User Space Controller error

[geschneide]

Error will change based on ePO agent version. But error is always right after Enforcing Policies for ePolicy Orchestrator Agent. All systems displaying the error are Server 2003 and 64bit Operating Systems (not every 64bit OS is displaying these errors)

4.0 and 3.6 agent display...

Error User Space Controller Failed to OpenProcessToken. Error code 6
Info Agent Agent finished Enforcing policies
Info Agent Next policy enforcement in 15 minutes
Info Agent Agent Started Enforcing policies
Info Management Enforcing Policies for VIRUSCAN8600
Info Management Enforcing Policies for EPOAGENT3000META
Info Management Enforcing Policies for EPOAGENT3000
Info Management Enforcing Policies for ePolicy Orchestrator Agent
Error User Space Controller Failed to OpenProcessToken. Error code 6
Info Agent Agent finished Enforcing policies
Info Agent Next policy enforcement in 15 minutes
Info Agent Agent Started Enforcing policies
Info Management Enforcing Policies for VIRUSCAN8600
Info Management Enforcing Policies for EPOAGENT3000META
Info Management Enforcing Policies for EPOAGENT3000
Info Management Enforcing Policies for ePolicy Orchestrator Agent

4.0.0.1345 epo agent display a new error

Error User Space Controller Failed to OpenProcess. Error code 57
Info Agent Agent finished Enforcing policies
Info Agent Next policy enforcement in 15 minutes
Info Agent Agent wakeup call received
Info Agent Agent wakeup call for FULL PROPS received
Info Agent Agent started performing ASCI
Info Agent Checking MAC address...
Info Agent Checking Computer Name...
Info Management Collecting Properties
Info Agent Agent communication session started
Info Agent Agent is sending FULL PROPS package ePO server
Info Agent Agent is connecting to ePO server
Info Agent Package uploaded to ePO Server successfully
Info Agent Agent communication session closed
Info Agent Agent received POLICY package from ePO server
Info Agent Enforcing newly downloaded policies
Info Agent Agent Started Enforcing policies
Info Management Enforcing Policies for VIRUSCAN8600
Info Management Enforcing Policies for EPOAGENT3000META
Info Management Enforcing Policies for EPOAGENT3000
Info Management Enforcing Policies for McAfee Agent

Manage Enforcing Policies for McAfee Agent
Agent CePOAgent::EnforcePolicy priority=-2 (still researching this, I would have expected a 0)
Agent Enforcing policies
LstnSvr Enforcing Policies
Logging Enforcing policies
Manage Enforcing policies
UsrSpCt Enforcing policies
UsrSpCt Token not found. Will try to get it from shell
UsrSpCt Failed to OpenProcess. Error code 57

I have not done a complete uninstall reboot and reinstall, yet. There have been other posts, but no one posted a fix that I was able to locate. If anyone needs longer logs, I just included the pieces around the errors.

[cdobol]

Seeing the same thing. Trying to get verification if we are only seeing 64 bit OS.

[simpleman2]

I am getting the same error, just on one machine so far. Several others are not reporting correctly to epo 4.0.

Current environment moved from epo 3.6 to 4.0
VSE 8.0 migrated to VSE 8.5/8.6
HIPS 700.953

I hope someone can post a fix for this one. After reading other posts, I have been able to resolve most of the other reporting problems.

[SeaCat]

Seeing a similar message here...

#1708 Agent Enforcing policies
#1708 LstnSvr Enforcing Policies
#1708 Logging Enforcing policies
#1708 Manage Enforcing policies
#1708 UsrSpCt Enforcing policies
#1708 UsrSpCt Token not found. Will try to get it from shell
#1708 UsrSpCt Failed to OpenProcess. Error code 57
#1708 UsrSpCt Try to Launch UdaterUI Again
#1708 Sched >>--CSchedule::EnforcePolicy
#1708 Sched >>--CSchedule::ModifyTask
#1708 Sched <<--CSchedule::ModifyTask

[dgordon]

I had the same error on 2 64bit servers. I was just able to resolve it by uninstalling the agent with a forceuninstall command.
"C:\Program Files (x86)\McAfee\Common Framework\frminst.exe" /forceuninstall /silent

Then reinstalled it and I am no longer getting the error.

[geschneide]

Thank you, that is the only other option I could think of following. However, with the forceuninstall I always uninstall and reinstall McAfee (8.5 in this case) because the forceuinstall seems to mess up the AV.

Have you run into that also?

I am currently still waiting on the application server owners to provide permission for reboot (due to uninstall and reinstall of McAfee). Since the only issue is ePO seems unable to enfoce policies AV seems to be working.

[dgordon]

All I uninstalled was the agent. I didn't do anything with AV no reboot required for this. I have had to do this several time and it has never messed up AV.

[Virulon]

KB60959 has information on this and you can safely ignore it. It'll be fixed in Agent 4.0 patch 3.

Corporate KnowledgeBase ID: KB60959
Published: March 17, 2009

Environment
McAfee Agent 4.0 with Patch 1 or 2
Microsoft Windows supported 64-bit operating systems
Microsoft Windows (All supported versions. See KB51109)
Problem 1
The Agent _<computer_name>.log records the following error during a policy enforcement on a Microsoft Windows 64-bit operating system:

I #1956 LstnSvr Enforcing Policies
I #1956 InetMgr IP address for ePO Server =###.###.###.###
I #1956 Logging Enforcing policies
I #1956 Manage Enforcing policies
I #1956 Script Enforcing policies
I #1956 Updater Enforcing policies
I #1956 UsrSpCt Enforcing policies
I #1956 UsrSpCt Token not found. Will try to get it from shell
e #1956 UsrSpCt Failed to OpenProcess. Error code 57
Problem 2
This error is only logged when no one is logged on to the client computer.
Solution
This error does not have any negative impact on the performance, or function of the McAfee 4.0 agent, and the message can be safely ignored.

This issue will be resolved in McAfee Agent 4.0 Patch 3 for Windows. This is currently scheduled for Q3 2009.

[rhythm_methods]

Thanks for that, your post saved me a bit of time, cheers for the info.

[danpotter]

Who is still getting these with 4.5?  I thought this was going to be fixed?