This post explains what to do when Endpoint Protection policy not applied

Symptom

  • The policy was applied to a specific collection and all members of the collection were failing to apply the policy

Monitoring / Endpoint Protection Status / System Center 2012 R2 Endpoint Protection Status / Operational State

12 clients are failing to apply the custom policy.

Endpoint Protection policy is not applied

Clicking on the “Antimalware policy application failed” brings us to the list of machine. On the bottom, clicking on the “Antimalware Policy” tab shows the error :

0x80004005 – Failed to generate Antimalware policy file

Endpoint Protection policy is not applied

Let’s look at the EndpointProtectionAgent.log on one of the affected client.

  • Failed to generate AM policy XML with error code 0x80004005
  • State 2 and ErrorCode -2147467259 and ErrorMsg Failed to generate Antimalware policy file
Endpoint Protection policy is not applied

You can see that my policy “Endpoint Protection CTX 4.5, 6.0 & 6.5” is failing.

Error 4005 would make me think about “Access Denied” error but it doesn’t make any sense. The SCCM client is healthy everything is working fine and my Endpoint Definition are getting updated by SCCM.

Resolution

I simply renamed my policy to : Endpoint Protection CTX 4.5, 6.0, 6.5 (I removed the “&” from the policy name)

After a machine policy all error were gone. I’ve done a machine policy retrieval on all my affected client and 5 minutes after, they were all OK.

TL;DR : Do not use special character in Endpoint Policy Name.

Technet is not stating any limitation : http://technet.microsoft.com/en-us/library/hh508785.aspx

The SCCM console is not blocking you if you want to create a policy name “Test &?%$%$”.

My recommendation is to avoid using special character in policy name.

Comments (4)

Sourav Datta

03.25.2019 AT 10:29 AM
Hi Benoit, Thanks for this excellent post. However, when I create a report, for EP AM policy Application Status, I see two values, '1' & '2', what does 1 & 2 mean, does 1 equals 'applied' and 2 equals 'not applied'? Thanks in advance

Pieter

05.06.2015 AT 04:38 PM
Thanks! Same Issue found and your post resolved it. Keep up the good work!

Benoit Lecours

05.07.2015 AT 07:40 AM
Thanks !

Chris

02.04.2015 AT 02:24 PM
Thanks we had this same issue today and found your page and help us fix the problem quickly. Thank you again.