Installing a distribution server causes WSUS to synchronize with the Microsoft Update servers. WSUS stores this update information in the SQL Server database.

WSUS should be allowed to complete synchronization before you install Client Security.

This icon indicates that the Client Security agent is unable to download definition updates. However, the system does have the correct definitions.

Open the Client Security user interface and click Check for Updates Now. If this does not resolve the issue, either log off and log back on, or right-click the exclamation-point icon and choose exit, and then restart the Client Security program from the Start menu. This will launch the notification icon again.

Error 10002 occurs due to the installation of Client Security not being fully configured.

Run the Configuration wizard by launching the Client Security console for the first time.

This issue may occur on topologies with remote MOM reporting servers.

To resolve this problem, you must explicitly grant network service write permissions to the .NET Framework folder on the remote MOM reporting server.

To grant write permissions to the .NET Framework folder

1. Open the following folder:C:\Windows\Microsoft.Net\Framework\ v2.0.50727\Temporary ASP.NET Files

2. Right-click the folder and click Sharing and Security.

3. Click the Security tab and click Add.

4. In the Enter the object names to select box, type Network Service, and then click OK.

5. Under Allow, ensure that the Read & Execute, List Folder Contents, and Read check boxes are selected.

6. Under Allow, select the Write check box, and then click OK.

7. In the warning message that appears, click Yes.

This error occurs if the account that the SQL Server agent runs as on the server with the Reporting database does not have permissions to the collection database on the other server. This most frequently happens if the SQL Server agent is running as Local System.

It is recommended that the SQL Server Agent service account be a domain user account. If you are using an existing SQL Server computer for Client Security, you may not have the SQL Server Agent service using a domain user account.

For Client Security to work correctly, you must give permissions for the account under which the SQL Server Agent service runs on the reporting database to the collection database on the management, collection, and reporting servers. By doing so, you will enable the Client Security DTS account to access the collection database.

To grant permissions, do the following: on the management, collection, and reporting servers, add the domain user account that the SQL Server Agent service for the reporting database runs under to the SQLServer2005MSSQLUser $computername$ MSSQLSERVER group.

For more information about the recommended accounts for Client Security, see Installing and deploying Client Security (http://go.microsoft.com/fwlink/?LinkID=86650).

To view client computers, expand Administration, expand Computers, and then click Pending Actions.

Verify that the management server meets all of the following conditions:

• If there is a firewall installed on the computer, ensure UDP/TCP port 1270 is open.
  
• The computer’s security policy allows "Access this computer from the network" permissions to either Everyone (in the case of clients that are not members of the domain) or Authenticated Users (for domain members).
  

For more information, see Knowledge Base article 823659 (http://go.microsoft.com/fwlink/?LinkId=86293).

If you see event ID 26017 in the Application log of Event Viewer, see "Agents are rejected with event ID 26017" in MOM issues.

The "NETWORK SERVICE" account does not have Activate permissions in DCOM.

To resolve 10016 errors

1. In Administrative Tools, open Component Services.

2. In the tree, expand Component Services, expand Computers, expand My Computer, click DCOM Config.

3. In the right pane, right-click the COM application labeled netman, and then click Properties.

4. Click the Security tab, click Edit under Launch and Activation Permissions, and then in the Launch Permissions box, click Add.

5. In the Select Users, Computers or Groups box, type network service and click OK.

6. Under Permissions for NETWORK SERVICE, select the Allow check box for Remote Launch, Local Activation, and Remote Activation. Click OK to close the remaining dialog boxes.