ENS 10.7 Questions Endpoint Upgrade Assistant and HIPS

[ccastbr]

Hi 

I have ePO 5.10 with Update 6.   Windows systems are running MA 5.6.2, ENS 10.6.1 Dec, and HIPS 8 P14.

I have ENS 10.7, May update  (or April extensions and May packages)

I was expecting a conflict with HIPS and was told installation of ENS 10.7 would disable HIPS, but if I install ENS FW, I could then disable it and enable HIPS.

I installed (assigned client task - run-now) ENS 10.7 Threat Prevention on a server 2012R2 system with HIPS and ENS 10.6.1 Dec, and although it took a little time, it installed find and appears to be working.  I am not seeing an issue.  

I attempted an install (assigned client task - run now) of ENS 10.7 Threat Prevention on a server 2016 build 14393 which failed.       That server had the same compliment of McAfee installed.

I also tried to use the Endpoint Update Assistant, but it would not check for 10.7.  It is only checking for 10.6.x       I have the Endpoint Update Assistant extension 2.4.0.61, and it is running. 

Should there have been an ENS/HIPS conflict to work around?

Is there in incompatibility with Server 2016?

Should Endpoint Update Assistant support ENS 10.7?

Thank you! 

[ccastbr]

OK - I upgraded the Endpoint Upgrade Assistant to 2.7 and it works perfectly for 10.7.    It reported that both of the servers, 2016 and 2019 should be ok for upgrade.

I put tags and assigned client tags to both.   It appears to be fine on the 2016 server.  I have to check the 2019 yet.     The process takes quite a while, and perhaps that is why the "run now" failed by just timing out. ?  

So I am only left with the question of HIPS and whether I should expect any interaction issues.

[hnegishi · Accepted solution]

Hi @ccastbr 

Thank you for posting on the Community. We apologize for being late in answering you.

There are description about ENS Firewall and HIPS in ENS 10.7 install guide

"Note: Host Intrusion Prevention can run alongside Endpoint Security. Whenever McAfee Host IPS Firewall is installed and enabled, Endpoint Security Firewall is disabled, even if enabled in the policy settings."

https://docs.mcafee.com/bundle/endpoint-security-10.7.x-installation-guide-windows/page/GUID-012AB11...

The HIPS modules will take precedence over the ENS modules. If you have both products installed, disable the HIPS modules if you want the ENS modules to be enabled. If you want to switch back to HIPS, then just enable the HIPS modules again, and it will automatically disable the ENS modules.

In case you have experienced upgrade failure, we would recommend whether this issue still persists using schedule task.

[ccastbr]

Thank you.   Yes everything worked as expected, however, this is what triggered my question.       Since I have HIPS 8 P14 and was installing ENS 10.7, I was prepared to take the work-around steps.  I did not have to.

"The HIPS Firewall and HIPS Network IPS settings are disabled after installing ENS 10.6.1 February 2020 update and rebooting. This issue is seen with ENS 10.6.1 and ENS 10.7 with HIPS 8 P14. A workaround is to install the ENS Firewall. After the installing the ENS Firewall, the ENS Firewall can be disabled which allows the HIPS Firewall and HIPS Network IPS to function correctly."

Perhaps the issue was resolved with the ENS 10.7 May HF?   I have rebooted, and everything still seems to be running as expected.  No work-around needed.