Just had a McAfee update which required a restart. Checking the event logs afterwards I found a 522 warning with Category 256 (whatever that is) and the following message (no Microsoft help available for this but lots of reports for similar errors in the McAfee KnowledgeBase).
Process **\mcshield.exe pid (436) could not be successfully validated with the mfevtp service and would have been blocked from performing a privileged operation with a McAfee driver if enforcement was enabled.
Does anyone else have this message in their Event Logs? If it's not just me I'll ask someone about it.
Edit - These may be connected to the above, I've never seen these before .
- Event ID 4125 and 2444, both for MS DTC (Distributed Transaction Coordinator). Information messages only, not warnings or errors.
- Event ID 5004 : Error, MclogEvent - "Could not contact Filter Driver - Error 0x57, the parameter is incorrect".Message was edited by: Hayton on 27/04/12 18:25:51 IST
I was getting these a lot on a server that had some other issues. McAfee support was "okay" on this. They said it was probably safe, but I should find out what is causing them in the first place, and as always, sent a barrage of articles to read. Like I have that kind of time!!!!
Answers like this usually make me assume that this is a known issue, but they don't want to make public the reason. I just got these messages today on my mailserver. Let's see how far we get with support today!
This issue was raised on the conference call, and a couple of good points were made.
If you get this on a server, first of all, what is the McAfee product you're talking about? We need to know if this should be dealt with in the Business/enterprise section.
The second question is related to the first. What is the operating system you've got? There are some known incompatibilities - in short, you can't run McAfee Consumer products on certain operating systems, they just don't work properly (one of the senior techs has tried it for himself, so he was speaking from experience).