Q. I'm trying to deploy Forefront Endpoint Protection (FEP) using System Center Configuration Manager 2007 (SCCM) using a custom advertisement, but it isn't working. Why not?

A. When the FEP server components that integrate with SCCM are installed, a package, a program, and an advertisement are automatically created to enable deployment of the FEP client, which can be set to download to a cache then execute. If you create your own advertisement that allows installation from the distribution point, the FEP client install will fail.

Because FEP is a security component, it must be installed from the local cache, so make sure you enable Download content from distribution point and run locally under the Distribution Points tab of the advertisement to distribute the FEP client in SCCM.