Just recently we are having an issue with HIPS installing on new laptops through ePO. The user keeps getting the message to Reboot To Complete the Installation Of HIPS but the product is not installed. When I look in the Protection Access Log I see that it is being blocked by an Access Protection policy. Prevent modification of McAfee files and settings. The executable that is being blocked is C:\Program Files\McAfee\VirusScan Enterprise\mfehidin.exe, however this is included as an exclusion in my policy. I have disabled that policy and now it seems to be working. That is not an acceptable fix as we need that option checked. Any ideas please. Thank you.
Solved! Go to Solution.
If this is reproducable, please open a support case and provide 'steps to reproduce', product versions etc. and ask that the SR be escalated to Tier 3 so we can get this looked at.
I will setup a test environment for this request as I had to disable the policy because it was affecting our production environment. I am also waiting on a new grant number from McAfee as our expired and Italy only recently renewed the contract. Once I get those two things in order I will open the case. I was curious if anyone else had this issue. I can safe the access protection log from one of the laptops that was having the issue. Thank you for your response.
I'm wondering if it might be related to this issue:Message was edited by: Mal09 on 08/04/10 16:18:17 GMT
Thinking about this more, the technote above probably isn't the same issue as it only refers to the CMA components in it. But I suspect the issue is something similar.
I just wanted to let you know that we are seeing this type of issue as well - though right now it seems it might be only on certain newer model laptops.
Example errors from AP log:
4/8/2010 4:26:20 PM Blocked by Access Protection rule NT AUTHORITY\SYSTEM C:\Program Files\McAfee\Host Intrusion Prevention\hipscore\mfehidin.exe \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\mfehidk\InstallReference.C__Program_Files_McAfee_Host_Intrusion_Prevention_hipscore_mfehidin.exe Common Standard Protection revent modification of McAfee files and settings Action blocked : Delete
4/8/2010 4:26:20 PM Blocked by Access Protection rule NT AUTHORITY\SYSTEM C:\Program Files\McAfee\Host Intrusion Prevention\hipscore\mfehidin.exe \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\mfetdik\Inst
Andrew this is exactly the issue I am having. I had to disable the Access Protection option under Common Standard Protection "Prevent modification of McAfee files and settings".
This started happening last week. Prior to that everything was working fine. We are having the issue on laptops that don't have HIPS installed and are installing it for the first time through epo.
I do not have a valid grant number yet or I would open a case with McAfee. That's another story. Thank you.
I am experiencing the same issue, Says common standard protection : prevent modification of mcafee files and settings is blocking my hips install from my epo server. I've temp disabled the AV rule and will report back with outcome.