Showing results for 
Search instead for 
Did you mean: 

ePo and query on disabled agents

As a admin on eP0 3.6 I'm trying to create a query on which virusscanner are disabled within my network. Alas! I don't have the funniest clue how to do this...

What seems to happen is the following:
Within ePo 3.6 all seems right with my security on the workstation. But after looking at several workstations it seems the on access scan has been disabled.
When I look up the specific workstation in ePo is states that all the properties are up to date.
Only after I choose 'retrieve full product properties' it shows the 'real' state of the virusscanner.

Isn't there a way I can get ePo to work in my advantage?
Running a query which shows me if a workstation has a disabled on-access scanner?

I could do it manually, but there a lot of workstation within my network...

Could anyone shed some light on this?
5 Replies

RE: ePo and query on disabled agents

You could use the System Compliance Profile to do this. Create a rule which checks for a running McShield service and let this check run regularly as an SCP Scan task.

RE: ePo and query on disabled agents

Thx Tom.

But is there anyone who can give an explanation for the fact that ePo is giving the wrong properties at first?

RE: ePo and query on disabled agents

What do you mean about "shwoing the real state". As far as I can remember there is no "scanner service is running" property in the system properties in ePO 3.6.1.

RE: ePo and query on disabled agents

Hi Tom,

When I look at the General setting of an Workstation (WS) is see the 'right settings'.
WS seems to be up to date. (See picture).
But the strange thing is, that when I take a look at the WS itself, it shows an disabled on-access scan and often a not up to date virusscanner.

Only when I choose 'Send Agent WakeUp Call' and check 'get full product properties' I get
the 'real settings'. Showing me a lower szDATversion and engine Version.

Isn't there a way to automate this? And why aren't the properties showing up correct?

RE: ePo and query on disabled agents

You are running an unsupported version of Virusscan. Virusscan 7.1 reached end-of-life at december 2007 ( This means McAfee does not test this release with new DAT or engine versions or McAfee agents.

As this could lead to Virusses not being detected or such problems as you had described I would strongly recommend upgrading to at least Virusscan 8.0 or the newest version 8.5. This can be done in place and, if you have a valid support contract, free of charge.