Microsoft Security Essentials, available from http://www.microsoft.com/security_essentials/, protects from viruses, spyware, and other malicious software.
Microsoft Security Essentials is licensed for use only by home users, and "small businesses" that install it on up to 10 devices (see http://www.microsoft.com/security_essentials/eula.aspx#mainNav). For other use cases Microsoft's equivalent product is Forefront Client Security.
 WPKG Package
This is a silent installer and uninstaller for Microsoft Security Essentials (Windows XP, US English, 32-bit version), different binaries are available for other systems.
<package id="microsoft-security-essentials" name="Microsoft Security Essentials" revision="4" reboot="false" priority="1"> <check type="uninstall" condition="exists" path="Microsoft Security Essentials"/> <install cmd='%SOFTWARE%\microsoft-security-essentials\mseinstall.exe /s /runwgacheck' /> <upgrade cmd='%SOFTWARE%\microsoft-security-essentials\mseinstall.exe /s /runwgacheck /o' /> <remove cmd='%SOFTWARE%\microsoft-security-essentials\mseinstall.exe /s /u'/> </package>
Note that an upgrade line is required because although the program updates itself automatically using Windows Automatic Updates (though only for minor updates, not upgrades such as from version 1 to 2), if you bump the revision number then WPKG will want to run an 'upgrade'.
 Installer command-line switches
- /s - perform a silent installation
- /runwgacheck - automatically perform a Windows Genuine Advantage check
- /o - don't automatically run the updater and the system scan after installation - when you then login it may then give a red indicator and say that real time protection is off because virus definition files are out of date. I've had a few differing experiences at this point, either it updates them quickly automatically, or if you click on the notification area icon it tells you it's out of date but then updates it quickly, or it displays this then just waits for you to manually press the 'Update' button. This is as both an Administrator and as a Limited User.
- /u - uninstall
 Error Codes
- -2147156138 - Windows XP SP2, extra package required - http://support.microsoft.com/kb/914882?mkt=en-us
- -2147156213 - Windows hasn't been activated or WGA validation failed
- 327426 - program already installed
Soon after installation MSE can recognise potentially useful software as a threat. For example if you have UltraVNC installed it will flag up UltraVNC.exe. There's a risk that a user, when prompted, will choose to remove or quarantine such files and remove the administrator's ability to connect. Administrative users can allow, quarantine or remove suspicious files where as Limited users can only remove or quarantine suspicious files. Administrators will want to white-list any such programs that should not be considered a threat, upon installation.
White-listing can be performed manually using: Show details → Recommendation → Select an action → Allow → Apply actions (note that Close means 'don't take any action at this point') → Close. This is saved system-wide.
White-listing is saved in the registry so can be automated in any of the usual ways, see the registry editing section.
Relevant white-listing registry settings are:
- Excluded processes.
"Exclude files that are accessed by processes such as programs ... For example, if you don't want Microsoft Security Essentials to scan files that are accessed by Windows Live Messenger, add Messenger.exe to the list of excluded processes.". Add .exe, .cmd, .bat, .pif, .scf or .scr files.
The registry key is
- Excluded paths.
Exclude particular files and/or locations from the scan.
The registry key is
- Excluded file types.
Exclude particular files types / extensions from the scan.
The registry key is
For a list of recommended files and file types to exclude see Virus scanning recommendations for Enterprise computers that are running currently supported versions of Windows.
Continuing with the above example to allow UltraVNC, a .reg registry file would look like this:
Windows Registry Editor Version 5.00 ; Set an exclusion path for winvnc.exe [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Microsoft Antimalware\Exclusions\Paths] "C:\\Program Files\\UltraVNC\\winvnc.exe"=dword:00000000
Note that 'HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Microsoft Antimalware' is read-only for all users apart from SYSTEM. If you use a script, such as a batch file, to alter Microsoft Antimalware registry settings then it will need to run as SYSTEM, which WPKG Client does.
 Virus Definition Updates
Virus definition updates for MSE are automatically downloaded and incorporated by the program, or via Windows Automatic Updates.
To download the Microsoft Forefront Client Security antimalware definition update file (Mpam-fe.exe) for 32-bit (x86-based) versions of Windows, go to http://go.microsoft.com/fwlink/?LinkID=87342&clcid=0x409 and for 64-bit versions of Windows go to http://go.microsoft.com/fwlink/?LinkID=87341&clcid=0x409
To run the Microsoft Forefront Client Security antimalware definition update file in silent mode: Mpam-fe.exe -q
 Program Updates
For minor updates, the Microsoft Security Essentials program updates itself or is updated through Windows Automatic Updates. for Major upgrades, such as from version 1.x to version 2.0, the program must be upgraded manually by an Administrator (not sure about Power User), not by a Restricted / Limited user. Either using Help → Check for software updates, or after being on for an amount of time, the software will prompt for an upgrade, choosing this as a Restricted / Limited user does nothing.
I don't know of a way to determine the installed version, to base WPKG updates off.