I have a number of machines where the epo agent 4.5 are being overwritten and agent 4.0 is being installed instead.
Machines are in the same policy as other machines that are on 4.5 and stay that way with no issues.
Problem is not site or OS specific.
I can manually update to 4.5 but it gets overwritten again.
Can any one shed any light on why the old agent is being installed or which logs to check to find out where it is being installed from?
You have a process somewhere that is performing a force install "framepkg /install=agent /forceinstall" on those machines. McAfee agents will not downgrade like that without the force swtich. The most likely place is that you have a login script that is doing it. I've seen what you described several times. (Once, I even saw this done in a logout script. That was hard to track down.)
I'm not 100% sure that's the location you're doing it. You could have some software management tool also doing it but it certainly isn't ePO.
Thanks for the response. I think I have found the issue.
Win 7 Machines were being renamed after a build to the same as the old XP systems. This was then presenting a duplicate entry in epo, think the new machine was then referencing the old policy. I removed the old device from epo and I am testing to see if the agent is again over written.
I will keep you updated.
Rather than just 'delete' the duplicates you might want to use the option "Move GUID to duplicate list and delete system". It has the benefit of making machines change their GUID if they have been involved in duplication. (And it can solve a bunch of other problems "sort of" related to this). You can never hurt anything by using that option to delete systems in lieu of just using the regular "delete" but this has the added benefit of fixing some weird communication issues.