Showing results for 
Search instead for 
Did you mean: 

EPO and MCAFEE AGENT in NLB Enviorment


This is the scenario:

I have 2 servers (Windows 2003) in NLB cluster enviorment. In the EPO Console I register one, but when the other one does a agent wakeup it eliminates the first one from the EPO  :s

I tried KB:

With no success.....

any sugestions?

10 Replies
Level 8
Report Inappropriate Content
Message 2 of 11

EPO and MCAFEE AGENT in NLB Enviorment

I had  the same problem, and used the kb57886 and it work. I started with uninstalling the agent on both my nlb machines first, then i disable the macsearch, restartet the Epo Server Services, install agent on pc1 at get it all the way into EPO, then i installed pc2, and both machines was in epo on the same time, if you dont uninstall the agent complete, the agent guid id in registry are still the same, and the agent will only use this for communication with epo. It is possible that you could try stoppe agent framework om the two pc's and delete the agent guid from registry and start agent again, but I have never tried that

JoeBidgood McAfee Employee
McAfee Employee
Report Inappropriate Content
Message 3 of 11

EPO and MCAFEE AGENT in NLB Enviorment

It appears that someone has edited that document and introduced a mistake     I have corrected this and taken steps to prevent it happening again...

The correct steps are given below: the important part is the Options subkey.

Step 1 - Disable the MAC search 

  1. Click Start, Run, type regedit and click OK.

    Navigate to and select the following registry key:
        [HKEY_LOCAL_MACHINE\SOFTWARE\Network Associates\ePolicy Orchestrator]

  3. Right-click the ePolicy Orchestrator key and select New, Key.
  4. Type Options as the name of the new key.
  5. Right-click the new Options key and select New, String Value.
  6. Name the new string DisableMACSearch.
  7. Right-click the DisableMACSearch key and select Modify.
  8. Set the Value data to 1 and click OK.
IMPORTANT: It is essential that the new value is created in the correct key. Confirm that the new key is:
  • [HKEY_LOCAL_MACHINE\SOFTWARE\Network Associates\ePolicy Orchestrator\Options\DisableMACSearch]
  • Value data for DisableMACSearch is specified as 1

If you follow these steps you should be able to get both machines added to ePO: make sure you turn the mac search on again when they are

Thanks -


EPO and MCAFEE AGENT in NLB Enviorment

I managed to resolve this, making a tweak on the XML file of the agent on one of the servers, just changed the mac address temporarily until both got registered.

First you have DisableMACSearch registry key as mentioned above.

Then change the registry key: HKLM\SOFTWARE\Network Associates\ePolicy Orchestrator\Agent\MacAddress.

And then:

C:\Documents and Settings\All Users\Application Data\McAfee\Common Framework\

You have to tweak lastprop.xml and incrprop.xml. just change the MacAddress Temporarily, then make a Collect and Send Props.

The object its to fake EPO with another mac address until both server get registered on EPO. You're going to see it on Lost&Found.


JoeBidgood McAfee Employee
McAfee Employee
Report Inappropriate Content
Message 5 of 11

EPO and MCAFEE AGENT in NLB Enviorment

Hm - you shouldn't have needed to edit any files: just disabling the mac search should have been enough - but at least it's OK now

Regards -



Re: EPO and MCAFEE AGENT in NLB Enviorment

Hi guy's, I'm having the same problem with my new installed Epo 4.6.

DisableMACSearch worked fine for Epo4.5 and lower but it's not worlking for Epo 4.6

Please help.

I also tried with the "Detected System Matching" in the server settings but that didn't help.


Re: EPO and MCAFEE AGENT in NLB Enviorment

Hello blindpepper,

In our case, I tried something more technical, I tricked the common framwork XML file.

There are 3 XML files in the All Users\Application Data\McAfee\Common Framework.

First you have to disable MAC Search as JoeBidGood posted, then you change the mac address on the files:




-Issue send props.

What is going to happen its that both servers are going to register in the console with different mac address, then you can fix the Mac address on the host system or delete these files, the agent is going to generate it again.

Consider that you have to put these systems on exceptions in Rogue System Detection

If you want more info just sent me a message.



JoeBidgood McAfee Employee
McAfee Employee
Report Inappropriate Content
Message 8 of 11

Re: EPO and MCAFEE AGENT in NLB Enviorment


I've just tested it with 4.6, and DisableMacSearch works in exactly the same way as before. There's no need to edit any agent-side files...

Can you confirm that you've definitely created the Options key, the value is a string, and its data is set to 1?

Thanks -


Message was edited by: JoeBidgood - put DWORD by mistake 🙂 on 01/06/11 15:34:21 GMT

Re: EPO and MCAFEE AGENT in NLB Enviorment

Hello Joe,

Yes, I created the options key and the string but it is not working for me


Re: EPO and MCAFEE AGENT in NLB Enviorment

Ok my fault, I created it under \McAfee\Epolicy Orchestrator and it has to be \Network Assosiates\Epolicy Orch..

It's working now. Thanks for the help

You Deserve an Award
Don't forget, when your helpful posts earn a kudos or get accepted as a solution you can unlock perks and badges. Those aren't the only badges, either. How many can you collect? Click here to learn more.

Community Help Hub

    New to the forums or need help finding your way around the forums? There's a whole hub of community resources to help you.

  • Find Forum FAQs
  • Learn How to Earn Badges
  • Ask for Help
Go to Community Help

Join the Community

    Thousands of customers use the McAfee Community for peer-to-peer and expert product support. Enjoy these benefits with a free membership:

  • Get helpful solutions from McAfee experts.
  • Stay connected to product conversations that matter to you.
  • Participate in product groups led by McAfee employees.
Join the Community
Join the Community