cancel
Showing results for 
Search instead for 
Did you mean: 
Reliable Contributor SCtbe
Reliable Contributor
Report Inappropriate Content
Message 11 of 12

Re: Last Update vs. Last Detected Time Query

And also first time, after MA installation, when client machine is added to ePO.

apoling
Level 14
Report Inappropriate Content
Message 12 of 12

Re: Last Update vs. Last Detected Time Query

Yes it seems MA registers the node in both places. I would not expect that 🙂

How about the following theory: when the ePOLeafNode.LastUpdate and RSDDetectedSource.LastDetected fields values equal, (plus Detection Source equals 'McAfee Agent') then it signifies a new node being added. I would expect that these two fields are less likely to be equal later (under certain conditions, like ASCI interval and RSD detection frequency, how these two relates).

As for the deletion of a node: I have no theory just now.. 🙂

Attila

More McAfee Tools to Help You
  • Subscription Service Notification (SNS)
  • How-to: Endpoint Removal Tool
  • Support: Endpoint Security
  • eSupport: Policy Orchestrator