SCEP for Windows Server 2008 Standard no longer updating

Brett Duncan 111

Yes it's old and no it won't be upgraded anytime soon..
Anyways Server 2008 Standard with SCEP 4.10.209.0. Event id 20, 2003, 2001 in System Event log.

Installation Failure: Windows failed to install the following update with error 0x80070643: Security Intelligence Update for Microsoft Endpoint Protection - KB2461484 (Version 1.323.201.0). Microsoft Antimalware has encountered an error trying to update the engine. New Engine Version: 1.1.17400.5 Previous Engine Version: Engine Type: Antimalware User: ************** Error Code: 0x8007007f Error description: The specified procedure could not be found.

Microsoft Antimalware has encountered an error trying to update signatures. New Signature Version: 1.323.188.0 Previous Signature Version: Update Source: User Update Stage: Install Source Path: Signature Type: AntiSpyware Update Type: Full User: ************ Current Engine Version: 1.1.17400.5 Previous Engine Version: Error code: 0x8007007f

Detail of each of the above events ids respectively.

Software distribution folder renamed etc and SCEP uninstalled restarted and installed again same issue.

Anyone else with the same issue in the last 6 days ?

dannyb54 1 Reputation point

2020-09-08T14:36:25.823+00:00

Any lucky with this? experiencing the same issue with 2008 Standard, R2 member servers have updated fine... standard has constant failed scep update within software centre
Ben K 111 Reputation points

2020-09-15T23:03:04.563+00:00

Worked with Microsoft support and found a solution. Its posted in the answers below.
pdog123 1 Reputation point

2020-09-17T14:01:40.073+00:00

Has anyone verified this dll worked and that this is indeed a official fix?
pdog123 1 Reputation point

2020-09-17T14:02:10.54+00:00

Has anyone verified BenK-9145's dll worked and that this is indeed a official fix?
pdog123 1 Reputation point

2020-09-17T14:28:40.97+00:00

I used BenKs fix, it worked.

Accepted answer

Brett Duncan 111 Reputation points

2020-09-02T01:02:58.407+00:00

I'm assuming anyone can install the "2020-02 Extended Security Updates (ESU) Licensing Preparation Package for Windows Server 2008 for x86-based Systems (KB4538484)" update but whether the License on the server actually permits it or not.

How can I tell if the license has been extended by the customer ?
Please sign in to rate this answer.
Joy Qiao 4,891 Reputation points Microsoft Employee

2020-09-02T09:42:43.13+00:00

Hi,

Thank you for your actions and provide detailed information about what you did.
We could run command line "slmgr /dlv" as administrator to check the license type. You could also post it here and hide personal data before upload capture.

Bests,

Brett Duncan 111 Reputation points

2020-09-02T19:15:22.407+00:00

Which part of the information do you require and i will post it ?

Brett Duncan 111 Reputation points

2020-09-02T19:16:15.293+00:00

here's a small snippet from top!

22303-image.png

Joy Qiao 4,891 Reputation points Microsoft Employee

2020-09-03T08:32:16.503+00:00

Hi,

Seems like you have not brought ESU product key.
Here is the capture which have brought and activated with ESU key.

Brett Duncan 111 Reputation points

2020-09-03T19:02:54.99+00:00

Thankyou JoyQiao.

I will advise the different customers that they have not bought the Extended License.

Muhammad Zeeshan Afzal 1 Reputation point

2020-09-09T09:34:33.073+00:00

Is there any official document from Microsoft where they mentioned that SCEP updates are no longer available for Windows Server 2008? and you need to buy ESU for that? I am unable to find any. Please share if you have any.

dannyb54 1 Reputation point

2020-09-09T10:04:18.203+00:00

Struggling to find this as well

Ben K 111 Reputation points

2020-09-15T20:24:18.847+00:00

FYI, my servers do not show the ESU info on this screen either, but after working with Microsoft and applying their patch, the definitions are updating again as expected.
Sign in to comment

14 additional answers

Ben K 111 Reputation points

2020-09-08T17:11:01.063+00:00

We are seeing the same thing. 2008 NON R2. Last Definition update happened on 8/24. 8/25 they started failing with the same errors as above.
2008 R2 servers are working normally

I tried to run the ESU updates to verify and they all just say its not applicable to the servers.
Please sign in to rate this answer.
Ben K 111 Reputation points

2020-09-09T16:45:33.877+00:00

Just an update, I have opened a case with Microsoft on this and they are currently investigating. They have acknowledged there is an issue, and they tried a fix that did not solve the issue so they are back with engineering to try and come up with a new fix.

dannyb54 1 Reputation point

2020-09-10T08:12:20.843+00:00

Would you be able to keep us updated if any of the fixes work? :)

Ben K 111 Reputation points

2020-09-10T16:25:58.787+00:00

As soon as I have any update I will post here.

dannyb54 1 Reputation point

2020-09-14T08:12:51.467+00:00

thankyou :)

Paul Faulkner 1 Reputation point

2020-09-18T14:23:08.3+00:00

Hi,

I don't suppose you've had any further update from MS on this issue please? Thanks.
Sign in to comment
Wayne W 1 Reputation point

2020-09-09T14:12:23.87+00:00

Same issue, but also want to note that the updates are being downloaded repeatedly to the server, adding 220MB of data each time. Depending on how frequently you're set to check for updates (we check hourly), this can fill up the hard disk pretty quickly.

If you're suddenly seeing space issues on your 2008 (non-R2) servers, check C:\ProgramData\Microsoft\Microsoft Antimalware\Definition Updates
Please sign in to rate this answer.

0 comments No comments
Sign in to comment
Ben K 111 Reputation points

2020-09-23T18:17:53.99+00:00

OK, I got a new fix for when the first one fails.
If you can find a working server, you'll grab the files from it, and copy it over.

Working server files:
C:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\Backup

Copy all the .vdm files and the mpengine.dll file from here, and paste them to the below location on the broken server.

C:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\Updates

Wait a few minutes and the files will disappear and the definitions should update on their own. Don't manually try to do the update or it will try and update normally again and fail.

After this I now have all my systems back up to date.
Please sign in to rate this answer.
WEYTENS Nico (SPC/DCS) 1 Reputation point

2020-09-24T07:53:55.413+00:00

hi Ben, thanks for keeping us updated (no pun intended ;-))

Copying the vdm's and dll from the Backup folder of a working server (Win2008R2) to the Updates folder of our 7 remaining Win2008s doesn't seem to work. I see the files disappearing one by one, but SCEP still says its definitions are 27 days old.
The system log mentions an error for both engine and definition updates:
Error code: 0x8007007f
Error description: The specified procedure could not be found.

Any word on when MS is going to release a public fix for this? You mentioned they would, so I'm waiting a bit before logging my own support case.
As these are servers running an OS that's EOL, it's not my highest priority to get their AV up-to-date, but I can't wait for too much longer.

RichIT 1 Reputation point

2020-09-24T09:18:49.583+00:00

@WEYTENS Nico (SPC/DCS)

The way we've resolved the issue if you've removed the SCEP client is similar to Ben's by copying

Working server files:
C:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\Backup (remember to copy and check if it's 32bit or 64bit OS)

Copy to same location on non-working server: C:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\Backup

Run command prompt as admin then go to the directory of: "C:\Program Files\Microsoft Security Client" and run MpCmdRun.exe -RemoveDefinitions -Engine

This will then reset the definitions and bring your SCEP client up to date and also bring the SCCM console up to date and no longer showing at risk.

We have tested this on two of our servers with no issues.

WEYTENS Nico (SPC/DCS) 1 Reputation point

2020-09-24T11:49:25.71+00:00

Still the same behavior as mentioned earlier after I first remove the engine and definitions...
The one I tried on is x64, and the donor is Win2008R2 (so x64).

Jason Valentine 1 Reputation point

2020-09-24T13:27:56.25+00:00

Ben , first off , thank you for doing the hard work here. I have used both of your fixes on several of my affected servers and saved a lot of hassle.

Yesterday as I was going through a few more, I did note that there is a new update in the queue released on 9/15

Update for System Center Endpoint Protection 2012 Client - 4.10.209.0 (KB3209361) which seemingly resolves the issue without the manual process.

I did have to free up space on the drive by deleting some of the superfluous definition updates, but once the Windows update completed , the remaining definitions were removed.

edit - If you have modified files on a system previously but had not corrected the error , the patch will not correct it alone.
I just had an example where I ran the update , the client came up with errors and I still had to copy the backup folder from one of the working systems and then run the commands provided by RichIT

Jason

Riley Foster 1 Reputation point

2020-09-24T15:57:19.373+00:00

The above ended-up working for me:

1) Take the four .vdm from a working machine (I grabbed mine from a 2008R2 server) and mpengine.dll from the link attached in the original fix.
2) Place in "C:\ProgramData\Microsoft\Microsoft Antimalware\Definition Updates\Backup"
3) Run "C:\Program Files\Microsoft Security Client\MpCmdRun.exe" -RemoveDefinitions -Engine

This got the client into a working state with definitions from when I took them from the old machine (the 22nd). After this point I'm now able to update normally and have definitions from today.

This was on a machine which just had SCEP installed last week - so I've never been able to install any definitions until now.

Ben K 111 Reputation points

2020-09-24T16:07:56.123+00:00

You need to use files from the same OS. You're using files from an R2 OS which won't work. They run different versions.
Sign in to comment
Ben K 111 Reputation points

2020-09-24T13:53:10.063+00:00

My case with Microsoft is now closed, however they did mention that an official engine fix for this will be coming at the beginning of October. That was the only info he could give me on the official fix. So if you are still having issues, you'll either need to wait for that official published fix, or open a support case with Microsoft.

One thing to note in that backup folder of a working machine, it should have 4 vdm files, and the mpengine.dll file. Another thing you can try is to use the updated mpengine.dll from my post above if it doesn't work just so you know for sure its the correct version with the fix included just incase the working server had the older unpatched dll file.
Please sign in to rate this answer.

0 comments No comments
Sign in to comment

Share via

SCEP for Windows Server 2008 Standard no longer updating

14 additional answers