Cannot initiate On-Demand Full Scan from ePolicy Orchestrator

[Ting_Chung]

We identified a machine has malware detected and would like to initiate a On-Demand Full Scan from ePolicy Orchestrator but failed. Tried to initiate the job by click the machine, Action -> Agent -> Run Client Task Now -> Select Product Endpoint Security Threat Prevention -> Policy Based On-Demand Scan -> On-Demand Scan - Full Scan to start the job. However status expire at 10 - 15 mins around and the job was stopped. Please advise what is best practices and requirement to perform a scanning task remotely. Thanks.

[Stefan80]

Hello,

the way you start the on demand scan is correct.

Think you have to check out the logfiles on the client for more information.

C:\ProgramData\McAfee\Endpoint Security\Logs

But personally, I would not leave a malware-infected computer on the lan.

[Ting_Chung]

Hi,

Thanks for reply. The reason I need to perform this is because this is a remote site computer and we do not have any local IT support on site, and event log showing the malware is deleted by McAfee, thus would like to issue remote scan to ensure if any further malware hidden and plan for next action.

[chealey · Accepted solution]

I would not suggest running an ODS task via a run client task now. This is because run client task now tasks have a default abort time of 20mins. This can be avoided by assigning a client task or you'll need to raise the default abort time (it's in the tab where you schedule the task, it's called "options")

[jess_arman · Accepted solution]

@Ting_Chung In line with chealey's response, your current ODS task behavior via Run Client Task Now is expected behavior as it does have a default timeout period. The type of Client Task assignment that you will want for your purposes is to take the ODS Scan Task that you want to run, assign it to the system of issue with a schedule for "Run Immediately". Then, once assigned, you can send a McAfee Agent wake-up call to the endpoint to have the scan invoke right away. You should then see the task runs completely instead of timing out.

Was my reply helpful?

If this information was helpful in any way, or answered your question, will you please select "Accept as Solution" in my reply, or give kudos as appropriate, so together we can help other members?

[Ting_Chung]

Thanks both @jess_arman  @chealey for the assist.

I tried to run the task but would like to know how to monitor and check the task status. Created a query using "Applied Client Tasks" from "Queries and Reports" to track but seems no data captured. 

[chealey]

You can refer to this KB article in regards to creating a query to show the ODS status:

https://kc.mcafee.com/corporate/index?page=content&id=KB87752

One thing to note - only policy based tasks will create these events.

[Ting_Chung]

Many thanks for all the support !!

[jess_arman]

@Ting_Chung Anytime! Glad we could help 🙂