McaFee MSME 8.5 Transport Agent Order

[bujar]

Dear All,

I have MSME 8.5 deployed on Exchange 2016 UR2 on Windows 2012 R2. I was wondering if the order of McaFee agents is correct?

Thank you

Bujar

[Aidan]

Normally what I notice is when McAfee stuff is first - its because an sp/cu/fix is applied which stops and starts and reorders transport agent priority.

I would check if they are detecting if this is what you have done

McAfee KnowledgeBase - Best practices when applying Microsoft Exchange rollups and cumulative update...

The behaviour of installation scripts for the agents (in <install folder>\bin\e2007 agents\ folder) is try to find the malware agent priority and set themselves in front of that.

[bujar]

Dear Aidan,

Thank you for your support. I reinstalled MSME agents, as shown in the article. No I can see that McAfeeTxIPAgent is listed as well, shows this agent by under front end transport service. Can you please tell be the correct order of agents by numbers.

Under console I can also see duplicate scan email for some reason, first one scanned by on-access and second one by gateway.

Thank you

[Aidan]

It looks OK as the malware agent is disabled.  I don't think anything else there affects where mcafee agents are listed.

If it were my server and I was going to change  I would do something like

1. Transport Rule

2. Text Routing

3. Text Delivery

4. McAfeeTxRouting

5. McAfeeTxIp

6. McAfeeTx

7. SMTP probe  Drop SMTP

8. SMTP probe drop routing

9. DLP Policy

10 Malware agent (disabled)

That is scanned against 2 policies - Gateway  (where antispam and phish etc is) then standard On Access Policy (Antivirus, File Filters etc)