cancel
Showing results for 
Search instead for 
Did you mean: 

Cannot initiate On-Demand Full Scan from ePolicy Orchestrator

Jump to solution
We identified a machine has malware detected and would like to initiate a On-Demand Full Scan from ePolicy Orchestrator but failed. Tried to initiate the job by click the machine, Action -> Agent -> Run Client Task Now -> Select Product Endpoint Security Threat Prevention -> Policy Based On-Demand Scan -> On-Demand Scan - Full Scan to start the job. However status expire at 10 - 15 mins around and the job was stopped. Please advise what is best practices and requirement to perform a scanning task remotely. Thanks.
2 Solutions

Accepted Solutions
McAfee Employee chealey
McAfee Employee
Report Inappropriate Content
Message 4 of 9

Re: Cannot initiate On-Demand Full Scan from ePolicy Orchestrator

Jump to solution

I would not suggest running an ODS task via a run client task now. This is because run client task now tasks have a default abort time of 20mins. This can be avoided by assigning a client task or you'll need to raise the default abort time (it's in the tab where you schedule the task, it's called "options")

Was my reply helpful?
If this information was helpful in any way, or answered your question, will you please select "Accept as Solution" in my reply, or give kudos as appropriate, so together we can help other members?
McAfee Employee jess_arman
McAfee Employee
Report Inappropriate Content
Message 5 of 9

Re: Cannot initiate On-Demand Full Scan from ePolicy Orchestrator

Jump to solution

@Ting_Chung In line with chealey's response, your current ODS task behavior via Run Client Task Now is expected behavior as it does have a default timeout period. The type of Client Task assignment that you will want for your purposes is to take the ODS Scan Task that you want to run, assign it to the system of issue with a schedule for "Run Immediately". Then, once assigned, you can send a McAfee Agent wake-up call to the endpoint to have the scan invoke right away. You should then see the task runs completely instead of timing out.

 

Was my reply helpful?

If this information was helpful in any way, or answered your question, will you please select "Accept as Solution" in my reply, or give kudos as appropriate, so together we can help other members?

8 Replies

Re: Cannot initiate On-Demand Full Scan from ePolicy Orchestrator

Jump to solution

Hello,

the way you start the on demand scan is correct.

Think you have to check out the logfiles on the client for more information.

C:\ProgramData\McAfee\Endpoint Security\Logs

But personally, I would not leave a malware-infected computer on the lan.

 

 

Re: Cannot initiate On-Demand Full Scan from ePolicy Orchestrator

Jump to solution

Hi,

Thanks for reply. The reason I need to perform this is because this is a remote site computer and we do not have any local IT support on site, and event log showing the malware is deleted by McAfee, thus would like to issue remote scan to ensure if any further malware hidden and plan for next action.

McAfee Employee chealey
McAfee Employee
Report Inappropriate Content
Message 4 of 9

Re: Cannot initiate On-Demand Full Scan from ePolicy Orchestrator

Jump to solution

I would not suggest running an ODS task via a run client task now. This is because run client task now tasks have a default abort time of 20mins. This can be avoided by assigning a client task or you'll need to raise the default abort time (it's in the tab where you schedule the task, it's called "options")

Was my reply helpful?
If this information was helpful in any way, or answered your question, will you please select "Accept as Solution" in my reply, or give kudos as appropriate, so together we can help other members?
McAfee Employee jess_arman
McAfee Employee
Report Inappropriate Content
Message 5 of 9

Re: Cannot initiate On-Demand Full Scan from ePolicy Orchestrator

Jump to solution

@Ting_Chung In line with chealey's response, your current ODS task behavior via Run Client Task Now is expected behavior as it does have a default timeout period. The type of Client Task assignment that you will want for your purposes is to take the ODS Scan Task that you want to run, assign it to the system of issue with a schedule for "Run Immediately". Then, once assigned, you can send a McAfee Agent wake-up call to the endpoint to have the scan invoke right away. You should then see the task runs completely instead of timing out.

 

Was my reply helpful?

If this information was helpful in any way, or answered your question, will you please select "Accept as Solution" in my reply, or give kudos as appropriate, so together we can help other members?

Re: Cannot initiate On-Demand Full Scan from ePolicy Orchestrator

Jump to solution

Thanks both @jess_arman  @chealey for the assist.

I tried to run the task but would like to know how to monitor and check the task status. Created a query using "Applied Client Tasks" from "Queries and Reports" to track but seems no data captured. 

 

McAfee Employee chealey
McAfee Employee
Report Inappropriate Content
Message 7 of 9

Re: Cannot initiate On-Demand Full Scan from ePolicy Orchestrator

Jump to solution

You can refer to this KB article in regards to creating a query to show the ODS status:

https://kc.mcafee.com/corporate/index?page=content&id=KB87752

 

One thing to note - only policy based tasks will create these events.

Was my reply helpful?
If this information was helpful in any way, or answered your question, will you please select "Accept as Solution" in my reply, or give kudos as appropriate, so together we can help other members?
Highlighted

Re: Cannot initiate On-Demand Full Scan from ePolicy Orchestrator

Jump to solution

Many thanks for all the support !!

McAfee Employee jess_arman
McAfee Employee
Report Inappropriate Content
Message 9 of 9

Re: Cannot initiate On-Demand Full Scan from ePolicy Orchestrator

Jump to solution

@Ting_Chung Anytime! Glad we could help 🙂

 

More McAfee Tools to Help You
  • Subscription Service Notification (SNS)
  • How-to: Endpoint Removal Tool
  • Support: Endpoint Security
  • eSupport: Policy Orchestrator
  • Community Help Hub

      New to the forums or need help finding your way around the forums? There's a whole hub of community resources to help you.

    • Find Forum FAQs
    • Learn How to Earn Badges
    • Ask for Help
    Go to Community Help

    Join the Community

      Thousands of customers use the McAfee Community for peer-to-peer and expert product support. Enjoy these benefits with a free membership:

    • Get helpful solutions from McAfee experts.
    • Stay connected to product conversations that matter to you.
    • Participate in product groups led by McAfee employees.
    Join the Community
    Join the Community