I have just had a few servers that somehow has failed to update their Forefront Client Security client software 🙁 The problem seem to be that Forefront cannot seem to stop the FCSAM service while updating, the service is stuck on “Stopping” and neither taskkill og any other utility seem to be able to kill it.
The errors in the eventlog go something along these lines;
Microsoft Forefront Client Security Antimalware Service Error 1921. Service 'Microsoft Forefront Client Security Antimalware Service' (FCSAM) could not be stopped.
I have tried uninstalling, rebooting and reinstalling but this did not help.
The workaround suggested is to set the service FCSAM to manual, reboot, upgrade and then setting the service back to automatically – however this only works for now and thus only postpones the problem.
I have found this article on a similar problem which I will try tomorrow, this includes some additional cleanup steps;
Eg. issuing the command; sc delete fcsam
I will also try to slipstream the installation of Forefront Client Security before I retry the re-installation, description on how to do here (mind you use the latest update and not the one the article refer to);