HIPS 8.0 Showing Installed in Log but not installing

[razsecure]

Hi all,

I'm having an issue right now in a lab environment trying to install Hips 8.0 on our EPO Server. HIPS has been installed successfully on every other end point, but when I attempt to push it to the EPO it runs the task, the agent status says that HIPS 8.0 was installed successfully and prompts for a restart, but the product is not installed. I went one step further and checked during the install and it creates the folder within C:/Program Files/Mcafee for hips but after it "finishes" the install the folder is deleted. Any help would be greatly appreciated.

Thanks 

[YashT]

Hello @razsecure ,

If you are running the task from EPO for HIPS installation, you should first start with masvc and mcscript files which will log task invoked and ran details that will give you failure information.

The logs are found in C;\programdata\mcafee\agent\logs\

[chealey]

Hi @razsecure 

To add to what's already been suggested. I would advise looking at the actual install logs created and checking that it says successfully installed - we should see a return code 0 or 3010 (reboot required).

The log can be found C:\Windows\Temp\McAfeeLogs 

[razsecure]

@chealey 

Thanks for the info, I looked into the logs and I'm seeing an install error code of 1603, which indicated there was already an install of HIPS on the device, even though I'm definitely not seeing the installation. 

[YashT]

Hello @razsecure ,

Error 1063 is the generic error message, please verify if there is  a recent install log created on windows temp location within McAfee folder or verify the agent logs for any install failure. The logs are found in C;\programdata\mcafee\agent\logs\  McScript in specific.

Also please share the Masvc and McScript log in private message, I will help you analyzing same.

[chealey]

Hi @razsecure 

Oh interesting that it's reporting a version already reported. Take a look in the following registry locations if you see an entry for HIPS:

HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Network Associates\ePolicy Orchestrator\Application Plugins

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall

[razsecure]

@chealey 

I checked both locations and there is no entry for HIPS.

@YashT 

I will get those logs pulled and message them to you sometime today.

Thanks for the help. 

[ZGreen]

Within the ePO do an uninstall task for HIPs on that system. If it says successful reboot and try the install. Let me know if that works. 

[razsecure]

Hi @ZGreen 

I've run that task, as well as an uninstall task for ENS so I can get the agent removed. Neither of those did anything, I see the call in the agent monitor for the tasks but It's not seeming to do the trick. I also attempted to uninstall ENS via the uninstall command in the registry and that failed, so I'm unable to remove the agent. 

[ZGreen]

Are you able to wake that system up from ePO wakeup call?