We’re tracking an issue where the latest FCS antimalware client update won’t install on Windows 2000 when the installation is run as Local System (i.e. Automatic Updates installing at 3am).
When this issue occurs, the update uninstalls the previous version of the antimalware client, and then tries to install the new version and fails, leaving the system without the antimalware service.
Workarounds are to decline the updates (976669 is the FCS slipstream client) and make sure that the previous FCS antimalware updates are approved (971026 and original FCS client), or run the install interactively as a logged on user.
Again, this only affects Windows 2000 when the updates are installing non-interactively as the Local System account (via Microsoft Update, WSUS, SMS, or Configuration Manager)
As an interim fix, we’re working to change the detection logic on Microsoft Update and WSUS so that the update isn’t offered to Windows 2000 systems, and will post an update when we have a more permanent fix to the problem.