Use automatic deployment rules to deliver definition updates to client computers.

Use the software updates automatic deployment rules to ensure that clients automatically receive the latest definition updates.

Make sure that the site is configured to use encryption, or that all management points are configured for HTTPS client connections.

Because Endpoint Protection clients use status messages to send information about any malware that they detect, prevent others from reading this information on the network by encrypting the data.

To configure encryption for the site, see the Configure Signing and Encryption section in the Configuring Security for Configuration Manager topic.

For management points to support HTTPS client connections, you must deploy PKI certificates. For more information about the certificate requirements, see PKI Certificate Requirements for Configuration Manager.

If you use email notification, configure authenticated access to the SMTP mail server.

Whenever possible, use a mail server that supports authenticated access and use the computer account of the site server for authentication. If you must specify a user account for authentication, use an account that has the least privileges.

Ensure that end users do not have local administrative privileges.

Although it is always a security best practice to grant end users the least privileges that they need and not to grant them local administrative privileges, this is especially important for Endpoint Protection. When users have local administrative rights on computers that run the Endpoint Protection client, they might be able to do the following:

• They can delete the reported instances of malware on their computer before this information is sent to Configuration Manager. Information about malware detection is collected and sent to the Configuration Manager site every five minutes. It is possible for a local administrator to delete the information on their computer that malware was detected, and if this happens within the five minutes, Configuration Manager will have no information about the detected malware.
  
  
• They can uninstall the Endpoint Protection client or stop dependent services. Although Configuration Manager can detect that the Endpoint Protection is no longer installed and will automatically reinstall it, and client status can restart a stopped service and set it back to automatic, this still leaves a potential window of vulnerability when the computer is unprotected by Endpoint Protection.