Re: [mssms] Endpoint Protection (SCEP) for servers

[Marcum, John]

I stopped using SCEP a while back after a virus. I found the support from MS to 
be less than stellar to say the least. I really think any definition based AV 
is nearly useless these days however I am still using one but I'm looking at 
other options too.

Typos compliments of Siri
Sent from my iOS device

On Jan 16, 2017, at 8:59 AM, Adam Juelich 
> wrote:

[External Email]

Makes sense, although there were a few people here using it for Servers.  I 
think it also depends on your Firewall, Content Filter, and also Windows 
Firewall and UAC.  Local Admins does pose a problem as well.  Really depends 
how else you're hardening your clients and servers...

On Mon, Jan 16, 2017 at 7:07 AM, Thelen, Chris 
> wrote:
We were using SCEP/FEP for our clients and ESET for our servers for about 4 
years with about 3k clients.

We had more infections in 4 years than we did in 10 years with other AV 
software.  In 2015 we had over 800 infections with 300 of those SCEP could not 
remove or clean.  A good portion of these infections we found due to the 
infection attempting to move to our file servers where ESET was catching, 
blocking, and reporting it.  Last year we switched to another AV product and 
have only had 1 infection that it was not able to remove.

But, also on the other hand, all of our users are…./shudders…local admins which 
does have a big impact on infections.  We are working on changing that, but we 
still have about 2k users that are still local admins that have not had any 
infections with the new AV software.

So, everyone here is still a big supporter of separate AV software for clients 
and servers, and am sure you can see why :)


From: listsad...@lists.myitforum.com 
[mailto:listsad...@lists.myitforum.com] 
On Behalf Of Adam Juelich
Sent: Friday, January 13, 2017 9:08 AM
To: mssms@lists.myitforum.com
Subject: [mssms] Endpoint Protection (SCEP) for servers

Hello Everyone,

I've used SCEP in the past on client machines and it worked great - no 
complaints.  This is after moving them off of Sophos.  At that time we didn't 
move it to Servers as our Network Admin wasn't confident in it.

Just curious if others are using SCEP for servers?  Thoughts, concerns?  Any 
gotchas?

Thanks!









Confidentiality Notice: This e-mail is from a law firm and may be protected by 
the attorney-client or work product privileges. If you have received this 
message in error, please notify the sender by replying to this e-mail and then 
delete it from your computer.

Re: [mssms] Endpoint Protection (SCEP) for servers

[Adam Juelich]

Makes sense, although there were a few people here using it for Servers.  I
think it also depends on your Firewall, Content Filter, and also Windows
Firewall and UAC.  Local Admins does pose a problem as well.  Really
depends how else you're hardening your clients and servers...

On Mon, Jan 16, 2017 at 7:07 AM, Thelen, Chris 
wrote:

> We were using SCEP/FEP for our clients and ESET for our servers for about
> 4 years with about 3k clients.
>
>
>
> We had more infections in 4 years than we did in 10 years with other AV
> software.  In 2015 we had over 800 infections with 300 of those SCEP could
> not remove or clean.  A good portion of these infections we found due to
> the infection attempting to move to our file servers where ESET was
> catching, blocking, and reporting it.  Last year we switched to another AV
> product and have only had 1 infection that it was not able to remove.
>
>
>
> But, also on the other hand, all of our users are…./shudders…local admins
> which does have a big impact on infections.  We are working on changing
> that, but we still have about 2k users that are still local admins that
> have not had any infections with the new AV software.
>
>
>
> So, everyone here is still a big supporter of separate AV software for
> clients and servers, and am sure you can see why J
>
>
>
>
>
> *From:* listsad...@lists.myitforum.com [mailto:listsadmin@lists.
> myitforum.com] *On Behalf Of *Adam Juelich
> *Sent:* Friday, January 13, 2017 9:08 AM
> *To:* mssms@lists.myitforum.com
> *Subject:* [mssms] Endpoint Protection (SCEP) for servers
>
>
>
> Hello Everyone,
>
>
>
> I've used SCEP in the past on client machines and it worked great - no
> complaints.  This is after moving them off of Sophos.  At that time we
> didn't move it to Servers as our Network Admin wasn't confident in it.
>
>
>
> Just curious if others are using SCEP for servers?  Thoughts, concerns?
> Any gotchas?
>
>
>
> Thanks!
>
>
>
>

RE: [mssms] Endpoint Protection (SCEP) for servers

[Thelen, Chris]

We were using SCEP/FEP for our clients and ESET for our servers for about 4 
years with about 3k clients.

We had more infections in 4 years than we did in 10 years with other AV 
software.  In 2015 we had over 800 infections with 300 of those SCEP could not 
remove or clean.  A good portion of these infections we found due to the 
infection attempting to move to our file servers where ESET was catching, 
blocking, and reporting it.  Last year we switched to another AV product and 
have only had 1 infection that it was not able to remove.

But, also on the other hand, all of our users are…./shudders…local admins which 
does have a big impact on infections.  We are working on changing that, but we 
still have about 2k users that are still local admins that have not had any 
infections with the new AV software.

So, everyone here is still a big supporter of separate AV software for clients 
and servers, and am sure you can see why ☺


From: listsad...@lists.myitforum.com [mailto:listsad...@lists.myitforum.com] On 
Behalf Of Adam Juelich
Sent: Friday, January 13, 2017 9:08 AM
To: mssms@lists.myitforum.com
Subject: [mssms] Endpoint Protection (SCEP) for servers

Hello Everyone,

I've used SCEP in the past on client machines and it worked great - no 
complaints.  This is after moving them off of Sophos.  At that time we didn't 
move it to Servers as our Network Admin wasn't confident in it.

Just curious if others are using SCEP for servers?  Thoughts, concerns?  Any 
gotchas?

Thanks!

Re: [mssms] Endpoint Protection (SCEP) for servers

[Adam Juelich]

I'll mostly have to leverage the Server Policy, SQL, ConfigMgr, and Domain
Controllers.  I'll possibly have to look at the WSUS policy and combine
with the ConfigMgr policy unless it assumed WSUS/SUP installed.

I'm one of the 'jack-of-all-trades' guys so I probably wouldn't hear much
complaining.  To be honest, I don't think anyone has looked at the Sophos
Server properties in years due to the fact that we were running a 4-year
old version that was out-of-support.  SMH.

Thanks everyone for your feedback!  We already pay for this and it has the
potential to save us $28K a year.

On Fri, Jan 13, 2017 at 11:05 AM, Stuart Watret 
wrote:

> Make judicious use of role based collections and make sure your av
> exceptions are advertised correctly to these collections; otherwise the
> “Urrrg, av on servers gang” will be on your back like a limpet.
>
> Oh and plan your scans carefully.
>
> > On 13 Jan 2017, at 14:08, Adam Juelich  wrote:
> >
> > Hello Everyone,
> >
> > I've used SCEP in the past on client machines and it worked great - no
> complaints.  This is after moving them off of Sophos.  At that time we
> didn't move it to Servers as our Network Admin wasn't confident in it.
> >
> > Just curious if others are using SCEP for servers?  Thoughts, concerns?
> Any gotchas?
> >
> > Thanks!
> >
>
>
>

Re: [mssms] Endpoint Protection (SCEP) for servers

[Stuart Watret]

Make judicious use of role based collections and make sure your av exceptions 
are advertised correctly to these collections; otherwise the “Urrrg, av on 
servers gang” will be on your back like a limpet.

Oh and plan your scans carefully.

> On 13 Jan 2017, at 14:08, Adam Juelich  wrote:
> 
> Hello Everyone,
> 
> I've used SCEP in the past on client machines and it worked great - no 
> complaints.  This is after moving them off of Sophos.  At that time we didn't 
> move it to Servers as our Network Admin wasn't confident in it.
> 
> Just curious if others are using SCEP for servers?  Thoughts, concerns?  Any 
> gotchas?
> 
> Thanks!
> 

Re: [mssms] Endpoint Protection (SCEP) for servers

[the codepoets]

Hi Adam,
  We use SCEP here as well. I've used many of these templates to get policy
stood up quickly:
https://gallery.technet.microsoft.com/System-Center-Endpoint-65917b04

-Erik

On Fri, Jan 13, 2017 at 1:04 PM, Adam Juelich <acjuel...@gmail.com> wrote:

> Thanks, everyone!
>
> Did you have to heavily modify the default Server/DC/ConfigMgr Templates?
>
> On Fri, Jan 13, 2017 at 2:54 PM, Timothy Ransom <
> timothy.ran...@gdol.ga.gov> wrote:
>
>> We have SCEP on 350 servers and have had no issues.
>>
>>
>>
>> *From:* listsad...@lists.myitforum.com [mailto:listsadmin@lists.myitf
>> orum.com] *On Behalf Of *Jimmy Martin
>> *Sent:* Friday, January 13, 2017 3:39 PM
>> *To:* mssms@lists.myitforum.com
>> *Subject:* RE: [mssms] Endpoint Protection (SCEP) for servers
>>
>>
>>
>> Yep..  have not had any issues at all.
>>
>>
>>
>> Jimmy Martin
>> (901) 227-8209
>>
>> *From:* listsad...@lists.myitforum.com [mailto:listsadmin@lists.myitf
>> orum.com <listsad...@lists.myitforum.com>] *On Behalf Of *Adam Juelich
>> *Sent:* Friday, January 13, 2017 8:08 AM
>> *To:* mssms@lists.myitforum.com
>> *Subject:* [mssms] Endpoint Protection (SCEP) for servers
>>
>>
>>
>> Hello Everyone,
>>
>>
>>
>> I've used SCEP in the past on client machines and it worked great - no
>> complaints.  This is after moving them off of Sophos.  At that time we
>> didn't move it to Servers as our Network Admin wasn't confident in it.
>>
>>
>>
>> Just curious if others are using SCEP for servers?  Thoughts, concerns?
>> Any gotchas?
>>
>>
>>
>> Thanks!
>>
>>
>>
>> This message and any files transmitted with it may contain legally
>> privileged, confidential, or proprietary information. If you are not the
>> intended recipient of this message, you are not permitted to use, copy, or
>> forward it, in whole or in part without the express consent of the sender.
>> Please notify the sender of the error by reply email, disregard the
>> foregoing messages, and delete it immediately.
>>
>>
>>
>> P *Please consider the environment before printing this email...*
>>
>>
>>
>>
>> *** GEORGIA DEPARTMENT OF LABOR ***
>>** CONFIDENTIALITY NOTICE **
>>
>> This transmission may contain confidential information protected by state
>> or federal law.
>> The information is intended only for use consistent with the state
>> business discussed in this transmission.
>> If you are not the intended recipient, you are hereby notified that any
>> disclosure, copying, distribution, or the taking of any action based on the
>> contents is strictly prohibited.
>> If you have received this transmission in error, please delete this email
>> and notify the sender immediately.
>> Your cooperation is appreciated.
>>
>>
>
>

Re: [mssms] Endpoint Protection (SCEP) for servers

[Adam Juelich]

Thanks, everyone!

Did you have to heavily modify the default Server/DC/ConfigMgr Templates?

On Fri, Jan 13, 2017 at 2:54 PM, Timothy Ransom <timothy.ran...@gdol.ga.gov>
wrote:

> We have SCEP on 350 servers and have had no issues.
>
>
>
> *From:* listsad...@lists.myitforum.com [mailto:listsadmin@lists.
> myitforum.com] *On Behalf Of *Jimmy Martin
> *Sent:* Friday, January 13, 2017 3:39 PM
> *To:* mssms@lists.myitforum.com
> *Subject:* RE: [mssms] Endpoint Protection (SCEP) for servers
>
>
>
> Yep..  have not had any issues at all.
>
>
>
> Jimmy Martin
> (901) 227-8209
>
> *From:* listsad...@lists.myitforum.com [mailto:listsadmin@lists.
> myitforum.com <listsad...@lists.myitforum.com>] *On Behalf Of *Adam
> Juelich
> *Sent:* Friday, January 13, 2017 8:08 AM
> *To:* mssms@lists.myitforum.com
> *Subject:* [mssms] Endpoint Protection (SCEP) for servers
>
>
>
> Hello Everyone,
>
>
>
> I've used SCEP in the past on client machines and it worked great - no
> complaints.  This is after moving them off of Sophos.  At that time we
> didn't move it to Servers as our Network Admin wasn't confident in it.
>
>
>
> Just curious if others are using SCEP for servers?  Thoughts, concerns?
> Any gotchas?
>
>
>
> Thanks!
>
>
>
> This message and any files transmitted with it may contain legally
> privileged, confidential, or proprietary information. If you are not the
> intended recipient of this message, you are not permitted to use, copy, or
> forward it, in whole or in part without the express consent of the sender.
> Please notify the sender of the error by reply email, disregard the
> foregoing messages, and delete it immediately.
>
>
>
> P *Please consider the environment before printing this email...*
>
>
>
>
> *** GEORGIA DEPARTMENT OF LABOR ***
>** CONFIDENTIALITY NOTICE **
>
> This transmission may contain confidential information protected by state
> or federal law.
> The information is intended only for use consistent with the state
> business discussed in this transmission.
> If you are not the intended recipient, you are hereby notified that any
> disclosure, copying, distribution, or the taking of any action based on the
> contents is strictly prohibited.
> If you have received this transmission in error, please delete this email
> and notify the sender immediately.
> Your cooperation is appreciated.
>
>

RE: [mssms] Endpoint Protection (SCEP) for servers

[Timothy Ransom]

We have SCEP on 350 servers and have had no issues.

From: listsad...@lists.myitforum.com [mailto:listsad...@lists.myitforum.com] On 
Behalf Of Jimmy Martin
Sent: Friday, January 13, 2017 3:39 PM
To: mssms@lists.myitforum.com
Subject: RE: [mssms] Endpoint Protection (SCEP) for servers

Yep..  have not had any issues at all.


Jimmy Martin
(901) 227-8209
From: listsad...@lists.myitforum.com<mailto:listsad...@lists.myitforum.com> 
[mailto:listsad...@lists.myitforum.com] On Behalf Of Adam Juelich
Sent: Friday, January 13, 2017 8:08 AM
To: mssms@lists.myitforum.com<mailto:mssms@lists.myitforum.com>
Subject: [mssms] Endpoint Protection (SCEP) for servers

Hello Everyone,

I've used SCEP in the past on client machines and it worked great - no 
complaints.  This is after moving them off of Sophos.  At that time we didn't 
move it to Servers as our Network Admin wasn't confident in it.

Just curious if others are using SCEP for servers?  Thoughts, concerns?  Any 
gotchas?

Thanks!


This message and any files transmitted with it may contain legally privileged, 
confidential, or proprietary information. If you are not the intended recipient 
of this message, you are not permitted to use, copy, or forward it, in whole or 
in part without the express consent of the sender. Please notify the sender of 
the error by reply email, disregard the foregoing messages, and delete it 
immediately.


P Please consider the environment before printing this email...


*** GEORGIA DEPARTMENT OF LABOR ***
** CONFIDENTIALITY NOTICE **

This transmission may contain confidential information protected by state or 
federal law.
The information is intended only for use consistent with the state business 
discussed in this transmission.
If you are not the intended recipient, you are hereby notified that any 
disclosure, copying, distribution, or the taking of any action based on the 
contents is strictly prohibited.
If you have received this transmission in error, please delete this email and 
notify the sender immediately.
Your cooperation is appreciated.

RE: [mssms] Endpoint Protection (SCEP) for servers

[Jimmy Martin]

Yep..  have not had any issues at all.


Jimmy Martin
(901) 227-8209
From: listsad...@lists.myitforum.com [mailto:listsad...@lists.myitforum.com] On 
Behalf Of Adam Juelich
Sent: Friday, January 13, 2017 8:08 AM
To: mssms@lists.myitforum.com
Subject: [mssms] Endpoint Protection (SCEP) for servers

Hello Everyone,

I've used SCEP in the past on client machines and it worked great - no 
complaints.  This is after moving them off of Sophos.  At that time we didn't 
move it to Servers as our Network Admin wasn't confident in it.

Just curious if others are using SCEP for servers?  Thoughts, concerns?  Any 
gotchas?

Thanks!




This message and any files transmitted with it may contain legally privileged, 
confidential, or proprietary information. If you are not the intended recipient 
of this message, you are not permitted to use, copy, or forward it, in whole or 
in part without the express consent of the sender. Please notify the sender of 
the error by reply email, disregard the foregoing messages, and delete it 
immediately.

P Please consider the environment before printing this email...