Trying to Checkin Packages for McAfee Agent 5.7.6 in Software Catalog

[thenry]

Installed the extension for 5.7.6 and its components (msgbus updater and agent key updater) continued to check-in the MA 576 package for Linux and it was successful. However, when I check-in the packages for MA576 for Mac or Windows the logs tell me check in was successful but the software catalog still shows it as not checked in. I have already attempted to manually check-in, and the same issues arises..ePO tells me the package was successfully checked in yet it still shows up in the software catalog at not checked in.

Any Ideas on why the 5.7.6 agent won't check in to epo.

Thanks

[cdinet]

What version shows in the master repository?  If you download the file and check it in manually, does that change?  Does the orion log show any errors, server task log, or epoapsvr log for checking in the package?

[thenry]

in the master repository the only Mcafee Agent product that shows is 5.7.6 for Linux.. we were previously deploying 5.7.5 and those were blown out when I downloaded the 5.7.6 ePO extension.

The Orion log shows no errors and the epoapsvr log just shows successful software download. ill attach the server task log that shows it was a successful checkin..but the software is still not in the master repository or the software catalog-- i also checked to see if it would show up when trying to create a client task, but it does not.

[cdinet]

The extension should not have changed anything in master repository.  Check in the version of the agent that you want to deploy, then check your deployment task to ensure the value isn't blank.  It will go blank when version changes, so you have to reset that task.

[thenry]

Thats my issue. The Agent will not check-in, I have tried to manually check in 5.7.5 and 5.7.6 and I get th "check in successful" but the agent is not in the master repository or software catalog. It still shows as not checked in after "successful" check-in

[cdinet]

Please open a ticket then so we can check the logs.  Send me your SR number please in private chat.

[cdinet]

20220415142408 E #22436 SITEMGR CheckInPkg.cpp(1357): Failed to copy to master repository C:\PROGRA~2\McAfee\EPOLIC~1\Server\temp\rman56872\FrameworkPackage.exe to C:\PROGRA~2\McAfee\EPOLIC~1\DB\Software\Current\EPOAGENT3000\Install\0409\FrameworkPackage.exe, error 5

Error 5 is access denied.  You have Carbon Black installed on the server, which is fine, but you need to check the logs for that software and the settings.  We have seen it block actions that epo is trying to do.

If that isn't the problem, then run procmon while trying to check in the package and upload it to your case with corresponding epoapsvr logs showing the time of the error and we can maybe identify what might be blocking this and causing the access denied.

[cdinet · Accepted solution]

You can get procmon here - https://docs.microsoft.com/en-us/sysinternals/downloads/procmon

[thenry]

We have CB EDR it just alerts on new process or binaries no block action is set.

I will run the procmon and upload the results.

[cdinet]

Ok thanks