Windows Server Certification Information
Applies To: Forefront Endpoint Protection
There are technical requirements that a server application and its client software must meet in order to be listed as Certified for Windows Server 2008. This topic contains information relating to Microsoft Forefront Endpoint Protection (FEP) compliance with those requirements.
Custom Actions
This table lists the custom actions taken by Windows Installer when installing FEP (using installation file epp.msi).
| Action | Description |
|---|---|
XWixQueryOsWellKnownSID |
Windows Installer XML (WIX) standard custom action (from a third-party tool) |
SetConfigProperties |
Retrieves the configuration from the registry during uninstall and repair |
FepRegistrator |
Adds FEP items to the System Center Configuration Manager configuration |
FepRegistratorUninstall |
Removes FEP items from the System Center Configuration Manager during uninstall |
FepRegistratorRollback |
Removes FEP items from the System Center Configuration Manager during install rollback |
InstallSqlData |
WIX standard custom action (from a third-party tool) |
UninstallSqlData |
WIX standard custom action (from a third-party tool) |
SchedServiceConfig UninstallSqlData |
WIX standard custom action (from a third-party tool) |
SetConfigProperties |
Retrieves configuration from the registry during uninstall and repair |
WixQueryOsWellKnownSID |
WIX standard custom action (from a third-party tool) |
RegisterETWMofFile |
Configures FEP service tracing |
ExecServiceConfig |
WIX standard custom action (from a third-party tool) |
StopWPPLogSession |
Stops the FEP service default tracing session |
RollbackServiceConfig |
WIX standard custom action (from a third-party tool) |
FepReportRegistrator |
Adds FEP reporting items to the System Center Configuration Manager configuration |
TimeDimensionGenerator |
Configures the FEP reporting database |
StylesDeployment |
Configures FEP reporting visual style |
GenerateOLAP |
Configures the FEP Reporting Analysis services |
InstallSISSPackages |
Configures the FEP reporting data transport service |
SqlJobEnablerFepDB |
Enables the FEP to report SQL Jobs on the System Center Configuration Manager database server |
SqlJobExecuterGetNewData |
Initialize the FEP reports database |
SqlJobEnablerDWDBEnables |
FEP to report SQL Jobs on the data-warehouse server |
UninstallSISSPackages |
Removes the FEP reporting data transport service during uninstall |
UninstallGenerateOLAP |
Removes the FEP Reporting Analysis services during uninstall |
UninstallReportsDeployment |
Removes FEP reports on the Reporting Services during uninstall |
FepReportRegistratorUninstall |
Removes FEP reporting items from the System Center Configuration Manager configuration during uninstall |
SqlJobEnablerFepDBUninstall |
Disables FEP report SQL Jobs on the System Center Configuration Manager database server during uninstall |
SqlJobEnablerDWDBUninstall |
Disables FEP report SQL Jobs on the data-warehouse server during uninstall |
RollbackReportsDeployment |
Removes FEP reports on the Reporting Services during install rollback |
RollbackGenerateOLAP |
Removes the FEP Reporting Analysis services during install rollback |
FepReportRegistratorRollback |
Removes FEP reporting items from the System Center Configuration Manager configuration during install rollback |
SqlJobEnablerFepDBRollback |
Disables FEP report SQL Jobs on the System Center Configuration Manager database server during install rollback |
SqlJobEnablerDWDBRollback |
Disables FEP report SQL Jobs on the data-warehouse server during install rollback |
ReportsDeployment |
Configures FEP reports on the Reporting Services |
CreateDatabase |
WIX standard custom action (from a third-party tool) |
DropDatabase |
WIX standard custom action (from a third-party tool) |
ExecuteSqlStrings |
WIX standard custom action (from a third-party tool) |
DataSourceDeployment |
Configure FEP reports data source on the Reporting Services |
RollbackExecuteSqlStrings |
WIX standard custom action (from a third-party tool) |
RollbackCreateDatabase |
WIX standard custom action (from a third-party tool) |
This table lists the custom actions taken by Windows Installer when installing the FEP client software (using the installation file fepclient.msi).
| Action | Description |
|---|---|
CloseClient |
Closes the user interface (UI) process |
MoveLockedFilesCA |
Copies locked files to a temporary folder (Used for “reboot required” prevention) |
RefreshShellFTA |
Refreshes the Windows Explorer file type association |
ModifyClientAppLogLocation |
Modifies the application log location |
CreateEppShellLinks |
Creates an application shell link |
RemoveEppShellLinks, RollbackEppShellLinks |
Removes an application shell link |
PolicyUninstall |
Uninstalls a policy |
PolicyInstall |
Installs a policy |
CloseOOBEWizard |
Closes the Out-of-Box Experience (OOBE) UI process |
RegisterWmiInfrastructureTraceSession |
Registers the Windows Management Instrumentation (WMI) infrastructure WPP trace session |
RegisterAMMofFile MpProviderInstallMofFile FirewallStateProviderInstallMofFile FirewallConfigurationNamespaceMofFile FirewallConfigurationProviderMofFile FirewallConfigurationProfileMofFile FirewallConfigurationRuleMofFile RegisterClientMofFile |
Register WMI providers |
SetFepMofUnregisterDeferredCAData SetFepMofUnregisterRollbackCAData |
Copies MOF file content from the MSI Binary Table to the MSI Property for later use |
FepMofUnregisterDeffered FepMofUnregisterRollBack |
Unregisters WMI providers |
WaitForUnloadWmiProviders |
Waits for WMI providers to get unloaded |
These are the custom actions taken by Windows Installer when installing the antimalware service (using installation file mp_ambits.msi).
| Action | Description |
|---|---|
InstallPerfCounterData |
Installs antimalware performance counter data |
UninstallPerfCounterData |
Uninstalls antimalware performance counters data |
LAUNCH_MY_PROGRAM_PLEASE |
Sets a property needed by other custom actions |
UpgradeParamsAction |
Sets a property needed by other custom actions |
NISServiceName |
Sets a property needed by other custom actions |
NISServiceDesc |
Sets a property needed by other custom actions |
NISServiceNameLoc |
Sets a property needed by other custom actions |
NISServiceDescLoc |
Sets a property needed by other custom actions |
InstallDriverWFP_SetProperty |
Sets a property needed by other custom actions |
InstallDriverTDI_SetProperty |
Sets a property needed by other custom actions |
InstallDriverWFPRollback_SetProperty |
Sets a property needed by other custom actions |
InstallDriverTDIRollback_SetProperty |
Sets a property needed by other custom actions |
UninstallDriverWFP_SetProperty |
Sets a property needed by other custom actions |
UninstallDriverTDI_SetProperty |
Sets a property needed by other custom actions |
UninstallDriverWFPRollback_SetProperty |
Sets a property needed by other custom actions |
UninstallDriverTDIRollback_SetProperty |
Sets a property needed by other custom actions |
WFPInstallComponents_SetProperty |
Sets a property needed by other custom actions |
WFPInstallComponentsRollback_SetProperty |
Sets a property needed by other custom actions |
WFPUninstallComponents_SetProperty |
Sets a property needed by other custom actions |
WFPUninstallComponentsRollback_SetProperty |
Sets a property needed by other custom actions |
FinalizeNisInstall_SetProperty |
Sets a property needed by other custom actions |
SetAMPRODUCT_FCSProperty |
Sets a property needed by other custom actions |
SetAMPRODUCT_MORROProperty |
Sets a property needed by other custom actions |
SetAMPRODUCT_JUPITERProperty |
Sets a property needed by other custom actions |
SetARPInstallLocation |
Sets a property needed by other custom actions |
SetAPPDATALocation |
Sets a property needed by other custom actions |
SetRegistrySaveKeyParams |
Sets a property needed by other custom actions |
InstallMpFilterDriverProperty |
Sets a property needed by other custom actions |
UninstallMpFilterDriverProperty |
Sets a property needed by other custom actions |
InstallMpFilterDriverRollbackProperty |
Sets a property needed by other custom actions |
UninstallMpFilterDriverRollbackProperty |
Sets a property needed by other custom actions |
InstallMpNWMonDriverProperty |
Sets a property needed by other custom actions |
UninstallMpNWMonDriverProperty |
Sets a property needed by other custom actions |
InstallMpNWMonDriverRollbackProperty |
Sets a property needed by other custom actions |
UninstallMpNWMonDriverRollbackProperty |
Sets a property needed by other custom actions |
RemoveSigDirProperty |
Sets a property needed by other custom actions |
RemoveScanDirProperty |
Sets a property needed by other custom actions |
RemoveLocalCopyDirProperty |
Sets a property needed by other custom actions |
RemoveSupportDirProperty |
Sets a property needed by other custom actions |
RestoreRegKeyProperty |
Sets a property needed by other custom actions |
SaveSignaturesProperty |
Sets a property needed by other custom actions |
RestoreSignaturesProperty |
Sets a property needed by other custom actions |
ConfigServiceHardeningProperty |
Sets a property needed by other custom actions |
RemoveServiceHardeningProperty |
Sets a property needed by other custom actions |
ServiceDescriptionPreVistaProperty |
Sets a property needed by other custom actions |
ServiceDescriptionPostVistaProperty |
Sets a property needed by other custom actions |
ValidateServiceStartProperty |
Sets a property needed by other custom actions |
CollectErrorLogFilesProperty |
Sets a property needed by other custom actions |
DeleteScheduledTasksProperty |
Sets a property needed by other custom actions |
DisableWDRollbackProperty |
Sets a property needed by other custom actions |
EnableWDOnUninstallProperty |
Sets a property needed by other custom actions |
EnableWDRollbackProperty |
Sets a property needed by other custom actions |
UnregisterWscOnUninstallProperty |
Sets a property needed by other custom actions |
UnregisterWscOnUpgradeProperty |
Sets a property needed by other custom actions |
SetEDTValueProperty |
Sets a property needed by other custom actions |
FindExistingConfigRoot |
Finds the registry root key for older versions that are installed |
SetWellKnownSids |
Sets account SIDs for well-known accounts |
CutTrailingBSFromAppDataDir |
Removes trailing backslashes from a directory path |
StopRunningProcessW |
Stops running processes |
SaveRegKey |
Migrates settings from older versions to the new version |
SaveSignatures |
Migrates definitions from an older version |
RemoveSigDir |
Deletes the definition directory |
RemoveScanDir |
Deletes the scan directory |
RemoveLocalCopyDir |
Deletes the local copy directory |
RemoveSupportDir |
Deletes the support directory |
StopMpTracing |
Stops tracing |
UnregisterWscOnUninstall |
Unregisters antimalware from WSC on uninstall |
UnregisterWscOnUpgrade |
Unregisters antimalware from WSC on upgrade |
InstallMpFilterDriver |
Installs the Mpfilter driver |
UninstallMpFilterDriver |
Uninstalls the mpfilter driver |
InstallMpNWMonDriver |
Installs the mnwmon driver |
UninstallMpNWMonDriver |
Uninstalls the mpnwmon driver |
ValidateServiceStart |
Validates that the service has started correctly |
EnableUSN |
Enables USN on the system volume |
RestoreRegKey |
Restores registry keys from a previously upgraded version |
RestoreSignatures |
Restores definitions from a previously upgraded version |
ConfigServiceHardening |
Configures service hardening (limits network access to an antimalware service) |
RemoveServiceHardening |
Removes the antimalware service hardening |
DeleteScheduledTasks |
Deletes the antimalware scheduled tasks |
EnableWDOnUninstall |
Enables Windows Defender during uninstall |
SetEDTValue |
Sets the EDT value (eval) |
InstallMpFilterDriverRollback |
Rolls back installation of the Mpfilter driver |
UninstallMpFilterDriverRollback |
Rolls back installation of the mpfilter driver |
InstallMpNWMonDriverRollback |
Rolls back installation of the mnwmon driver |
UninstallMpNWMonDriverRollback |
Rolls back uninstallation of the mpnwmon driver |
CollectErrorLogFiles |
Collects error log files |
DisableWDRollback |
Rolls back the disabling of Windows Defender |
EnableWDRollback |
Rolls back the enabling of Windows Defender |
InstallDriver |
Installs the Network Inspection System (NIS) driver |
WFPInstallComponents |
Installs the WFP component (NIS) |
FinalizeNisInstall |
Finalizes the NIS installation |
RegisterPerfCounterData |
Registers performance counter data |
UnregisterPerfCounterData |
Unregisters performance counter data |
UninstallDriver |
Uninstalls the NIS driver |
WFPUninstallComponents |
Uninstalls the NIS WFP components |
RollbackRegisterPerfCounterData |
Rolls back the registering of performance counter data |
RollbackUnregisterPerfCounterData |
Rolls back the unregistering of performance counter data |
InstallDriverRollback |
Rolls back the NIS driver installation |
UninstallDriverRollback |
Rolls back the NIS driver uninstallation |
WFPInstallComponentsRollback |
Rolls back the NIS WFP installation |
WFPUninstallComponentsRollback |
Rolls back the NIS WFP uninstallation |
The following table lists custom actions taken by third-party packages, which are not described here.
| Installation File | Action |
|---|---|
sqlncli.msi |
SkipInstallCA IsDotNet20Installed IsPendingRebootKey Sqlmsirc_ValidateAppGuid_NewerFound.0D10D66A_FB58_4290_B8AC_58FF44A6C1F1 Sqlmsirc_RefCountAppGuid_NewerFound.0D10D66A_FB58_4290_B8AC_58FF44A6C1F1 Sqlmsirc_CheckLanguage.0D10D66A_FB58_4290_B8AC_58FF44A6C1F1 Sqlmsirc_ValidateAppGuid.0D10D66A_FB58_4290_B8AC_58FF44A6C1F1 Sqlmsirc_RefCountAppGuid.0D10D66A_FB58_4290_B8AC_58FF44A6C1F1 Sqlmsirc_CheckAppDependency.0D10D66A_FB58_4290_B8AC_58FF44A6C1F1 SNAC_SetClientSSNLDefaults.9B634CFE_9A39_4508_9CA8_D8DE65A7B8AD SxsInstallCA SxsUninstallCA Sqlmsirc_BackupAppGuid_NewerFound.0D10D66A_FB58_4290_B8AC_58FF44A6C1F1 Sqlmsirc_RegisterAppGuid_NewerFound.0D10D66A_FB58_4290_B8AC_58FF44A6C1F1 Sqlmsirc_RestoreAppGuid_NewerFound.0D10D66A_FB58_4290_B8AC_58FF44A6C1F1 Sqlmsirc_BackupAppGuid.0D10D66A_FB58_4290_B8AC_58FF44A6C1F1 Sqlmsirc_RegisterAppGuid.0D10D66A_FB58_4290_B8AC_58FF44A6C1F1 Sqlmsirc_RestoreAppGuid.0D10D66A_FB58_4290_B8AC_58FF44A6C1F |
sqlncli_x64.msi |
SkipInstallCA IsDotNet20Installed IsPendingRebootKey Sqlmsirc_ValidateAppGuid_NewerFound.D350C5A1_F686_4118_97C0_28AC69A2FC76 Sqlmsirc_RefCountAppGuid_NewerFound.D350C5A1_F686_4118_97C0_28AC69A2FC76 Sqlmsirc_CheckLanguage.D350C5A1_F686_4118_97C0_28AC69A2FC76 Sqlmsirc_ValidateAppGuid.D350C5A1_F686_4118_97C0_28AC69A2FC76 Sqlmsirc_RefCountAppGuid.D350C5A1_F686_4118_97C0_28AC69A2FC76 Sqlmsirc_CheckAppDependency.D350C5A1_F686_4118_97C0_28AC69A2FC76 SNAC_SetClientSSNLDefaults.E6F94A18_225A_4D91_8129_DB62CA84F36B SNAC_SetClientSSNLDefaults.9B634CFE_9A39_4508_9CA8_D8DE65A7B8AD SxsInstallCA SxsUninstallCA Sqlmsirc_BackupAppGuid_NewerFound.D350C5A1_F686_4118_97C0_28AC69A2FC76 Sqlmsirc_RegisterAppGuid_NewerFound.D350C5A1_F686_4118_97C0_28AC69A2FC76 Sqlmsirc_RestoreAppGuid_NewerFound.D350C5A1_F686_4118_97C0_28AC69A2FC76 Sqlmsirc_BackupAppGuid.D350C5A1_F686_4118_97C0_28AC69A2FC76 Sqlmsirc_RegisterAppGuid.D350C5A1_F686_4118_97C0_28AC69A2FC76 Sqlmsirc_RestoreAppGuid.D350C5A1_F686_4118_97C0_28AC69A2FC76 |
sqlserver2005_xmo.msi |
SkipInstallCA IsDotNet20Installed IsPendingRebootKey Write_sqlLocalServers.BB9BCD10_C507_4374_A5FC_3F04C705A420 SqlFollowComponentsValidate.BB9BCD10_C507_4374_A5FC_3F04C705A420 Write_sqlVerIndependentProgID.BB9BCD10_C507_4374_A5FC_3F04C705A420 Sqlmsirc_ValidateAppGuid_NewerFound.0D10D66A_FB58_4290_B8AC_58FF44A6C1F1 Sqlmsirc_RefCountAppGuid_NewerFound.0D10D66A_FB58_4290_B8AC_58FF44A6C1F1 Sqlmsirc_CheckLanguage.0D10D66A_FB58_4290_B8AC_58FF44A6C1F1 Sqlmsirc_ValidateAppGuid.0D10D66A_FB58_4290_B8AC_58FF44A6C1F1 Sqlmsirc_RefCountAppGuid.0D10D66A_FB58_4290_B8AC_58FF44A6C1F1 Sqlmsirc_CheckAppDependency.0D10D66A_FB58_4290_B8AC_58FF44A6C1F1 SxsInstallCA SxsUninstallCA Sqlmsirc_BackupAppGuid_NewerFound.0D10D66A_FB58_4290_B8AC_58FF44A6C1F1 Sqlmsirc_RegisterAppGuid_NewerFound.0D10D66A_FB58_4290_B8AC_58FF44A6C1F1 Sqlmsirc_RestoreAppGuid_NewerFound.0D10D66A_FB58_4290_B8AC_58FF44A6C1F1 Sqlmsirc_BackupAppGuid.0D10D66A_FB58_4290_B8AC_58FF44A6C1F1 Sqlmsirc_RegisterAppGuid.0D10D66A_FB58_4290_B8AC_58FF44A6C1F1 Sqlmsirc_RestoreAppGuid.0D10D66A_FB58_4290_B8AC_58FF44A6C1F1 Do_sqlLocalServers.BB9BCD10_C507_4374_A5FC_3F04C705A420 Undo_sqlLocalServers.BB9BCD10_C507_4374_A5FC_3F04C705A420 Do_sqlVerIndependentProgID.BB9BCD10_C507_4374_A5FC_3F04C705A420 |
sqlserver2005_xmo_x64.msi |
SkipInstallCA IsDotNet20Installed IsPendingRebootKey Write_sqlLocalServers.8A7C0211_57EC_4FE0_833F_8FAC0EBC0C1B SqlFollowComponentsValidate.8A7C0211_57EC_4FE0_833F_8FAC0EBC0C1B Write_sqlVerIndependentProgID.8A7C0211_57EC_4FE0_833F_8FAC0EBC0C1B Sqlmsirc_ValidateAppGuid_NewerFound.D350C5A1_F686_4118_97C0_28AC69A2FC76 Sqlmsirc_RefCountAppGuid_NewerFound.D350C5A1_F686_4118_97C0_28AC69A2FC76 Sqlmsirc_CheckLanguage.D350C5A1_F686_4118_97C0_28AC69A2FC76 Sqlmsirc_ValidateAppGuid.D350C5A1_F686_4118_97C0_28AC69A2FC76 Sqlmsirc_RefCountAppGuid.D350C5A1_F686_4118_97C0_28AC69A2FC76 Sqlmsirc_CheckAppDependency.D350C5A1_F686_4118_97C0_28AC69A2FC76 SxsInstallCA SxsUninstallCA Sqlmsirc_BackupAppGuid_NewerFound.D350C5A1_F686_4118_97C0_28AC69A2FC76 Sqlmsirc_RegisterAppGuid_NewerFound.D350C5A1_F686_4118_97C0_28AC69A2FC76 Sqlmsirc_RestoreAppGuid_NewerFound.D350C5A1_F686_4118_97C0_28AC69A2FC76 Sqlmsirc_BackupAppGuid.D350C5A1_F686_4118_97C0_28AC69A2FC76 Sqlmsirc_RegisterAppGuid.D350C5A1_F686_4118_97C0_28AC69A2FC76 Sqlmsirc_RestoreAppGuid.D350C5A1_F686_4118_97C0_28AC69A2FC76 Do_sqlLocalServers.8A7C0211_57EC_4FE0_833F_8FAC0EBC0C1B Undo_sqlLocalServers.8A7C0211_57EC_4FE0_833F_8FAC0EBC0C1B Do_sqlVerIndependentProgID.8A7C0211_57EC_4FE0_833F_8FAC0EBC0C1B |
sqlserver2008_asamo10_x64.msi |
Write_sqlLocalServers_Redist_64 Write_sqlVerIndependentProgID_Redist_64 SqlFollowComponentsValidate_Redist_64 IsDotNet20Installed SkipInstallCA Sqlmsirc_ValidateAppGuid_64 Sqlmsirc_RefCountAppGuid_64 Sqlmsirc_CheckAppDependency_64 Sqlmsirc_CheckLanguage_64 Sqlmsirc_ValidateAppGuid_NewerFound_64 Sqlmsirc_RefCountAppGuid_NewerFound_64 Sqlmsirc_CheckFeatureDependency_64 Sqlmsirc_NotifyFeatureStates_64 Write_NativeImage_Redist_64 Remove_NativeImage_Redist_64 Sqlmsirc_BackupAppGuid_64 Sqlmsirc_RegisterAppGuid_64 Sqlmsirc_RestoreAppGuid_64 Sqlmsirc_BackupAppGuid_NewerFound_64 Sqlmsirc_RegisterAppGuid_NewerFound_64 Sqlmsirc_RestoreAppGuid_NewerFound_64 SapBiOpenReadme Undo_NativeImage_Redist_64 Do_sqlLocalServers_Redist_64 Undo_sqlLocalServers_Redist_64 Do_sqlVerIndependentProgID_Redist_64 |
sqlserver2008_asamo10_x86.msi |
Write_sqlLocalServers_Redist_32 Write_sqlVerIndependentProgID_Redist_32 SqlFollowComponentsValidate_Redist_32 IsDotNet20Installed SkipInstallCA Sqlmsirc_ValidateAppGuid_32 Sqlmsirc_RefCountAppGuid_32 Sqlmsirc_CheckAppDependency_32 Sqlmsirc_CheckLanguage_32 Sqlmsirc_ValidateAppGuid_NewerFound_32 Sqlmsirc_RefCountAppGuid_NewerFound_32 Sqlmsirc_CheckFeatureDependency_32 Sqlmsirc_NotifyFeatureStates_32 Write_NativeImage_Redist_32 Remove_NativeImage_Redist_32 Sqlmsirc_BackupAppGuid_32 Sqlmsirc_RegisterAppGuid_32 Sqlmsirc_RestoreAppGuid_32 Sqlmsirc_BackupAppGuid_NewerFound_32 Sqlmsirc_RegisterAppGuid_NewerFound_32 Sqlmsirc_RestoreAppGuid_NewerFound_32 SapBiOpenReadme Undo_NativeImage_Redist_32 Do_sqlLocalServers_Redist_32 Undo_sqlLocalServers_Redist_32 Do_sqlVerIndependentProgID_Redist_32 |
Files Requiring Elevated Permissions
The following files require elevated permissions:
\Program Files\Microsoft Security Client\setup.exe
\Program Files\Microsoft Security Client\Backup\amd64\setup.exe
\Windows\SoftwareDistribution\Download\Install\AM_Delta_Patch1.exe
\Program File 2\Microsoft Forefront\Client\FEPInstall.exe
\Program File 2\Microsoft Forefront\Forefront Endpoint Protection\FepSrv.exe
NisSrv.exe
Files That Remain After Uninstall
This table lists files that remain in place after you uninstall and can then be deleted.
| File | Description |
|---|---|
\Program Files\Microsoft SQL Server\MSSQL10_50.SQLR2\MSSQL\DATA\FEPDW_VTP.mdf \Program Files\Microsoft SQL Server\MSSQL10_50.SQLR2\MSSQL\DATA\FEPDW_VTP_log.LDF |
Database files containing malware activity history (user data). |
\Program File 2\Microsoft Forefront\Client\Policies\Default Desktop Policy.xml \Program File 2\Microsoft Forefront\Client\Policies\Default Server Policy.xml |
User data. |
\Windows\System32\MpSigStub.exe |
Microsoft installer application used in conjunction with Windows Automatic Updates to install new definitions on the machine. |
\Windows\System32\winevt\Logs\Forefront Endpoint Protection.evtx |
Forefront Endpoint Protection event log file. |
Other Information
The file epplauncher.mif is a FEP file and has an unregistered extension. This file passes FEP installation results to the System Center Configuration Manager.
If the server is low on resources and the Network Inspection System is running, there might be interruptions in network connections. These can cause third-party application issues, for example, preventing the System Center Configuration Manager Console from starting.
When the client computer is running in safe mode, the antimalware service loads, because it is needed to diagnose, protect, repair, and maintain the computer. This behavior is governed by the following two registry entries:
HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Safeboot\Minimal\MsMpSvc
HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Safeboot\Network\MsMpSvc
Real-time protection does not function in safe mode, because this could interfere with the ability to diagnose, protect, repair, and maintain the computer.