Showing results for 
Show  only  | Search instead for 
Did you mean: 
Reliable Contributor
Reliable Contributor
Report Inappropriate Content
Message 21 of 24

Re: Slow shutdown >2min with HIP

Hi all,

checked not any posting here, but we have a similar problem with a customer. The problem is caused by the McAfee Agent and HIPS/VSE Patch 4. This should be fixed with Patch 5.
You can also try to change from Agent 4.8.x to Agent 4.6.x. This solved the problem at out customer.


Level 9
Report Inappropriate Content
Message 22 of 24

Re: Slow shutdown >2min with HIP

Any update on this?

I have attempted patch 5 also with the latest EPO Agent. I have even rolled back to the old 4.6P3 Agent. I get the same issue.

IPS is disabled, I am only using it as a firewall

McAfee Employee
McAfee Employee
Report Inappropriate Content
Message 23 of 24

Re: Slow shutdown >2min with HIP

Does the issue occur if the FW is enabled with a USE ANY-ANY policy?  Maybe it's due to some type of blocked network traffic.  See "Use the Any-Any rule" in the KB below.

KB67055 – How to troubleshoot a network facing application, or traffic is blocked by Host Intrusion Prevention firewall

Former Member
Not applicable
Report Inappropriate Content
Message 24 of 24

Re: Slow shutdown >2min with HIP


Any update on this issue. I have the same problem during logon or logoff. It takes more than 4 minutes to logoff. I have ;

Windows 10

VSE 8.8 Patch 7

HIP 8 Patch 7

MA 4.8 Patch 3.

I have tried to add the hipmgmt.exe in the low risk processes.

Here is what I get in the application event log ;


Nom du journal :Application

Source :       Microsoft-Windows-EventSystem

Date :         2016-06-20 16:16:40

ID de l’événement :4627

Catégorie de la tâche :Agent de déclenchement

Niveau :       Avertissement

Mots clés :    Classique

Utilisateur :  N/A

Ordinateur :   xxxxxxxxxxx

  Description :

  Le système d’événements de COM+ a expiré en tentant de déclencher la méthode Logon sur la classe d’événements {D5978650-5B9F-11D1-8DD2-00AA004ABD5E} pour le serveur de publication  et l’abonné . L’abonné a échoué à répondre dans un délai de 180 secondes. Le nom complet de l’abonnement est « HIP_Logon" ». La valeur de HRESULT était 80010002.

  XML de l’événement :

  <Event xmlns="">


      <Provider Name="Microsoft-Windows-EventSystem" Guid="{899daace-4868-4295-afcd-9eb8fb497561}" EventSourceName="EventSystem" />

      <EventID Qualifiers="32768">4627</EventID>






      <TimeCreated SystemTime="2016-06-20T20:16:40.000000000Z" />


      <Correlation />

      <Execution ProcessID="0" ThreadID="0" />



      <Security />



      <Data Name="param1">80010002</Data>

      <Data Name="param2">Logon</Data>

      <Data Name="param3">{D5978650-5B9F-11D1-8DD2-00AA004ABD5E}</Data>

      <Data Name="param4">


      <Data Name="param5">


      <Data Name="param6">HIP_Logon</Data>

      <Data Name="param7">180</Data>

      <Data Name="param8">





You Deserve an Award
Don't forget, when your helpful posts earn a kudos or get accepted as a solution you can unlock perks and badges. Those aren't the only badges, either. How many can you collect? Click here to learn more.

Community Help Hub

    New to the forums or need help finding your way around the forums? There's a whole hub of community resources to help you.

  • Find Forum FAQs
  • Learn How to Earn Badges
  • Ask for Help
Go to Community Help

Join the Community

    Thousands of customers use the McAfee Community for peer-to-peer and expert product support. Enjoy these benefits with a free membership:

  • Get helpful solutions from McAfee experts.
  • Stay connected to product conversations that matter to you.
  • Participate in product groups led by McAfee employees.
Join the Community
Join the Community