Yes customer has to use proxy to let VSE connect to mcafee update server.
We tried to open the update url in browser, it can be opened successfully, sitestat.xml was also retrieved successfully.
To answer this question - McAfee Agent uses it's internal aac self-protection mechanism(sanitize selected MA processes) and detecting those 2 DLLs hooked into Mcscript_inuse.exe contain unsigned/untrusted codes/digital signatures, and THEN, agent stops(not third-party software forces agent to stop) to process further and causes agent failed to find the valid repository.
When any untrusted dll or process tries to inject itself into our processes, we block that from happening to prevent things such as malware or other type processes that might even try to modify the behavior or code of our processes to protect them. In doing so, mcscript_inuse is prevented/blocked from executing its own functions. One of those functions is to invoke an mue.exe process to start running the scripts for the update. If our process is injected with an untrusted dll, we can't trust it to not alter the behavior of what mcscript_inuse is trying to do, so we block its functionality. That is why it fails any updates or deployments. The 3rd party software isn't what forces the agent to stop, we stop ourselves so we do no harm if the 3rd party software happened to be malicious.
Was my reply helpful?
If this information was helpful in any way or answered your question, will you please select Accept as Solution in my reply and together we can help other members?
Download the new ePolicy Orchestrator (ePO) Support Center Extension which simplifies ePO management and provides support resources directly in the console. Learn more about ePO Support Center
Corporate Headquarters
2821 Mission College Blvd.
Santa Clara, CA 95054 USA