We track compliance of McAfee EPP & EPE for many machines. While tracking down defects, we found out that that EPO console displays "Unknown" under Firewall Status (Host IPS) for few machines. Have googled for finding out the root causes or if there is any patch issue but found none. Did hit and trial with HIPS services, McAfee agent GUID regeneration. None helped. :-(
The McAfee agent is running properly on the machines and is reporting to EPO everyday. McAfee agent version is 4.8. Yet, the "Unknown" issue persists. Someone, please help out.
Thanks in advance!
Try running the ePO Server task "Host IPS 8 Property Translator" task manually (leave it Disabled; just run it manually once) and see if the data gets updated properly.
No luck in this. "Host IPS 8 Property Translator" we run manually everyday. Issue got resolved automatically after few days and we do not know how it happened. I wish I knew.. :-(
I hate it when EPO fixes itself...you just sit there waiting for the next time it freaks out...
Earlier I posted a HIPS Product Codes dashboard here in the community, try importing that into your EPO and look at the
Also License Status, Service Running...etc....it may point to something.
Also Check the "Events" folder on your EPO to see if there are any events backing up.
Thanks for the dash. It's showing what my queries show - IPS Product status, Service Running Status, and Host IPS Status all show UNKNOWN.
This happened to one server but resolved itself after that one was rebuilt from scratch. Now I have another server (on a totally different net) showing the UNKNOWN status.
UNKNOWN as well.
I know my policies are set to Enabled on both. If I drill down into the individual systems within the ePO and look at Products, I can see both are Enabled.
I found in both cases after a MS SQL update got applied, the problem went away. I'd like to include the actual update but I don't have access to the server console.