Search

Hello Community, 

I am currently running ePO 5.9 & Drive Encryption 7.2.6. I have been using a corporate branded background on the Pre-boot login for some time now. Some systems show it, whereas others show the default theme or an older corporate background.

I know how to apply the theme in the policy and have the new corporate theme applied in the policy. I have also issued the "Update Task" to have the clients update their current theme to the new theme set in the policy. 

My question is; is there a way in ePO to see what theme has been applied?

For example, the default theme set by McAfee is called "McAfee default". Whereas, my corporate theme is named "2018Theme". Is there a setting somewhere or a file directory path on the client that will show me which theme is being applied on that device?

I want to avoid sending an "Update Task" to all the devices as this prompts them with a McAfee message each time, wither it has already been applied or not. 

Thank You.

Hi!

I'm trying to make McAfee ENS and another exploit protection application coexist on the same host. What processes and folders should be added to the whitelist of the other application to make it work?

Thanks!

Hi All,
Would be great to get some help with this guys.
I get the following event IDs, using my admin account (which gets locked out). I can't see where these  credentials are used for the life of me. I've looked at server tasks and nothing there.

---------------------------------------------------------------------------------------------
---Event ID 4648
A logon was attempted using explicit credentials.

Subject:
    Security ID:        SYSTEM
    Account Name:        SYSTEM
    Account Domain:        NT AUTHORITY
    Logon ID:        0x7fbbb18
    Logon GUID:        {00000000-0000-0000-0000-000000000000}

Account Whose Credentials Were Used:
    Account Name:        ************Admin account
    Account Domain:        
    Logon GUID:        {00000000-0000-0000-0000-000000000000}

Target Server:
    Target Server Name:    ePO FQDN
    Additional Information:    ePO FQDN

Process Information:
    Process ID:        0x4
    Process Name:        

Network Information:
    Network Address:    -
    Port:            -

This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials.  This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command.
---------------------------------------------------------------------------------------------


---------------------------------------------------------------------------------------------
---Event ID 4624
An account was successfully logged on.

Subject:
    Security ID:        SYSTEM
    Account Name:        My PC
    Account Domain:        Domain
    Logon ID:        0x3e7

Logon Type:            9

New Logon:
    Security ID:        SYSTEM
    Account Name:        SYSTEM
    Account Domain:        NT AUTHORITY
    Logon ID:        0x7fbbb18
    Logon GUID:        {00000000-0000-0000-0000-000000000000}

Process Information:
    Process ID:        0xc9c
    Process Name:        C:\Program Files\McAfee\DLP\Agent\fcags.exe

Network Information:
    Workstation Name:    
    Source Network Address:    -
    Source Port:        -

Detailed Authentication Information:
    Logon Process:        Advapi  
    Authentication Package:    Negotiate
    Transited Services:    -
    Package Name (NTLM only):    -
    Key Length:        0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The authentication information fields provide detailed information about this specific logon request.
    - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
    - Transited services indicate which intermediate services have participated in this logon request.
    - Package name indicates which sub-protocol was used among the NTLM protocols.
    - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.

I also have an event 4634 and 4672 - not sure they'll be of any value.

Thanks in advance.

 I have an "issue" when the rule email protection: monitoring external email matches with names in cache or groups names (all internals) in Outlook because "dont have a domain" but is an internal mail and I only need to protect externals email to outgoing domains... I don't need to save internals emails

Our current ePO is not synchrnzed with AD. The system tree is setup is IP based. I don't want to bring across computers from AD since we already have a working IP based system tree. However, is it possible to just obtains users from AD that we could assign to user based policies. 

We are looking at trying to find a way of creating user account that only has access to classroom computer but which can't get out to the Internet. Any other user account will need Internet access.

Is there anything in ENS that would allow you to lockdown a user account to not have Internet access? Can't seem to find any user based options under the firewall settings.

Hello,

I have created "Printer protection" rule in the ruleset of DLP 11.0.500 to block printng if printer "is any local printer" from "any application". Users can now print only to network printers. However when user tries to use "Send to OneNote 2016", DLP is blocking the print by the same rule for the "local printers" and can't find a way to exlude this. Print to PDF/XPS is working as expected and you can print in it.

How can I exclude "send to OneNote" and why it's detected as local printer in general but  "print to PDF/XPS" is not?

Is there anyway that I can define which printer is which in DLP?

Hi all,

I could use some clarification on data encrichment.  Our ESM is configured with a rule to enrich the lookup field "Source User" with the enrichment field "Contact_Name" on our receiver.  I've tested the LDAP query and it is working.

We have an appliance that employees log into using their user IDs (sAMAccountName.)  The appliance sends a syslog to the ESM which obviously only has that identifier in Source User.  My assumption is that the data enrichment rule should be adding the displayName attribute to the Contact_Name field in the event created by the syslog.

Since I'm not seeing the Contact_Name field in any of these events, can someone please confirm that my understanding of this function is correct?  And is there somewhere that would show me if data enrichment was not working properly?

Any help is greatly appreciated.

Thanks in advance,

- Steve

We want to create a pacakge that we can give to the helpdesk that will install the McAfee ENS Theat Prevention and then the McAfee ePPO Agent. We have a package that we use with VirusScan 8.8i with Patch 11.

Just want to know if you can use the ENS 10.6 standalone product and have it managed by ePO?

Also, is there a command line parameter that can be use to install just Threat Prevention silently? We are not interested in Web Control or Firewall options. 

ePO version 5.3

I have been admin'ing ePO for about a year but I wasn't here when it was implemented at my organization, so I'm missing a couple pieces of info regarding local users and groups.

On the server that has ePO installed (using Windows 2012 R2), the below entries exist in the Local Users and Groups console:

Groups > ePO Pre Checker Grp

Includes:  ePO Service Account, local account with my predecessor's name

Groups > ePO User Group

Includes:  ePO Service Account, my domain account

Obviously, I want to get rid of the local account with my predecessor's name since he no longer works here.  It's not a domain account so either he created it manually or ePO created and assigned it and is still using it.  Is there any reason I need to keep this?  Is there any reason I need to keep either of these groups?  I don't know why my domain account is in one of the groups as I didn't add it. 

TYIA!