cancel
Showing results for 
Search instead for 
Did you mean: 
1006
Level 7
Report Inappropriate Content
Message 11 of 23

RE: Agent upgrade error

I think you have to copy it as the file its looking for is in C:\Documents and Settings\All Users\Application Data\Mcafee...

RE: Agent upgrade error

yea, the first thing I did was to copy the file it was looking for to the location and then point it to the file, unfortunatley that didn't work......its a pitty what works for me didn't work for you, I am not sure why, but to be honest I don't have any more suggestions.

If you find anything useful please post it up, because it might be useful for me also.
1006
Level 7
Report Inappropriate Content
Message 13 of 23

RE: Agent upgrade error

Another thing maybe it can help.. I downloaded a DAT to try update my VSE and its telling me:

SDStbRes.dll: The specified module could not be found

RE: Agent upgrade error

Any luck? McAfee are calling me back again on Friday to see if they can work it out...still say they have never seen it before.....I think I have about 60 PCs still showing the problem.....
jhjvma
Level 7
Report Inappropriate Content
Message 15 of 23

Agent Upgrade 4.0.0.1421 > . 1444 Fails

I just began deploying the 1421 agent on brand new machines using the MSI installer. About 30% of my new machines failed to update from 1421 to 1444 with the ePO managed deployment task. In the Windows event log you'll find this error:

Product: McAfee Agent -- Error 1714.The older version of McAfee Agent cannot be removed. Contact your technical support group. System Error 1612.

This is the same error discussed above. It means that the source files for the 1421 agent are missing and the agent cannot be uninstalled.

The problem is that the install source is supposed to be copied by the MSI installer to %ALLUSERSPROFILE%\Application Data\McAfee\Common Framework. On some computers (don't know why), it doesn't get copied. When a new installer version is run, it invokes removal of the existing version and it needs file MFEagent.msi to remove it. The new version installer will first look in %ALLUSERSPROFILE%\Application Data\McAfee\Common Framework and if its not there, then it looks in the location in the Uninstall key in the registry.

My fix:
1) On the broken machine, locate the uninstall registry key for ePO agent 4.0 in key
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall.

Here you'll find a bunch of GUIDs in HEX. I don't how how to get the reference to find the McAfee Agent entry, so I just skip through them until I see it. The DisplayName will be "McAfee Agent".

1a) Note the data (Windows folder) for value "InstallSource". Mine show in C:\Tmp\mfexx.tmp or C:\Windows\Temp\mfexx.tmp. (xx=random alpha-numeric)

2) On a machine that a) is still at version 1421, and b) hasn't failed to upgrade (I had to strip my machine and reinstall it to get this), repeat step 1 and 1a and copy the contents of the indicated folder to a safe location.

3) On the broken computer, create the folder noted in step 1a and copy the files from step 2 to it.

4) Run either the ePO deployment task or force agent install on the broken computer. It will work. It should not be necessary to remove any McAfee point products to fix this.
Minkus
Level 7
Report Inappropriate Content
Message 16 of 23

Re: Agent Upgrade 4.0.0.1421 > . 1444 Fails

Dear all,

I was experiencing the same problem on my network, when attempting to upgrade the McAfee Agent from version 4.0.0.1345 to 4.0.0.1494 using a startup script and 'FramePkg.exe /UPGRADE'.

In the end I discovered that there is a quite easy way to discover whether a client has the issue or not, and to fix the problem as necessary. I have written a script in KiXtart which I will attach to the end of this post to detect whether the problem has manifested itself on a client and automatically fix it for you. But first, some background knowledge about the problem and its effects:

On a machine where the problem has manifested itself:

  • All of the files on the client have been updated to the latest version (e.g. 4.0.0.1494) - you can see this by checking the file properties of (say) "C:\Program Files\McAfee\Common Framework\CMDAgent.exe". On the 'Version' tab in Windows Explorer, the 'File version' item states '4.0.0.1494', which is correct.
  • However, the agent version reported via the Web interface (http://localhost:8081) or in ePolicy Orchestrator (Agent/Product Version) remains at the old version (e.g. 4.0.0.1345).
    • One exception to the above is that on some clients, 'Product Coverage Reports/Product Version' may report the new version (e.g. 4.0.0.1494).
  • The reason why the Web interface and ePolicy Orchestrator versions are 'out of date' is probably because the registry value 'Version' at 'HKLM\SOFTWARE\Network Associates\TVD\Shared Components\Framework' also remains at the old version, even though the files are up to date. In my experience, this is a pretty reliable clue that the problem has occurred, and is one of the values that I use in my script for detecting the problem.
  • Also, if you check the 'DisplayVersion' of the McAfee Agent under the relevant section of HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\<random key>, it will be incorrect as well when compared to the ProductCode for the latest McAfee Agent MSI file. (NB This is a *different* version number to the main McAfee version for some reason - if 4.0.0.1494 is installed correctly, it should read '4.00.0301', but if an upgrade from 4.0.0.1345 has failed, it will read '4.00.0012'. Don't ask me why!). This is also a pretty reliable clue, but due to the random key name it's harder to get hold of the value in a script, which is why I used the Network Associates registry value above instead.

As far as I can see, the reason why the problem occurs is that something goes wrong during the upgrade process, which means that although the agent files themselves are updated correctly, the internal Windows Installer database on the system is not updated with the new version, and so the computer 'thinks' that the old MSI file is still installed, instead of the new one. This causes problems during upgrades because the agent attempts an uninstall first, and this fails when Windows Installer is unable to find the MSI file for the 'old' version of the agent in the place that it expects, i.e. "%ALLUSERSPROFILE%\Application Data\McAfee\Common Framework\MFEAgent.msi'. I don't know why this should happen, but as someone else suggested before I should imagine it is some sort of race condition in a multi-threaded process, and I don't think it is likely to be Microsoft's fault. However, the fix for the problem is fairly simple - copy over the 'old' version of MFEAgent.msi into "%ALLUSERSPROFILE%\Application Data\McAfee\Common Framework" and attempt an upgrade again, and everything should be hunky-dory. You may want to do a FramePkg.exe /FORCEUNINSTALL first to get rid of all the half-installed agent files and registry settings as well, and then reinstall the agent from scratch just to be safe, but in my experience this is not strictly necessary and just copying over the correct version of MFEAgent.msi to match the current version that Windows thinks is installed seems to do the trick.

So what does my script do?

Basically, first it finds the current version of McAfee Agent from the 'Version' key that I mentioned above in the registry - i.e. the last version that installed successfully. Then it finds out the agent version of MFEAgent.msi in "%ALLUSERSPROFILE%\Application Data\McAfee\Common Framework", by extracting 'AGENTVERSION' from the Property table of the MSI file itself. Then it compares the two version to see if they match, and if they don't, it tries to copy the 'correct' version of MFEAgent.msi from a subfolder placed next to the script (which you have to create & copy yourself), using a copy of Robocopy.exe renamed to Setup.exe which is also stored in the same folder as the script (which you also have to download & copy/rename yourself).

(The last bit with Robocopy.exe is necessary due to McAfee's wonderful Access Protection Rules that are implemented in most versions of VirusScan, which will prevent you from using the KiXtart COPY function or any other function to overwrite the MFEAgent.msi file, as it is considered a 'protected' file. By renaming Robocopy.exe to Setup.exe, we are using one of the 'excluded' process names to bypass this rule, which is a bit naughty, but the only way I could see to do it without having to switch off the VirusScan protection rules).

So basically to use the script, you need to get a copy of KiXtart (http://www.kixtart.org/), get a copy of RoboCopy (http://tinyurl.com/4k28b), and get a copy of the relevant MFEAgent.msi files for previous versions of the McAfee Agent (from computers that haven't been updated yet), and copy them in a structure like this:

  • Kix32.exe
  • FixMcAfeeAgent.kix (my script, attached)
  • Setup.exe (renamed version of Robocopy.exe)
  • 4.0.0.1345 (FOLDER)
    • MFEagent.msi (the MSI file for Agent 4.0.0.1345)
  • 4.0.0.1421 (FOLDER)
    • MFEagent.msi (the MSI file for Agent 4.0.0.1421)
  • etc. etc.

If you didn't have a version of the agent installed, you don't need to get an MSI or create a folder for it. Also the script won't fall over if it can't find an MSI file for a version that is installed - it will just say 'No corrected MSI file found for <versionnumber>, so you can add it in at a later date.

Feel free to modify the script or rewrite it in another language if you want to - it's in the public domain, I just want to be helpful. I have been running this exact script in my environment for about a week, and it has fixed the problem on all of my PCs, so I am pretty sure it will fix it for others as well (although if it doesn't, I can't offer you any support of course - it's entirely at your own risk!)

I hope this helps some people get this problem fixed. Hopefully McAfee will recognise the problem soon and sort out a patch themselves, but until then it's up to us, so please let us know how you get on, and post back to the forum with any other results / advice.

Kind regards,

Chris

RE: Agent upgrade error

I too have run into the same issue. I upgraded console to 4.5 a couple of days ago. As soon as I upgraded the agent 4.0.0.1444 began attempting to reinstall on all machines over and over and over. It killed our lower bandwith sites because it was continuously sending agent installs. Support is looking into why the agent was attempting the contiuous install. If they find anything, I'll let you know. I also ran into the problem with the msi. The only solution I came up with was to copy any older mfeagent.msi from my software library over to the machines that were having the issue. Once I copied over the problem msi the agent upgrade was ablt to compete succesfully.
jhjvma
Level 7
Report Inappropriate Content
Message 18 of 23

Could be caused by 1444

I suspect that MFEAgent.msi is being replaced by the 1444 installer before the older version can be used. This could be caused by a race condition (multi-threaded app) in the 1444 installer.

A note to my above post: In order to use the files specified in the registry Uninstall key, the set cannot have been rebooted. The files in the tmp folder are marked for deletion on reboot.

RE: Could be caused by 1444

Thanks for posting up these bits of information.
I am still waiting on some official resoloution etc from McAfee.
(I guess it might require a hotfix for the hotfix, for the agent version released with a major bug in it)

I too will post back if I get any more information from McAfee.
Highlighted
SeaCat
Level 7
Report Inappropriate Content
Message 20 of 23

RE: Could be caused by 1444

Had the same issue in our environment. I worked with Platinum support and was able to find out how to resolve the issue.

You will need to use regedit to find a key that you will either need to change or delete.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Installer\Products\ADE3EF6381C0ED8439B49D68F2287A8A]

The key ADE3EF6381C0ED8439B49D68F2287A8A might not be the same as in your environment, but if you look down through the Products you will see a key with the MFEAgent.msi in it. You will either need to change the path it's pointing to or go ahead and delete the key.

To resolve all the issues, I deleted this key, killed all the McAfee processes and services then deleted all McAfee folders.

Open windows explorer and delete the following directories:

C:\Documents and Settings\All Users\Application Data\McAfee

C:\Documents and Settings\All Users\Application Data\Network Associates

C:\Program Files\Mcafee

C:\Program Files\Network Associates

C:\Windows\Temp\*any McAfee folders you see, and VSE850.exe if it’s there



Go to Start, Run, type regedit to open the registry editor

Browse down to the following paths and delete the following keys:

(Click on the folder then right click and choose delete)

HKEY_LOCAL_MACHINE\SOFTWARE\McAfee

HKEY_LOCAL_MACHINE\SOFTWARE\Network Associates



Next, go to HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\Root - change the

permissions on root to have full control. Delete any keys you see that start with

LEGACY_MC*

LEGACY_MFE*

LEGACY_NAI*

Change the permissions on Root back to non full control

Repeat this process for ControlSet002, 003, CurrentControlSet


You should then be able to reinstall the agent and Virusscan successfully.
More McAfee Tools to Help You
  • Subscription Service Notification (SNS)
  • How-to: Endpoint Removal Tool
  • Support: Endpoint Security
  • eSupport: Policy Orchestrator