ePO is showing modules missing (Policy Auditor and HIPs) after upgrading systems to McAfee Agent 220.127.116.11 from 18.104.22.1688.
I am 100% certain the modules were installed prior to upgrading the McAfee Agent. Also it only occurs randomly to some systems, but not all. If I send a task to reinstall the module(s), it completes very quickly, but does not report the module as being installed.
Thank you in advance.
Thanks for your post!.
Please open a Service Request with the Support so they can check and let you know what exactly is happening on the client machine.
Was my reply helpful?
If you find this post useful, please give it a Kudos! Also, please don't forget to select "Accept as a Solution" if this reply resolves your query!
Thank you for posting your query
May I know what is the version of ePO, HIPS and Policy Auditor
Could you check if the extensions are installed on ePO server are compatible as per the below table and KB Articles
For ePO 5.10 - KB article is https://kc.mcafee.com/corporate/index?page=content&id=KB90383
|McAfee Product Name||Extension Name||Minimum||Minimum||Extension Display Name in ePO 5.10.x|
|Policy Auditor (PA)||AUENGINEMETA||6.4.0||22.214.171.124||Benchmark Editor Content Distributor|
|Host Intrusion Prevention System (Host IPS)||HOSTIPS_8000||8.0.11 Hotfix 1226541||126.96.36.1998||Host Intrusion Prevention 8.0.12|
|(Windows and non-Windows)||HostIpsAdv||Host IPS Advanced|
|HostIPSLicense||Host IPS License|
|Product Name||Extension Name||Minimum||Minimum||Extension name displayed in ePO 5.9.x|
|Policy Auditor (PA)||AUENGINEMETA||6.2.2||188.8.131.52||Benchmark Editor Content Distributor|
|Host Intrusion Prevention System (Host IPS)||HOSTIPS_8000||8||184.108.40.2062||Host Intrusion Prevention 8.0.0|
|(Windows and non-Windows)|
|HostIpsAdv||220.127.116.112||Host IPS Advanced|
|NOTE: Host IPS 8.0 Extensions before build 18.104.22.1688 can't be installed and does not support ePO 5.1...||HostIPSLicense||22.214.171.1242||Host IPS License|
Thank you for your post! Apologies to barge in, I was going through the post and responses and I can sense some ambiguity here. May I please confirm that you are referring to client side components when you say "modules" missing?
I see that you have also mentioned that you did "send a task to reinstall the module(s)" and hence I assume this is not an ePO side issue, rather, you find some client components are missing after upgrading your McAfee Agent program on the machines right?
If this is the observed behavior, I would urge you to create a Service Request after capturing logs, however, I would like to investigate this with you on this post if it is alright with you.
Here is what my plan of action is:
You have mentioned some modules have been missing and hence I am assuming that it would have happened via an "uninstallation" action on the machine. Uninstallation actions should definitely have their corresponding Log files on the machine. If the uninstallation was carried out via the ePO, we need to first find the task involved. Audit log form ePO should show us if there was any product deployment (also used for Product uninstallation) task recently deployed on any machines.
If it was a run now task, you should be able find the details in "Server Task Log"
The uninstall logs should be present in C;\Windows\Temp\McAfeeLogs\ if the action was carried out via ePO. However, if this was locally done via control panel, the logs should be available in the corresponding user account's temp folder (%temp%\McAfeeLogs). Since you see it on many machines, my bet is on an ePO deployed task.
The easiest method of finding out what task caused the uninstallation from the client end would be form the masvc.log found in C:\programdata\McAfee\Agent\logs, but, sadly you will not find more than 2 to 3 days worth events in this log files and assuming you reported this in Community in less than few hours after noticing this and you see my post now and act upon it immediately, you may get to see the tasks involved form the masvc.log. Kindly please check if you have mcscript.log and McScript_deploy.log and if you have them, please attach them here.
Please note that these log files can contain sensitive information that you may not wish to reveal to the public. Kindly please sanitize the log files before sharing it here. If you wish to share it with tech support only, then please feel free to create a support ticket with us for product: McAfee ePolicy Orchestrator or McAfee Agent.
This post can be moved to this forum for better visibility to experts and for their involvement and suggestions. I sincerely hope this gives a good start to where to look at.