Querying for End-of-life Generated by FEP and SCEP

A platform update to Forefront Endpoint Protection 2010 (FEP) and System Center 2012 Endpoint Protection (SCEP) on April 8, 2014 brings a new feature where Microsoft's anti-malware engine will classify the operating system into one of three stages based on the support expiration of the OS. You can read all about the platform update and the three distinct stages here: Microsoft Endpoint Protection Modified with Warnings and Service Stoppage for OS End-of-Life.

As part of the platform update, Microsoft has also included a special Windows registry key entry to allow administrators to query to determine the end-of-life state of the operating system. Those companies that utilize System Center Configuration Manager can inventory the registry key value to find the PC's assigned stage. This is important since Stage 3 means that the anti-malware engine will cease functioning completely, and PCs reaching support expiration need to be migrated to a newer operating system to remain protected.

The registry key that can be queried is:

HKLMSoftwareMicrosoftMicrosoft AntimalwareEndOfLifeState

This key will contain special values to show end-of-life status:

A value of '1' means Stage 1 has been reached, indicating that the OS is approaching end-of-life.

A value of '2' means Stage 2 has been reached and the OS has entered the grace period.

A value of '3' means Stage 3 has been reached and that the anti-malware will cease functioning.

Even though this new feature has been developed due to the end of support for Windows XP (April 8, 2014), it is a permanent feature going-forward and will be applied against any operating system approaching end of days. The registry key will only be created when the operating system enters Stage 1. The key will not exist until that time.