McAfee Agent does not communicate with the ePO server

[Pinard]

Hi

We have the same issue here. We have open a service request and we have get HF1230234 but It`s for MA5.0.6 only. We have 4500 endpoint that have already been upgraded to MA 5.5.0 because it was recommanded by support before they release the hotfix. 600 of our endpoint does not communicate with ePO anymore. It's... frustrating.

- Is HF1230234 really fix this mess for 5.0.6?

- Will there be an hotfix for 5.5.0 soon and if so, when?

regards

[mastermix]

Hi Pinard

Until now we have 2700 clients with the hotfix 5.0.6.463. As it seems, the hotfix fixes the issues. No negataiv Feedbacks anymore from our users.

Regards

[cdinet]

Yes, there is a hotfix for 5.5 - scheduled for March 22, but you need a service request to get it.  5.5.1 will be out either late this month or next month and will contain these fixes and will be publicly released.  You will also need a service request for the 5.0.6 hotfix.

[Pinard]

Hi

Thank you both for you reply mastermix and cdinet.

I already have service request 4-18312499111 oppened for that. Since hotfix for 5.5 is planed for tomorow and most of our endpoint are running that version, I'll wait for it.

Regards

[cdinet]

Ok please be sure to let your case owner know to request MA 5.5.0 HF1230772.

[cdinet]

correction - 5.5.1 may not be released until June, but hopefully sooner.

[hausi]

I'm just rolling out 5.5.1.342 on about 4'700 windows-computers, because it seems, the problem with crashed "McAfee Agent Service" is solved. (As soon, as all endpoints have the new version, I can tell you, if there are still crashing "McAfee Agent Services"...

There also seems to be other impact with this version. It looks like a stable version until now.

[twenden]

Have started testing agent 5.5.1.342 and have noticed that the clients won't pul the DAT from the ePO server. Instead they are hitting the fallback repository which is McAfeeHttp. Have you seen that in your deployment of agent 5.5.1.342. I see it by going to a client system and doing a "Update Security".

[hausi]

Hi twenden

We have one ePO and 3 AH.

Each has an ePO-Repository and a HTTP-Repository. Additional we have 2 Repositories, which are reachable from internet (if a mobile is out, he can get the DATs from our Repository).

On "Agenr Handlers" I've defined, where the Endpoints should communicate (DMZ or Intranet).
In the Policy "McAfee Agent > Repository > _Our Default" and "McAfee Agent > Repository > _Oru DMZ" I have defined, which order the endpoints should use. There we also have "McAfeeHttp1" as last choice, so only the ePO gets the Updates from there and replicate those files to our repositories.

I've added a Pie-Chart (Client events) with Number of events and Site.
-> Only a few clients get the Updates from "McAfeeHttp1" - And looking at the IPs, those have no internal IP...

[twenden]

Thanks. I have just created that query and can see not very many systems pulling from McAfeehttp, this is with agent 5.5.0.447. With our autoupdate repository liste, we have the ePO server as global and McAfeehttp as fallback.

Did noticed that under agent-repositories poicy that the select repository by was set to Ping Time. Have changed it to the option "Use order in repository list". On my test Windows 10 (1803) with agent 5.5.1342 this then fixed the issue as the agent then started pulling the DAT from the ePO server. Also selected "Do not use  a Proxy"  as it was set for "Use Internet Explorer Settings". I believe that these are the default settings.