then click Install.

• If the User Account Control dialog box appears, click Continue.

====


After again reading this [note the section highlighted and underlined] I realized I should have set WHS2011 up for Microsoft updates before I did your install. I went into Windows update and made the change which you can see below highlighted.



I believe this has fixed the issue I may have had but I plan to wait a couple days before coming to a conclusion.

As of right now FF is:



Is that the client version you're seeing in your setup?

The rest of the article in TechNET confirms "Dave's" process. I plan to test that step with another Clone later this week or weekend.

Here's the relevant section IMHO from http://technet.micro...y/bb625083.aspx

=======

Distributing the Client Security agent installation program

The Client Security agent installation program, clientsetup.exe, is located in the Client folder on the Client Security installation CD. Clientsetup.exe calls the Windows Installer files needed for the Client Security components. For this reason, when distributing the Client Security agent to home users, you must distribute both the appropriate processor platform version of clientsetup.exe and the supporting MSI installer files.

The following table lists the files you need to include for each processor platform when distributing the Client Security agent for home use.

Files needed for x86-based computers (from the Client folder)

Clientsetup.exe

Fcsssa.msi

Mp_ambits.msi

Windowsxp-kb914882-x86-LNG.exe where LNG is the language of the operating system installation

Files needed for x64-based computers (from the Client\x64 folder)

Clientsetup.exe

Fcsssa.msi

Mp_ambits.msi


Installing the Client Security agent

To install the Client Security agent in a home-use scenario, you must install it without the reporting and alerting component.

To install the Client Security agent on Windows Vista without the reporting and alerting component

• On computers running Windows Vista, click Start, point to All Programs, and then click Accessories.

• Right-click Command Prompt, and then click Run as administrator.

• In the User Account Control dialog box, click Continue.

• In the Command Prompt window, change to the location of the Client Security Client folder, type the following command, and then press ENTER:

  clientsetup.exe /NOMOM

=======




I hope you find this helpful! [Note the tables in the TechNET notes didn't copy over well so I had to fiddle with the file lists]

Edited by Joe_Miner, 03 October 2011 - 07:40 PM.

[Joe_Miner]

Update:

So far so good. WHS-2011 and WHS-V1 updated fine this morning and FF seems to be running well.

I have both set up to run quick scans every 2 hrs and to check for updates before running a scan. I am intentionally doing this to see how often it updates and what kind of performance hit I may notice -- these are both virtual machines running on top of an HTPC build with and i3-2120 -- so I'm currious if I can dog the system down.

I would suggest that before beginning the process of installing FF on a 2011 build that the user update "windows update" to include all Microsoft products as explained in the TechNET notes in my previous message.

[jmwills]

I'd be surprised if you see updates more than once in 24 hours.

[Joe_Miner]

I'd be surprised if you see updates more than once in 24 hours.

As of 7pm FF on the WHS2011 has updated the definitions on 10-04-2011 three(3) times starting with:

Definition 1.113.874.0
Definition 1.113.904.0
Definition 1.113.933.0

I then checked FF running on the WHS-V1 and found the same three(3) updates.

On both machines I have FF set to do a quick scan about every 2 hours and do a check/download any new updates/definitions

When I was checkint the microsoft/windows update log on both machines it showed 904 as an automatic update while 874 and 933 were listed as other updates so Im guessing the automatics were done by the microsoft/windows automatic update while the "other updates" were done by FF.

Is that how you would read it?

[jmwills]

Yes, those would be three updates, but once the database gets stabilized once a day should be the norm.

[tinkererguy]

I've now incorporated the new Windows Update related information that is key to getting Microsoft Forefront Client Security not just installed, but also regularly updated (thank you David and Joe_Miner!). I'll remind you this is not the latest version called "Microsoft Forefront Client Security 2010," since that version won't install.

I've also created an entirely new and now accurate video of the Forefront install on WHS2011 process. All early indicators I've looked at so far seem to be good.

Most of my blog updates were done with WHS2011, as working on the v1 version (and a whole new set of screenshots) is not a priority at the moment.

See blog entries and videos here:
http://tinkertry.com/antivirus4whs2011
http://tinkertry.com/antivirus4whs

[HSS-Dave]

If you are reading this thread you will certainly want to listen to podcast 155 where we discuss ForeFront and anti-virus for WHS 2011 and v1.

[Joe_Miner]

Tinkererguy:

I just wanted to confirm that David's method to load Forefront client (FF) works.

I tested his approach in a different VM (Enterprise) of WHS-2011 using his approach which is also outlined in TechNET notes at http://technet.micro...y/bb625083.aspx part of which I copy below (but the whole article is well worth reading IMHO...)

===

To install the Client Security agent on Windows Vista without the reporting and alerting component

• 
  
  On computers running Windows Vista, click Start, point to All Programs, and then click Accessories.
• 
  
  Right-click Command Prompt, and then click Run as administrator.
• 
  
  In the User Account Control dialog box, click Continue.
• 
  
  In the Command Prompt window, change to the location of the Client Security Client folder, type the following command, and then press ENTER:
  clientsetup.exe /NOMOM

===

In my case -- this time the first thing I did was make sure that Windows Update was set to update all Microsoft Products like we discussed in the earlier post.

I then copied the x64 folder to my downloads folder and as you can see Clientsetup.exe /nomom executed with no problem -- absolutely no problem loading FF as you can see by the Yellow FF icon in the lower right -- note: when FF first loads it downloads the latest definitions but it needs an engine update -- that's why the icon is yellow I think --


Instead of clicking FF to let it update it's engine I clicked windows (microsoft) update and that worked


FF is running well and the FF icon is green


As a side note: My other VM (Hal) of WHS-2011 that I loaded FF on by your direct method is running strong and yesterday it updated with three more definition files yesterday (Oct 5) (1.113.966, 993, 1022) and it has already updated 1.113.1052 this morning. I currently have it set to scan every 2 hrs and check for updates before scanning -- same setup for both WHS-2011 VM's running FF -- trying to detect any performance issues. No issues so far.

Edited by Joe_Miner, 06 October 2011 - 06:27 AM.

[ikon]

Just to bring things back full circle, is it most peoples' opinion that the reason to use ForeFront is because it will install on WHS? Is anyone thinking ForeFront is better than MSE?

[Joe_Miner]

Just to bring things back full circle, is it most peoples' opinion that the reason to use ForeFront is because it will install on WHS? Is anyone thinking ForeFront is better than MSE?

For a production build I think the answer is neither one.
The MSE version that can be run is a beta that AFAIK was never designed to work on a server and by being a beta would be expected (at least by me) to be buggy.
For testing purposed I see Forefront as the better choice because it can be loaded on to WHS and it has a history of “working on” and is “designed to” work on Servers – for protection of a test Server I’m running in a VM it’s a win-win because I get to learn more about Forefront and it enables me to try some things in the future with my test set-up that I might not have the nerve otherwise. But the only access I have to Forefront is via my TechNET account and even then I can only get it to load by loading an older (2006) version and upgrading from there.
For a production version of WHS-2011 I don’t see Forefront as a viable solution for WHS-2011 for one simple reason – you can’t load the latest version (2010) and I doubt if we’ll be able to load the 2012 version when it’s available -- Microsoft deliberately blocks installation of the 2010 version onto WHS-2011 – when trying to load the 2010 FF it links you to a page that lists the platforms that FF2010 will run on which is everything but WHS
http://technet.micro...y/ff823900.aspx
===

• Windows 7 (x86 or x64)
• Windows 7 XP mode
• Windows Vista (x86 or x64) or later versions
• Windows XP Service Pack 2 (x86 or x64) or later versions
• Windows Server 2008 R2 (x64) or later versions
• Windows Server 2008 R2 Server Core (x64)
• Windows Server 2008 (x86 or x64) or later versions
• Windows Server 2003 Service Pack 2 (x86 or x64) or later versions
• Windows Server 2003 R2 (x86 or x64) or later versions

===
Forefront supports even Windows 7 XP mode – because that’s used by businesses for legacy programs SO Forefront is only targeted to the business market -- for a WHS-2011 we’re out of luck (unless Microsoft has a change of heart with Forefront 2012)

Part of the problem I see for WHS-V1 and WHS-2011 may be that AV vendors (speculation alert) aren’t allowed (by licensing(?)) to install directly onto the machine but instead must be installable via the connector – at least that appears to be part of the reason McAfee is getting out of the WHS-V1 market and doesn’t seem too anxious to jump into the WHS-2011 market. https://kc.mcafee.co...tent&id=KB61113

[tinkererguy]

Joe_Miner, your assessment of the situation is greatly appreciated, I so appreciate your stepping in (while I was away for a day), and putting up so much great info!

You found the perfect document at http://technet.micro...y/bb625083.aspx, it sure would have saved me some trouble figuring out the install (I get impatient), but now it's here, and this is great!

I haven't decided if I should re-do all my screenshots and video, just for this change in launch method, it's all so time consuming (yours is the legit way that Microsoft intended, mine is the lazy way with no commands to memorize). It sure looks like the end result is exactly the same (both ways kick of the MSI). I've now added addendum/notes to my posts.

More important, I'm also working to try to get more info on what is going on with the future of antivirus solutions at Microsoft, since we don't all want to be wasting our time learning something if it doesn't have much life left and/or is unsupported.

Just a footnote: having been a user of some competitor's antivirus products for about a decade, I never really saw much difference between server products and client products, perhaps Microsoft stuff is similar. I'm not talking about virus signature distribution and/or AV intall mechanisms (those are server components), I'm just talking about the client install that goes with those deployment features. Generally, client looks just like a client whether installed on a server OS or a client OS, with daily quick scans, etc. So, as long as the vendor doesn't actually prevent the client product from installing on a server OS, and the signatures are updated regularly, I'm not very that worried about using Forefront Client Security for now (instead of nothing), since it at least seems to be stable and frequently install, and works an awful lot like MSE from a usability perspective.