I was wondering if anybody else has experienced problems to keep a scheduled scan (in my case a monthly one, 2nd monday of each month) to run prperly on all systems.
I noticed this time around that most systems, including my own are not automatically doing the Scan as set int he scheduled task. Just a couple of system seem to be doing it but it looks highly unreliable.
Has anybody experienced anything similar?
I'm actually just looking at this now - thank goodness I'm not alone.
We have multiple systems (Windows 2012, Windows 2012R2, Windows 7, Windows 10) failing to run their scheduled scans whether Quick / Full (scheduled using the default McAfee tasks created in the original installations). Out of 14 systems only 2 are triggering scans.
Looking at the OnDemand_Activity.log I've traced this failure back to August this year. We deployed ENS in late 2017 and these scans had been running without issue.
There are no indications of errors in event logs etc. as to why the scans have simply stopped being triggered.
We're on ENS 10.6.1.1068, with Threat Prevention and Web Control deployed to laptops, and Threat Prevention only deployed to servers. All standalone installations (no EPO).
I've a ticket raised through our vendor at the moment but it's clearly not something that they have dealt with previously.
There are a number of different reasons for an ODS task to be missed, including system not running, ENS not in a healthy state, various known issues with MA depending which version you are running.
If you look at the masvc log (in %Programdata%\Mcafee\Agent (or Common Framework)\Logs and look for your task name, you will see next scheduled time. If this time has passed and the time has just been moved on, you may want to raise an SR with our McAfee Agent team. If the task has failed, then you can look at the ENS logs/ console - check everything is running fine i.e. does it detect an EICAR? are there any "ENS not running" warnings? If all is fine, you can further check the On-Demand Scan logs (also found in Programdata\Mcafee\ENS) and look for any failures. If you raise an SR, please supply a MER file so we can assist as soon as possible!
We have only 2 machines unaffected by this issue which appears to have started around the time of our 10.6.0 update rollout in August of this year, and the issue affects all our platforms (Windows 7/10, Windows 2012 / 2012 R2).
3 of the machines affected exhibit random 'unhealthy' ENS states when started that can be cleared with a reboot.
Scheduled scan tasks that are newly created are unaffected, however the default Quick and Full scan tasks are effectively dead on all affected machines.
On Access scans appear unaffected.
No visible entries in the logs or event viewer.
MER files have been submitted via our vendor.
I have an extended overview of that issue so let me know if you need something to check from my investigation. I would be happy to assist or test something for you.
It would be great if you can confirm my findings.
I made some testing and I need to verify with you the following things:
1. Do you use ePO or you see such issues only with the Standalone installations of ENS?
2. After you saw scans did not run, did you check the scan schedule is active or it was not editable?
3. Can you describe with few steps your version history and what was tested?
I am asking because my tests so far seem to provide some details about that issue.
For the time being there is not an official article but to be honest it seems McAfee are more focused on the managed endpoints(ePO managed) than the Standalone installations - I have not seen articles in the Knowledge Center refering to fixes only for standalone instances because usually they just make faulty ones unavailable from the product site and release newer version with every next release. Probably not the best strategy but that is their way.
Now let me share my findings and hopefully provide proper direction for further troubleshooting.
These were results of my testing in my lab, trying to recreate the issue:
1. I installed the 10.6.0 package from the scratch and it had the default scan properly set with default values so built in scans worked fine after few tests.
2. After that I did new test upgrading 10.5.5(this was the only older version available for me from the product site dated October) to 10.6.0 and it did not work fine - it was almost completely unusable with locked interface and no option to review all default settings as you can see below.
3. I also tried to upgrade both brand new 10.6.0 and corrupted one to 10.6.1 which seems to improve the situation drastically. I was then able to run, reschedule and enable scan tasks but they were all disabled by default except the client update task.
4. All of the tests above did not affect the common client update task
So far the only known workaround is to update/reinstall latest ENS available version and re-enable default scan tasks schedule or simply create custom scan tasks instead McAfee-defined ones.