with Agent 5.x, the configuration files are not viewable any more. KB82883 describes the changes in detail.
Actually i have a customer, where approx 7000 clients are connecting to the wrong Agent Handler. How can i troubleshoot this? Agenthandler is okay and is also distributing policies.
Any ideas how to check locally why an Agent 5.x is connection to an Agenthandler and how the Agenthandler was selected?
are the sitelist-entries correct: C:\ProgramData\McAfee\Common Framework\serversitelist.xml?
It maybe a problem with the sitelist itself.
Did you try to manually overwrite it with the one from the repo?
In McAfee Agent 5.X series, Sitelist are encrypted hence it cannot be checked manually in the local system.
If the Machines are having healthy communication with agent handler, try to Modify the agent handler assignments to those machines and check.
To analyze the root cause, collect the MER logs and submit it to McAfee Support.
this is fucking bad for trouble shooting. In case of, if an endpoint is connecting or is not connection to a configured angenthandler, i cannot do troubleshooting.
This is really bad. So it would be great to decrypt the data with a key provided by EPO.
I will ask McAfee.