Endpoint Security Threat Prevention Policy Check for Qualys

[User30580749]

We are using Qualys to do policy checks for AV on our servers. we need to check for ENS Threat Prevention and have a couple of questions. First, can Threat Prevention run without Endpoint Security Platform being installed? If so, do we only need to verify that mfeetp.exe is running on the server to verify that Threat Prevention is running?

[mmuthuga · Accepted solution]

Threat Prevention will not run\install without Endpoint Security Platform being installed. You can check mfeesp.exe and mfetp.exe  or if only mfetp.exe are running to verify that Threat Prevention is running

[chealey · Accepted solution]

To add to @mmuthuga comments. To check if the processes are running correctly, it's best to run the command listed in this KB article: https://kc.mcafee.com/corporate/index?page=content&id=KB85374

It will give you the true status of the services as these are all managed by our mms service.

[zuku]

@mmuthuga you mentioned that "Threat Prevention will not run\install without Endpoint Security Platform being installed. "

this is strange because Default Endpoint Security deployment task do not have inside included "Endpoint Security Platform" and I deployed this task for some PC and my Threat Prevention is running. Please look at this default task.

[mmuthuga]

Hi @zuku 

The deployment is through ePO and "Endpoint Security Platform" is present in ePO master repository, even when "Endpoint Security Platform" is not selected it will be installed first followed by selected ENS module. When installing ENS using standalone package by running setupEP.exe, only ENS modules are visible to be selected and "Endpoint Security Platform" will be installed before installing the selected ENS modules. You can check the "Endpoint Security Platform" process mfeesp.exe is running on client.

If  you are trying to install threat prevention manually using setupTP.exe, you will first need to install "Endpoint Security Platform" by running setupcc.exe.