I have what is hopefully a quick question. we have installed HIPS 8.0 on a few laptops and they are experiencing intermittent network drops when connected via VPM. I nothiced in the print route that its using "McAfee Core NDIS Intermediate Filter Miniport" drivers. Am I correct in assuming HIPS 8.0 should NOT be using these drivers? Maybe leftovers froma HIPS 7.0 install/uninstall?
0x1 ........................... MS TCP Loopback interface
0x2 ...e8 9a 8f 08 69 f6 ...... Realtek PCIe GBE Family Controller - McAfee Co
NDIS Intermediate Filter Miniport
0x3 ...00 ff 58 94 e6 87 ...... Juniper Network Connect Virtual Adapter - McAf
Core NDIS Intermediate Filter Miniport
If you check the affected machine do you see any driver remnants for these miniport adapters in Device Manager? I have seen this issue during a HIPS 7 --> HIPS 8 upgrade that does not fully remove the NDIS miniport drivers. Here is another forum post regarding this that might be helpful:
In my experience completely removing HIPS 7 before installing HIPS 8 prevents this issue from occurring. I have not run through any packet sniffing to see failed network communications however, so this gives me ammo for a ticket that I currently have open with McAfee support. I suggest that you do the same to light a fire under the devs to craft up a hotfix.
I nothiced in the print route that its using "McAfee Core NDIS Intermediate Filter Miniport" drivers. Am I correct in assuming HIPS 8.0 should NOT be using these drivers? Maybe leftovers froma HIPS 7.0 install/uninstall?
HIPS 8.0 on Windows XP & 2003 will use the McAfee Core NDIS Intermediate Filter Miniport driver, since these OSes are limited to Microsoft NDIS 5.0 architecture. HIPS 8.0 on Windows Vista and higher will utilize the Microsoft NDIS 6.0 architecture.
HIPS 7.0 uses only NDIS 5.0 architecture drivers, which are named McAfee NDIS Intermediate Filter Miniport.
Thank you for both of your replies. It looks like we have some other issue in play.... We are testing a removal of sygate, installation of HIPS SMS package and we are having issues when the package runs while connected through Juniper VPN... My guess is that we are missing a reboot at some point or installing HIPS while connected via Juniper VPN is not really a good thing.
If you are deploying via SMS, you may want to check if BITS is enabled for this package. With BITS enabled, you should not have any issues as the installation package will fully download to the local client before installation.
Regarding installation/upgrading/removing HIPS, you should not need a reboot to occur to complete installation. I have seen instances where a reboot is called, if the OS is pending reboot from a previous installation or security patch, however.
I responded to another thread here in the forums () that discusses this issue as well. It was in that thread that I found my answer - which was to run McAfee's MCPR clean up tool - which can also be found here: http://download.mcafee.com/products/licensed/cust_support_patches/MCPR.exe
I ran this tool, rebooted and the 2 problem entries in my device manager were gone.
Thanks to Ex_Brit in that thread for making the suggestion and offering the link to the executable.
Hope this helps someone....