#SCCM #SCEP Suspend SCCM2012 SP1 Endpoint Protection #SysCtr

If you ever come into a situation where you need to stop the running System Center Endpoint Protection 2012 SP1,  you will find out that there is no way to stop the service. Neither in the GUI nor the service Microsoft Antimalware Service (MsMpEng.exe) itself.

After searching a while I found the solution in this thread:

You need two tools, which will help you (not only in this case!): psexec and Process Explorer.

Copy both tools to a folder on the system and start an elevated command promt.

1. Run the command:

%yourpath%\psexec.exe –s –i %yourpath%\procexp.exe  *

Capture1

*where %yourpath% is the path you saved the tools in

2. After accepting two EULAs (only for the first time) Process Explorer will show up. Search for a process called “MsMpEng.exe” and double click it. Switch to the “services” tab.

Capture2

3. Click on “Permissions” and give Full Control rights to the Administrators group.

Capture3

After OKing every window you can open or refresh your services.mmc and you will be able to stop the Microsoft Antimalware Service.

Capture4

 

As soon as you start the service again, the permissions will be set back to the original settings.

Christian

Leave a Reply

Fill in your details below or click an icon to log in:

WordPress.com Logo

You are commenting using your WordPress.com account. Log Out / Change )

Twitter picture

You are commenting using your Twitter account. Log Out / Change )

Facebook photo

You are commenting using your Facebook account. Log Out / Change )

Google+ photo

You are commenting using your Google+ account. Log Out / Change )

Connecting to %s