Server 2008 SP2 - SCEP/MSSE definition updates

Discussion in 'Windows Server' started by Carlos Detweiller, Sep 24, 2020.

  1. Carlos Detweiller

    Carlos Detweiller Emperor of Ice-Cream
    Staff Member

    Dec 21, 2012
    7,202
    8,752
    240
    Lately (since end of August), SCEP (MSSE, too) does not seem to be able to update its definitions on Server 2008 SP2 (NT 6.0). Running the same on Windows 7 is fine, however.

    Even a complete reset or new installation does this. 0x80070643

    Did MS b0rk it on Server 2008 SP2?


    (Unfortunately, I also can't find any other free AV that will run in Server 2008 SP2.)
     
    Stop hovering to collapse... Click to collapse... Hover to expand... Click to expand...
  2. Carlos Detweiller

    Carlos Detweiller Emperor of Ice-Cream
    Staff Member

    Dec 21, 2012
    7,202
    8,752
    240
    Stop hovering to collapse... Click to collapse... Hover to expand... Click to expand...
  3. abbodi1406

    abbodi1406 MDL KB0000001

    Feb 19, 2011
    17,592
    93,438
    340
    It worked here
    extracted mpas-fe.exe with 7-zip
    replaced the new mpengine.dll
    ran following cmd as admin
    Code:
    MpSigStub.exe /stub 1.1.16900.5 /payload 0.0.0.0
    you may need to clear this folder first
    C:\ProgramData\Microsoft\Windows Defender\Definition Updates\Backup\

    the missing kernel32.dll's TryAcquireSRWLockExclusive broke a lot of programs on NT 6.0
     
  4. Carlos Detweiller

    Carlos Detweiller Emperor of Ice-Cream
    Staff Member

    Dec 21, 2012
    7,202
    8,752
    240
    Yes, I got it to work. For some reason, my old extracted mpas-fe.exe directory missed the dynamics (maybe because it was a fresh cycle). I just got and extracted mpas-d.exe, too, for the dynamics.

    The complete set (5 files, including the compatible mpengine.dll) copied to "C:\ProgramData\Microsoft\Microsoft Antimalware\Definition Updates\Updates\" triggers an immediate update (the files will disappear). If the set is missing files, nothing will update, but the files disappear, too.

    Code:
    mpasbase.vdm
    mpasdlta.vdm
    mpavbase.vdm
    mpavdlta.vdm
    mpengine.dll
     
    Stop hovering to collapse... Click to collapse... Hover to expand... Click to expand...