macOS: Managed ENSM slows down to a halt

[KGAM]

After installing ENSM and Threat Prevention 10.6.5 on macOS Mojave and Catalina our Macs slow down to a halt. The spinning beachball will appear for minutes and all other dialogs on the Mac (like System Preferences, Finder etc.) will become unresponsive. Watching the clock in the top-right corner of the Mac shows that even the seconds stop on the clock. After waiting 30-60 minutes and rebooting a few times the system starts to respond faster but even then we still see long timeouts from McAfee.

We're managing our systems using ePO so first we install Agent 5.6.2 by running the install.sh script from the Terminal and the we install ENSM from the .pkg file.

Kernel Extensions (SKEL) and Privacy Policy Preference Control (PPPC) are configured as required.

ENSM is running in kernel-mode and all Macs are online and able to see the ePO server.

All Macs are freshly installed with (mostly) Catalina and ENSM is the first thing we install on our Macs so the problem shouldn't be related to conflicts with other software.

I'm interested to hear if anybody else are experiencing similar problems since this is pretty consistent for every new Mac we deploy.

Thanks.

[patrakshar]

Hi @KGAM 

Apologies for delay in updating this thread. 

There has been known issue which has been resolved in 10.6.7

https://docs.mcafee.com/bundle/endpoint-security-10.6.7-release-notes-macOS/page/GUID-917C584A-E6DD-...

This looks to me similar to the issue you are experiencing . Can you please download and install 10.6.7 and let me know if the issue still persist? If the issue persist with 10.6.7 then this is a new issue which has been seen before and need further investigation. 

[KGAM]

Thank you for your reply.

I read the release notes for 10.6.7 before posting but since our clients are running in kernel-model and not kextless I wouldn't expect the patch to solve our problem.

Do you think it will?

[patrakshar]

Hi @KGAM 

It will be suggested to use the 10.6.7 on one of the machine first. I have seen multiple environment latest build has resolved the similar problem. If you want to be exactly sure if this is the same problem or not, then we would need to investigate the issue by looking at the logs. In that I would suggest to open  a SR with us so that we can go through the logs and details.

[KGAM]

We'll try and upgrade our agent and client to latest version.

Any logs I can check myself before I submit a support request?