Event ID 7036 still occur with VSE 8.5i Patch 4 when EPO agent communicates

[twenden]

With the previous McAfee Patch 3 we started seeing in a workstations event logs those Event Id 7036. McAfee released a hotfix VSE85HF370722.zip that corrects this issue.

I was hoping that McAfee would have included this hotfix in VSE 8.5i Patch 4. Well, I have applied this patch and still see those event ids appearing on every policy enforcement. The readme file makes no mention of this hotfix.

Not too sure why McAfee did not fix these annoying messages that fill up workstations event logs in Patch 4.

[tonyb99]

Wierd.. I applied it locally and they stopped dead.
Are you sure they didnt just get overwritten with patch 1 again? this happened on one of the stations I had forgotten to exempt from standard updates

[twenden]

These messages are occurring on the following systems:

Office workstation (XP) - manually installed the Patch 4 and then rebooted the system.
Two workstations (XP) in test environment - Patch 4 installed via update task from test EPO server.
One workstations (Vista Business) in test environment - Patch 4 installed via update task from test EPO server.

In our environment, we set policy enforcement for every 30 minutes. This where each of these 7036 id occur. We get two events every 30 minutes - one state mcafee entered paused state and the other mcafee entered a running state.

[tonyb99]

I have 2 manually installed hotfixed XP workstations that were prev showing the start and stop messages every hour when policy enforcement applies but with patch 4 they are not showing this at all (so far)

very strange..

How about everyone else who has applied this??

Please post your results for the 7036 problem

[twenden]

The readme file for the hotfix VSE85HF370722.zip shows a time stamp of Nov 6th. The readme file for Patch 4 shows a release date of Oct 16th. My gut feeling is that they failed to include this hotfix due to time constraints especially since the release notes make no mention of this fix.

Hopefully other people will report what they see when this patch 4 is applied. I might make a support call to confirm.

[tonyb99]

Ive got a 3rd XP workstation that took this off EPO and it has also stopped logging these events. So I am 3 for 3 so far it has worked in every case.

[twenden]

Just got off the phone with McAfee Tech support. They told me that the hotfix to correct these event ids was not included in Patch 4. He had me on hold for 5 minutes while he had to check with the upper tier folks. He said that it would be included in the next patch release.

[tonyb99]

Thats odd, why has it worked on every workstation ive applied it to?
They did all have the issue, I've checked the logs and it has def gone since I applied patch 4.

Aww well.. mine is not to reason why, as long as my machines are clear I'm not going to worry.

[twenden]

I did mention to the support guy that you are seeing these alerts disappear. He could not come up with a reason as to why that would occur. At least I know that the hotfix was not included.

[squonk_109]

I have been running VS 8.5 Patch 4 for about a week and noticed this problem.

I have applied the hotfix to 3 machines, so far and it seems to fix the problem.

Thanks for your comments.