Attack Computer Wiz

System Center Endpoint Protection (SPEC) may not install via SCCM policy if a conflicting application exists and cannot be uninstalled. This is commonly associated with an existing Antivirus application.

In order to find what the conflict is;

1. Open regedit 
2. Navigate to \HKLM\SOFTWARE\Microsoft\CCM\EPAgent 
3. Look at “StateEventMessage” where you will find a message similar to the below:

System Center Endpoint Protection installation error. The System Center Endpoint Protection Setup wizard was unable to remove one or more programs that conflict with System Center Endpoint Protection. To install System Center Endpoint Protection you must manually uninstall the following programs and then run the wizard again. Error code:0x80041108. Programs: Trend Micro OfficeScan Client

In this example, the Trend Micro OfficeScan Client was installed and for whatever reason, SCEP could not remove it. At this point you will need to manually remove the conflicting application and re-initiate a policy refresh to the SCCM server.

Navigate to Control Panel, open the Configuration Manager client, clicked on the Actions tab, and force each action to run.

After a while the new SCEP icon will appears as expected.

Posted by Mike Wright

Posted by Mike Wright

Here is the registration link: https://ae.rsaconference.com/US14/portal/newreg.ww

Use one of the codes below to get your free Expo only pass. Be sure to visit the vendor whose code you used.

I will be updating them as I get them.

Duo Security - Booth #2518 - EC4DURY
F5 Networks - Booth #1801 - EC4F5NET
Proofpoint - Booth #1527 #520 and #3615 - SC4PROOFB or EC4PROOFE
APCOM - Booth # 632 - EC4APCON
OPSWAT - Booth #2531 - EC4PSWT

Posted by Mike Wright

While trying to demote an existing Windows Server 2008 R2 Domain Controllers I ran into quite the headache. After running "dcpromo" and following the first few steps of the demotion it seems to start and run just fine. But within a few seconds I was promoted for credentials with the below "access is denied" message.

I searched and searched but was not able to find a good solution so finally I gave up and ran "dcpromo /forceremoval". I then did the metadata cleanup and moved on. I then tried to remove the old DC computer object from the Domain Controllers OU and I was denied access again. I scratched my head and realized that the object was protected. Could this whole problem be that simple!? The answer is YES, it was that simple.

On my next DC demotion I re-created the same errors. I cancelled the dcpromo, went into ADUC and unchecked the "Protect object from accidental deletion" box, ran dcpromo and and everything went smooth without error!


  

Posted by Mike Wright

Here is the registration link: https://ae.rsaconference.com/US13/portal/login.ww

Use one of the codes below to get your free Expo only pass. Be sure to visit the vendor whose code you used.

AhnLab - FXE13AHN
APCON - FXE13APC
OneLogin - FXE13LOGIN
Proofpoint - FXE13PRF
Symantec - FXE13SYM

Posted by Mike Wright