I'm getting this third hand, so bear with me.
Our helpdesk has created a Windows XP SP3 Pro image (via Ghost). The image has the EPO agent and VSE 8.7i installed on it. Prior to "sealing" the image, they removed the GUID thingy so that EPO works fine.
What they claim is happening:
After putting the image onto a new machine, it comes up and SYSPREP asks the user for some information and then tries to join our AD domain. It fails every time (or so they say).
If they remove VSE 8.7 (leaving ePO still on), SYSPREP works fine
If they use their previous image (which has VSE 8.5i on it), SYSPREP works fine.
I'm not sure if it's really VSE causing SYSPREP to not work (I have no idea what logs would even exist prior to the machine being setup properly to show this).
VSE is installed with most default settings, and then the EPO agent pulls down the config info which has our VSE 8.5 policies migrated to VSE 8.7 policies (and there's some subtle differences like the Artemis stuff), but I'm not doing any port blocking that I'm aware of that would prevent SYSPREP from joining a machine to a domain.
I searched the forums here and it seems that it SHOULD work without any extra steps (aside from the EPO GUID thing).
Well we're now thinking that it's either:
the mfehidk.sys driver
or the mfevtp service that's causing this.
1) PC with VSE 8.5 installed with the sysprep works fine
2) PC with VSE 8.7 installed with sysprep fails to even get to join the domain
3) Same PC in #2, but remove VSE, and re-sysprep it and it works fine
I tried disabling the McAfee services, and the ONLY one I couldn't disable was the MFEVTP (error 5, access is denied). (you cannot stop/disable this in the services.msc no matter what you do in the VirusScan Console or even if AP is disabled).