I see discussions related to the EpePC has been corrupted (error 92h) error on EEM Managed machines but has anyone seen this on ePO managed machines? I have a machine displaying this error that is running EEPC Software 126.96.36.199, EEPC Agent 188.8.131.52, McAfee Agent 184.108.40.2060, and Windows XP SP3. This machine is also at a remote site across the country. Is there any hope of recovery being done remotely? Thanks in advance.
After the E-boot I though the machine had to contact the ePO server to rebuild the PBFS. I do have the ports open on the ePO server to allow offsite machines to report in but I am pretty sure they will not download software from the ePO server. Does that seem to be correct?
I am in the middle of an upgrade of our entire organization and I have 10 machines with this error at one of our remote sites. There are no real similarities (the make. model, disk mode, bios version, etc.vary). The only similarity is that they are all at this one location. I have deployed this to over 500 machines and so far these are the only 10 that have crashed and received this error 92h error. I deployed to 38 at this one site and confirmed some upgraded without a problem.
Nothing seems to fix the problem (Emerg. Boot, Remove EE and Fix MBR, etc.). We are upgrading clients from EEPC 5.2.10 to 6.1.3 with the hotfix. We have ePO 4.6 patch 1 and the clients are running McAfee Agent 4.6. I have ticket in with support, but nothing yet....I was hoping to access the drive with the EETECH tools to get the data off or view some logs, but I can't see it even after authenticating and authorizing with the file.
Anyone else seen this issue? Any suggestions?
If you have 92H, it means that the mbr code can't find the pre-boot OS where it expects - usually it's because some bad program deleted or moved the file, a third party defrag tool which does not follow unmovable file rules, or a repartitioning tool etc.
something external to EEPC.
You can't mount a drive in this state as EETech does not know what is and is not encrypted - all you can do is force decrypt it.
So, I would look for some tool/process which moves files illegally.
One of my co-workers worked with you through one of these blogs to get theWINPE environment and EETECH working for us. It works on a 6.1.3encrypted drive in the since that I can boot up a known good encrypted drive, authenticate,authorize and see the contents of the encrypted drive to remove the data. With the drives that have received this 92h error I cannot. My onlyoption is to format when I click on the drive after authenticating and authorizing.
I saw mention in a post from you back in April about a TDSS rootkit causingissues like this(https://community.mcafee.com/thread/44889?start=0&tstart=0). Haveyou seen that a lot?
TDSS causes a slightly different error - you get "EEPC is not installed" after a pre-boot login.
You can't see the contents of the drive in a 92H state, because EETech doesnt know what is and is not encrypted - you should still be able to test the key (using the workspace) and then force decrypt it though (via the partiton information). Then replace the MBR with a standard one and you'll be working again.