System Center 2012 Configuration Manager Unleashed

Communication Between the Client and the Server

State messages are used via the ConfigMgr client agent and the site server to transmit information from the SCEP client pertaining to the last scan time, definition update version, whether a virus was detected, or if suspicious malware activity is detected. Here’s how it works:

• There is a separate namespace in Windows Management Instrumentation (WMI) that the SCEP client accesses; this is root\Microsoft\SecurityClient.

• The Configuration Manager client agent monitors the AntiMalwareHealthStatus and AntiMalwareInfectionStatus classes for any changes; if found, a state message is sent. Here are the logs on the client system that provide additional information about what is submitted to the server: ...