McAfee Endpoint Security for Mac (ENSM) 10.6.6 failed to update DAT on macOS 10.15.1

[Eggie_Reg]

Hi, I have a personal Macbook Pro but I have to run a Company security access software for working at home. My company's security policy requests McAfee Endpoint Security for Mac (ENSM)  must be installed and DAT must keep up-to-date. But I don't need to work at home everyday so I don't update DAT frequently.

my Macbook Pro ran on macOS 10.13.x in Nov 2019. A previous ENSM version (I can't remember the exact release no., for sure it is early version before 10.6.6) was working well at that time.

But DAT failed to update when I tried on Dec 1st, 2019. I checked company's intranet and found ENSM release 10.6.6. But 10.6.6 needs to run on macOS 10.15. So I did the following steps.

1) Upgrade macOS to 10.15.1 without uninstall old ENSM.

2) Install ENSM 10.6.6 directly after upgrade complete.

Then I found "Threat Prevention" can't be enabled correctly, which made the ENSM status abnormal. And I can't unlock "Preferences" menu, which always prompt the password I input was wrong.

I had to follow the KB88461 (https://kc.mcafee.com/corporate/index?page=content&id=KB88461) to uninstall ENSM. I reinstalled ENSM 10.6.6. This time "Threat Prevention" can be enabled through "Preference" menu. And the status icon in the menu bar seems OK.

But when i tried to Update DAT, a "Update Error" will prompt. And the update bar seems on-going but actually dead.

I have tried several times to repeat uninstall and install but the error keeps.

Full Disk Control has been granted to relevant process.

I have attached /var/log/McAfeeSecurity.log in this post.

Can anyone help me?

***********************OS and ENSM Release info*******************

macOS Catalina 10.15.1

MacBook Pro (Retina, 13-inch, Mid 2014)

********

[Eggie_Reg]

I forgot to upload /var/log/McAfeeSecurity.log so reload it now. I have to zip it to *zip according the policy of uploading attachment.

[gururaj]

from the provided logs and screen shot the McAfee Agent is not running on the machine. or it is not installed properly 
Dec 2 17:25:39 XIAOs-MacBook-Pro McAfee: [187]: Info: LogTime: 2019-Dec-02 17:25:39 EventManager::handleFMMessage - Got a EVENT_REGISTRATION message from 5
Dec 2 17:26:06 XIAOs-MacBook-Pro McAfee: [187]: Info: LogTime: 2019-Dec-02 17:26:06 AVAS: PID: 173 : In ScanFactory::initialize(), m_EngineInitStatus : 0
Dec 2 17:28:23 XIAOs-MacBook-Pro McAfee: [187]: Info: LogTime: 2019-Dec-02 17:28:23 AVAS: PID: 173 : Child Scanner with 793 exited
Dec 2 17:33:01 XIAOs-MacBook-Pro McAfee: [187]: Info: LogTime: 2019-Dec-02 17:33:01 AVAS: PID: 147 : Stopping eUpdate.
Dec 2 17:33:01 XIAOs-MacBook-Pro McAfee: [187]: Info: LogTime: 2019-Dec-02 17:33:01 AVAS: PID: 147 : Deleting all eUpdate Session objects
Dec 2 17:33:01 XIAOs-MacBook-Pro McAfee: [187]: Info: LogTime: 2019-Dec-02 17:33:01 AVAS: PID: 147 : Starting eUpdate
Dec 2 17:33:53 XIAOs-MacBook-Pro McAfee: [187]: Info: LogTime: 2019-Dec-02 17:33:53 FMPController Started
Dec 2 17:33:53 XIAOs-MacBook-Pro McAfee: [187]: Alert: LogTime: 2019-Dec-02 17:33:53 AVAS: PID: 193 : KextEventProvider:MDM Profile could not be found on Machine
Dec 2 17:33:53 XIAOs-MacBook-Pro McAfee: [187]: Info: LogTime: 2019-Dec-02 17:33:53 EventManager::handleFMMessage - Got a EVENT_REGISTRATION message from 100
https://kc.mcafee.com/corporate/index?page=content&id=KB86785 use this KB to collect the Agent information.  

[gururaj]

https://kc.mcafee.com/corporate/index?page=content&id=KB84934 check the supported agent version is installed on the mac mcahine.

[Eggie_Reg]

Dear Gururaj,

I have run the script on my MBP.  The output file indicates the Agent version is 5.6.2.209.

The whole zip is attached for your reference.

Regards,

[gururaj]

The ma process are not running on the machine. can check the status of the agent in the agent status monitor and execute the below commands. is agent installed from you office epo server ?   

StartCommand>/Library/McAfee/agent/scripts/ma status 

StartCommand ##/Library/McAfee/agent/scripts/ma start

[Eggie_Reg]

XIAOs-MBP$ /Library/McAfee/agent/scripts/ma status

Password:

Sorry, try again.

Password:

McAfee agent service is not running.

McAfee common service is not running.

(base) XIAOs-MBP:$ /Library/McAfee/agent/scripts/ma start

Starting McAfee common services... [OK]

Starting McAfee Agent services... [OK]

(base) XIAOs-MBP:$ /Library/McAfee/agent/scripts/ma status

McAfee agent service is not running.

McAfee common service is not running.

***********

I just tried the two commands. But it failed to start.

Yes, I download the installation package from my company's intranet, which should upload by our IT dept.

The package includes all components for ENSM 10.6.6.

[gururaj · Accepted solution]

uninstall the prdouct # #sudo /usr/local/McAfee/uninstall EPM

# #/Library/McAfee/agent/scripts/uninstall.sh

Reboot the mac machine. install the agent Agent pacakage first which is provided by the company then the install ENS 10.6.7 the standalone version. 

[Eggie_Reg]

Dear Gururaj,

I have contacted my company IT dept and got a standalone Agent package for installation (install.sh).

I did the following step to uninstall the ENSM.

1) #sudo /usr/local/McAfee/uninstall EPM

2) #sudo /Library/McAfee/agent/scripts/uninstall.sh

But the application seems still running. So I continued with the steps from KB88461 (https://kc.mcafee.com/corporate/index?page=content&id=KB88461)

3)  Go to safe mode of macOS.

4) sudo su

NOTE: When prompted, type the administrator password.
 
cd /usr/local/
rm –rf McAfee/
cd /Library/Application\ Support/
rm –rf McAfee/
cd /Library/LaunchDaemons/
rm –rf com.mcafee.*
cd /Library/LaunchAgents/
rm –rf com.mcafee.*
cd /Library/Preferences/
rm –rf com.mcafee.*

**************

Then I reboot the mac and start the installation as your suggested

1) Install the standalone Agent (install.sh)

2) Install the ENSM 10.6.6 (IT dept. cannot provide 10.6.7)

3) Reboot the Mac

Now the update is OK.

Thank you very much.