I had a machine that was newly imaged and received HIPS 126.96.36.1999 from the ePO server. When the machine was transported to another facility for installation the machine would not get an IP from any jack within the facility. I noticed in the Device Manager there was an warning about a WAN Miniport (IP) - McAfee NDIS Intermediate Filter Miniport. The warning stated that "Windows cannot load the device driver for this hardware. The driver may be corrupted or missing. (Code 39) I have attached some screenshots. In the Driver you can see it references 188.8.131.525 as the version. There also seems to be an additional Service listed called McAfee HIPSCore Service that is set to Automatic but it is not running. Is this a holdover from HIPS 184.108.40.2065? If so how did it get there when HIPS 220.127.116.119 was the only HIPS version installed? Thanks.
Message was edited by: kink80 on 3/21/12 2:21:30 PM GMT-06:00Message was edited by: kink80 on 3/21/12 2:23:28 PM GMT-06:00
This is a HIPS 7.0 driver and service. It appears as though HIPS 7.0 was installed on this system as some point and probably not removed properly.
So is the driver version consistent with the HIPS version that was installed? Also will this remnant of HIPS 7 cause any issues? If so how would I go about removing the remaining pieces of HIPS 7?
HIPS 8.0 does not install these driver versions, so yes, HIPS 7.0 was installed at some point. I'm not sure if it would cause any issues, but if it did, you might see network connectivity issues. Best to remove all the HIPS 7.0 items, to be sure.
Performing a manual removal of HIPS 7 is not an easy task especially if my preliminary odds of failure hold for my entire enterprise. Roughly 1-2% of the machines I have upgraded from HIPS 18.104.22.1689 to HIPS 22.214.171.1249 have had issues. Either this issue where parts of 7.0 remain and have blocked all Ethernet traffic or during the installation of HIPS 126.96.36.1999 the machine restarts. I have about 12,000 machines so that would mean 120-240 machines would have to be physically touched and repaired. Some of these machines are also in a I cannot pinpoint what makes one machine fail while another works just fine so troubleshooting is rather problematic. Would there be anyway to try to improve the odds of success.
I have a solution to remove the NDIS driver.
Once removed from Device manager and the system is rebooted I found that any network issues found were fixed.
In regedit navigate to:
Do a search in regedit from this point for McAfee NDIS Intermediate driver
In the item view the Characteristics value.
Change Characteristics with the value of 0x00000029(41) to 0x00000001(1)
Go back into Device Manager and remove the NDIS Driver as normal. Reboot the system.
Please do the above at your own risk.
I'm experiencing problems with my VPN connection. I was upgraded from HIPS 7 to HIPS 8 and can no longer VPN. I followed your instruction and was hoping this would solve our problems. I changed the value of Characteristics from 29(41) to 1(1) on the McAfee NDIS Intermediate drive, then removed the Cisco Systems VPN Adapter - McAfee NDIS Intermediate Filter Miniport. This didn't fix my VPN problem. However, my Device manager still shows other NDIS devices? we tried deleting them, couldn't delete them, we tried changing the Characteristics value to 1(1) and then deleting them but that didn't work. Then we stop the HIPS service and tried to delete them, no luck.
I have 2 questions:
Should all NDIS device adapters be removed? If this is yes, How?
Any other suggestions would be appriciated.
I would apply this hotfix, and see where it leaves you... https://www.google.com/#hl=en&biw=981&bih=615&sclient=psy-ab&q=HIPS+8+patch+2+803520+release+notes&o...
The release notes mention a fix for VPN issues. I would be really curious too if it clears up the WAN Miniport drivers that are faulted in your device manager screenshot. Please provide some feedback.