cancel
Showing results for 
Show  only  | Search instead for 
Did you mean: 
MRK_HC
Level 7
Report Inappropriate Content
Message 1 of 10

How to find out if someone has removed the McAfee Agent?

See title. I can't seem to find any way to detect a client who deleted the McAfee Agent from the ePo server.

 

By the way, the easiest way I found to remove the Agent (even if protected by password), is trying to install the Kaspersky free antivirus, this thing is able to remove the managed and password protected Agent no questions asked. Maybe there are other ways, that's why I would like to know how to detect it.

9 Replies
Former Member
Not applicable
Report Inappropriate Content
Message 2 of 10

Re: How to find out if someone has removed the McAfee Agent?

The agent doesnt have a password against it, VSE has one to lock the console; but the agent just doesnt allow the uninstall, with normal permissions, when in a managed state.  Using the switch /forceuninstall will also remove the agent from a managed machine. (https://kc.mcafee.com/corporate/index?page=content&id=kb65863). 

 

 

ePO utilize the classic client to server communication mode. Meaning ePO doesnt actually keep track of the agents until they report back; by default every one hour. The last communication time will be the only way to see if  client machine is currently managed or unmanaged.  If the time stamp stops updating, then either the agent is non functional, the computer is off, or the agent has been removed.  ePO will hold a record of the system indefinitely as it doesnt know the state of the machine. 

Utilizing a query would be the best way to see this information. Something like "Machines that have not communicated in the past 48 hours" or something similar to know if there are issues with communication.  

 

Hopefully this helps.   

cdinet
McAfee Employee
McAfee Employee
Report Inappropriate Content
Message 3 of 10

Re: How to find out if someone has removed the McAfee Agent?

There is also a query in epo that might show some attempts.

Agent Uninstalls Attempted in the Last 7 Days

 

Was my reply helpful?
If this information was helpful in any way or answered your question, will you please select Accept as Solution in my reply and together we can help other members?

LeNam
Level 8
Report Inappropriate Content
Message 4 of 10

Re: How to find out if someone has removed the McAfee Agent?

Agent Uninstalls Attempted in the Last 7 Days -> This is solution 😄 Which EventID=2413 if you want to check
bodysoda
Reliable Contributor
Reliable Contributor
Report Inappropriate Content
Message 5 of 10

Re: How to find out if someone has removed the McAfee Agent?

Check the EPO Audit Logs which records all the activities on the EPO. Use the find function to search for DELETE event. You will find the culprit who deleted the mcafee agent. 🙂

In case above information was useful or answered your question, please select "Accept as Solution" in my reply, or give a Kudo. Thanks!
cdinet
McAfee Employee
McAfee Employee
Report Inappropriate Content
Message 6 of 10

Re: How to find out if someone has removed the McAfee Agent?

The problem with a query like that is that it depends on the agent being able to send an event for that.  If the agent is successfully removed, there is no event sent and you don't know if the agent is there or not.  You would, however, see the last communication not updating.  So you can periodically look for systems that have not communicated in a specific time frame.

Was my reply helpful?
If this information was helpful in any way or answered your question, will you please select Accept as Solution in my reply and together we can help other members?

LeNam
Level 8
Report Inappropriate Content
Message 7 of 10

Re: How to find out if someone has removed the McAfee Agent?

Just checked it, so its not like what you said. I tested in MacOS and Windows.
- Windows: The agent successfully removed, i still got the information on ePO
- MacOS: Successfully removed or not, it wont send the message to ePO
And i still want to say "Thank you" for your query advice
cdinet
McAfee Employee
McAfee Employee
Report Inappropriate Content
Message 8 of 10

Re: How to find out if someone has removed the McAfee Agent?

That is interesting result.  If you want to pursue the MAC systems not reporting that, please open SR so dev can look at that.

Was my reply helpful?
If this information was helpful in any way or answered your question, will you please select Accept as Solution in my reply and together we can help other members?

LeNam
Level 8
Report Inappropriate Content
Message 9 of 10

Re: How to find out if someone has removed the McAfee Agent?

Yep, i want that. But i'm new here. I don't know what SR is 😄 I'll check it later
cdinet
McAfee Employee
McAfee Employee
Report Inappropriate Content
Message 10 of 10

Re: How to find out if someone has removed the McAfee Agent?

SR is service request.  You would either call into support and give your grant number to have them open a ticket for you, or you can go to support.mcafee.com and set up your account there with grant number and open one from there.

Was my reply helpful?
If this information was helpful in any way or answered your question, will you please select Accept as Solution in my reply and together we can help other members?

You Deserve an Award
Don't forget, when your helpful posts earn a kudos or get accepted as a solution you can unlock perks and badges. Those aren't the only badges, either. How many can you collect? Click here to learn more.

Community Help Hub

    New to the forums or need help finding your way around the forums? There's a whole hub of community resources to help you.

  • Find Forum FAQs
  • Learn How to Earn Badges
  • Ask for Help
Go to Community Help

Join the Community

    Thousands of customers use the McAfee Community for peer-to-peer and expert product support. Enjoy these benefits with a free membership:

  • Get helpful solutions from McAfee experts.
  • Stay connected to product conversations that matter to you.
  • Participate in product groups led by McAfee employees.
Join the Community
Join the Community