I made the mistake of loading McAfee on my dell optiplex 755 with windows 7 64 Bit on it. The Bios was set to RAID or AHCI and the system obviously selected RAID. Once the system was rebooted it destroyed the MBR and/or File allocation Table.
When I tried to Authenticate with the Wintec utility and the computer object export, it told me that the device was not active. It also gave me an error that an MBR had not been uploaded to the server.
At this point I have replaced the MBR with both the Windows 7 recovery console and the McAfee Wintech CD ( I was able to authenticate with another computer objects info and pointing to database) However, once I did that I started getting the error above.
McAfee says that if a system is not encrypted that the steps they list will cause data loss. I have a 60 page tutorial on this system that I would desprately like back. Is there any hope? And if so, what steps must I take to resolve this issue??
Your help is greatly appreciated.
if you're getting 92H, then you still have the EEPC MBR in place - you need to remove that and then as long as your drive is not encrypted, you'll be back to square one.
I selected remove EEPC and it ran through a short list of process, all said successful. It then told me it had been removed, however upon restart I now get a 0xc000000f disk inaccessible error.
if you're still getting pre-boot EEPC error messages, you have not flushed the MBR - you need to do this first. I think the correct command from the Rescue environment is FixMBR now?
This is windows that is posting this message. It then gives me two options Enter, and Exit. Both restart the system and repeats the message.
I know before McAfee said that the original MBR had not been uploaded yet. Since I am authenticating with a different Machine Object export, is this going to change the effects if I try the set safe MBR option?
Should I boot to the Windows 7 CD and try to recreate the MBR from within there?
you can't use another machines object!
you need to repair your MBR - there are some low level disk tools which will go scan the drive, but it all depends of course on how hardware-safe your RAID card is. If it generates a perfect standard disk, you should be all right.
It's interesting, EEPC does not actually touch the partition table at all - it just changes the boot code.
What was the EXACT error about the MBR and the server? I am not sure I have ever seen that before? The Original MBR is always stored in the SBR file - it has to be other wise you'd not be able to remove EEPC. Unfortunately, since we don't change the partition table, that's not stored.
Maybe best to call your IT department and ask for them to help you rescue your disk?
Unfortunately I am the IT department. I am a co-Administrator of the system with the Engineer being in Arlington. Since I don't have full access to the server my options are somewhat limited.
Here is exactly what happened.
I loaded the McAfee Encyption agent on my box and selected NO to restarting the system. (This was set to join an AutoBoot enabled group)
I then started seeing some very "funny" things where I could not ping or RDP into servers that were up and available to others
Thinking this was some type of DNS issue I restarted my box hoping to flush and re-register on the domain
Once I restarted I recieved the message "BOOTMGR Not found".
Since the drive never encrypted I made the assumption that I could just rebuild the MBR through the Windows 7 recovery console. Upon launching that, it would not even see the C: drive. I proceeded to run the fix MBR with no positive results and the same error coming up. I also ran check disk with the fix switch. This saw there was data on the drive and the C: partition itself so I was hopeful it would solve the issue. Obviously that didn't happen
I then exported my machine object from the McAfee Console and booted to the WinTech CD. When I tried to authenticate it said system was disabled. I checked the console and sure enough the system is disabled without the option of enabling it.
After trying everything I could to get it to authenticate through my machine object, I tried a tool named "disk scavenger". It saw the drive and the data, but would only pull the files as Jpegs. And would only see approx 500 files.
I then switched back to Wintech and tried to authenticate with another Machine object. This worked! I was very hopefull at this point and selected the restore eepc Mbr option. That didn't help. Then I choose remove EEPC MBR and now am getting the 92H error.
Would putting in the correct sector info into the drive info and selecting decrypt help me at all? Or am I up a creek without a paddle as they say?
Right now if I mount the drive in WinTech and use the A43 File explorer, I only see two folders: Boot, and system volume information. The boot folder contains the bootmgr.exe.mui for multiple lang. there is a tracking.log and a mountPointMangerRemoteDatabase File in the sysvol.