Unable to check in McAfee Agent extensions

[Abhishek_Roy]

Hi,

I have a couple of doubts about product extension check-in EPO. As per as I understand, for deploying any product module and managing it via EPO (Eg: McAfee ENS Threat Prevention 10.7) I need to check-in both the installation package and the extension. The installation package will help in installing the same on managed clients whereas the extension will help to create policies, task, reporting for the same product. So suppose I have 10 systems in my environment with ENS Threat Prevention 10.6 and 10 systems with ENS THreat prevention 10.7. Then I should be having extension of both 10.6 & 10.7 right?

But ideally I think if I have 10.6 extension checked-in and want to onboard 10.7 extension, the latter will replace the existing extension. So is it something like 10.7 extension is capable of managing 10.6 product as well?

Please comment wherever I am wrong. And if my understanding is correct the same goes for any McAfee product, Because I just had Agent 5.6.1 extension and whenever trying to check-in 5.6.4 extension it is replacing the older one.

If I don't install Extension for a product, then will I loose control in creating tasks/policies? or what will be the issue?

[cdinet]

The extensions are backward compatible, so 5.6.4 ma extension will manage all agent versions before that, even 4.8 - just some features may not be compatible (single system troubleshooting, etc.)  The same goes for other products.  ENS 10.7 extension will manage lower versions of ens.

[Abhishek_Roy]

Thanks. That was great help. And please confirm that if extensions are not checked in for a module, then what challenges will we face? Is it like ENS 10.7 is checked in Master Repository but I am not able to create any deployment task or run any query or make policy changes?

[cdinet]

Deployment tasks depend on the product being in the master repository or not, regardless of whether there is an extension installed or not.

If a point product extension is not installed, there will be no policies, tasks, or queries for that product.  Additionally, extensions provide OS support information for the point product, which can be crucial for newer operating systems.  For example, with later versions of Windows 10, only certain versions of the products are supported.  So if a product is deployed and there is no info on the supportability of that os, then that point product will fail to install as not supported on that platform.  That is another reason for having the latest extensions installed, even if clients aren't necessarily up to that version.  

As always, it can also be important to check with point product teams for what extensions are backward compatible or not - most are.

[cdinet]

Additionally, without product extensions, particularly if they are report extensions, events will not be parsed for that product, as that also adds info to epo for how to handle that product's events.