Although it's not clear from the Best Practices guide, you can also improve performance on DAT update by disabling the scan of processes on enable.
VSE On-Access General Policies
On the General tab, uncheck 'Processes on enable'.
The Best Practices guide talks about how impacts performance on startup, but what you have to remember is that during a DAT update, McShield will stop and then start up again. If you have 'scan Processes on enable' checked, after every DAT update McShield will scan all processes in memory. This is very CPU intensive and will cause performance issues.
I would suggest checking this setting in your configuration, testing on a limited basis to see if changing it resolves the problem, and make sure to thoroughly understand whether your company can accept the additional risk that may come with this configuration. Having said that, keep in mind that McAfee itself recommends "This setting is intended for environments where security is more important than performance" and "McAfee recommends that you disable the option to scan Processes on enable unless you require the maximum protection configuration for Access Protection in your environment."
(See KB67634. It's for VSE 8.7 but I believe the concepts still apply for VSE 8.8).
clbarnett, yes thats a good way to get performance, you also need to setup a daily scan task to mitigate against the 'what could be running' issue. im sure thats in the guide somewhere as well. just root kits and running processes takes less than 5 minutes.
I was able to clean most of the Slowness / Sluggishness - with Exclusions to the OAS, As long as you have Strong AP - Policies - you can loosen (Not Completely Remove) OAS protection for on the MCAFEE Files & Update exe's.
With Strong AP Policies you can Disable the Ability to Touch or Modify the Mcafee Program / engine files. If you do this successfuly you can remove the OAS - Read Setting on most mcafee files. If you choose you could remove the Write Scan option also...Totaly up to you and how you feel about the protection.
1GB of ram is a bit weak however - I also have ran it on 512MB so it can be done - When Updating a significant amount of memory is used. 1GB may be plenty in some situations however not knowing what else the computer is doing it may not be enough. .....
Here are a few Reg Keys that I use on the "OLD" Computers - Some running 1GB or 512MB of Ram - Pentium 4 2.6GHZ - Windows XP , some running windows 2000
[HKEY_LOCAL_MACHINE\SOFTWARE\Network Associates\TVD\Shared Components\Framework]
[HKEY_LOCAL_MACHINE\SOFTWARE\McAfee\VSCore\On Access Scanner\McShield\Configuration]
;;RunAtNormalPriority - Not at High Priority
"DoNotReportSkippedFiles"=dword:00000001Message was edited by: pwolfe on 2/28/12 9:22:21 AM GMT-08:00
thanks pwolfe ive added frameworkservice.exe, mcscancheck.exe, mcscript_inuse.exe & mcupdate.exe to the exclusion sextion on the On-Access Default Processes policy and applied the registry settings to a test machine so i will see how we get on
I believe the path of some of these keys have changed in 8.8:
The path for VSE 8.7i and earlier is:
The new path for VSE 8.8 is:
(replace "\VSCore" with "\SystemCore\VSCore").
yes - Good Catch
Also - If you have migrated to windows 7 x64
add the WOW6432Node
Thanks guys but after doing some testing in our new Windows 7 x64 environment the update doesnt have a problem its only in XP and we're migrating to Windows 7 in the next few weeks so this is kinda not needed anymore, but thanks for your input