At our site we built automatic reponses to notify us by email when certain things happen like viruses and so on.
Sometime after our EPO 4.5 MR4 update (from MR3) SOME of those responses stopped working.
I watch the Threat Event Log and it is recording the events that should be triggering automatic reponses but the trigger isn't actually occuring. Again, this is only for some of the respones. If all didn't work that would be some kind of indicator but SOME? Note I have deleted and recreated the 'broken' responses from scratch with the same negative result.
Any help would be appreciated.
There's a bunch of further fixes to the responses mechanism in ePO 4.5 Patches 5 & 6.
although by preference it would be better to consider moving to ePO 4.6 current patch.
Basically the version you are running is still quite old, please consider a further upgrade
Would love to but we're restricted to a very slow upgrade schedule here (out of my control).
Thinking it might be the McAfee Agent extension. Our server is still on 4.5 while my client is 4.6. Doing a downgrade today to see if that's the issue.Message was edited by: kenobe on 12/7/12 9:56:21 AM CST
The server Agent Extension is version 4.5. I downgraded to McAfee Agent 4.5 and no-go. My events didn't even make it into the Threat Event Log.
Upgraded back to Agent 4.6 and events make it to the log- but still no Automatic Responses.
I suspect a server issue. The Administrator tried to upgrade the Agent Extension to 4.6 while all our deployed agents were still 4.5 and nobody talked. He rolled back to the 4.5 Extension and all talked again - but that's the time our Responses stopped working. We're getting a push soon to make all the agents 4.6, then the admin will update the server to 4.6 Extension. Hopefully things will work then.
I've had similar issues since upgrading to the latest version of ePO, I've set up the responses again as suggested in some other posts but some responses aren't working, the main one I can't get to work is the 'Software Manager new product update available' no matter what I do I never get an email, the corresponding event id is recorded in the system, just no email. I also find the software manager seems to be a few days behind picking up new updates.