4 Replies Latest reply on Jun 1, 2017 1:31 AM by justlearning

    Where to assign client tasks in epo

    justlearning

      Hey guys again,

       

      I've got many questions, and hopefully you can help me, finding the answers .

       

      Starting in the system tree, I have one group "workstations", which contains all our normal computers - like windows 7, and some xp machines, all tagged accordingly to their OS type.

       

      For this group, there are several client tasks assigned, most of them with the schedule "run immediately", some "at logon" and on a "daily" basis.

       

      For example (all tasks assigned in the system tree):

       

      Client Deployment Tasks:

      • Deploy Current Epo Agent - Run immediately
      • Deploy Current VSE (virusscan enterprise) - Run immediately

       

      Client Update Tasks:

      • Update Buffer Overflow DAT for VSE - at Logon and on Daily Basis (every X hours)
      • Update DAT and Engine - at Logon and Daily Basis (every X hours)
      • Update VSE Patch and SP - Run immediately
      • Update Cipher Key - Immediately

       

       

      So does "run immediately" mean, running the task, as soon as the computer is able to contact the epo server, no matter if someone is logged in?

      What's happening, if the computer is starting the VSE Installation first, but the currently installed Epo Agent version is not supporting this VSE Version (until the current epo version is installed)?

      Will the VSE installation start, as soon as the Epo Agent is updated, if there is only one task set to "run immediately"? Or do I need to wait for next policy enforcement or reboot?

      How does the EPO work with many of these tasks (what comes first, runs first)?

       

       

      Or will it be a good idea, to set one daily task for deploying epo agents and vse?

       

      Regarding the Update Tasks, usually I would set them to run immediately too, but I am not sure, if this would work like intended.

       

       

      How do you guys deploy these kind of tasks?

       

       

      Sorry for those many questions.

       

      Thanks in advance.

       

      Best regards

        • 1. Re: Where to assign client tasks in epo
          tkinkead

          So does "run immediately" mean, running the task, as soon as the computer is able to contact the epo server, no matter if someone is logged in?

           

          - Run immediately means that the task will run as soon as the client is aware of it.  That requires an Agent check-in to take place.  If you assign a Run Immediately task, the task will run immediately upon the next Agent check-in, regardless of other circumstances.  Run Immediately tasks will only run once.

           

          What's happening, if the computer is starting the VSE Installation first, but the currently installed Epo Agent version is not supporting this VSE Version (until the current epo version is installed)?

           

          - If the system starts VSE installation and the Agent version is not supported, the task will stop.  If the task is set to Run Immediately it will not run again.  If it is scheduled, it will run at the next scheduled time.

           

          Will the VSE installation start, as soon as the Epo Agent is updated, if there is only one task set to "run immediately"? Or do I need to wait for next policy enforcement or reboot?

           

          - Run Immediately tasks start on the next Agent communication.  If pre-requisites are not in place the task will fail.

           

          How does the EPO work with many of these tasks (what comes first, runs first)?

           

          - I'm not entirely sure what you're getting at.  Do you mean, how does the Agent handle multiple simultaneous Run Immediately tasks that it receives at the same time?  It would run them sequentially, but I'm not sure how it would choose to order them.  If you need to install products in a certain order I would not trust ePO / the Agent to determine and execute them in the correct order for you.

           

          Or will it be a good idea, to set one daily task for deploying epo agents and vse?

           

          - I prefer daily tasks when doing installations / updates.  Tasks sometimes fail and need to be re-run anyway. 

           

          Regarding the Update Tasks, usually I would set them to run immediately too, but I am not sure, if this would work like intended.

           

          - Really, if you need a certain order, schedule them in that order.  That's the only way I would feel confident about it.

          • 2. Re: Where to assign client tasks in epo
            justlearning

            Thank you very much, tkinkead.

             

            Your answers helped me a lot to clarify some issus.

             

            Best regards

            • 3. Re: Where to assign client tasks in epo
              Moe Hassan

              justlearning, Are you familiar with "tags" in ePO? Tags can come very handy in deploying products and assigning policies. Because tags remain with a system even when they are moved out of a particular folder (\Workstation), so whatever you assign to that tag (a specific policy or a task), will travel also. They will work just fine. Look in the "Tag Catalog" option. You can apply tags manually or setup rules. I like tags.

               

              Have fun.

              • 4. Re: Where to assign client tasks in epo
                justlearning

                Hi Moe,

                 

                yep I am using tags too.

                 

                I am not completely sure, if McAfee Epo or the Agent is aware in what order to install the software, when they are all scheduled to run immediately. Like I mentioned in my example, VSE needs a certain Version of McAfee Agent, but it is still one old Agent Version installed on the Client - but the actually needed Version of the Agent is ready for deployment and scheduled for running immediately (like VSE too), I would assume EPO is aware of that and try to install the new Agent first and if it was successfull install the VSE, not the other way around.

                 

                Would be nice if you could create such dependecies in the Epo yourself, if that logic isn't implemented by the McAfee Team. (e.g. Run Agent Deploy --> Run VSE Deploy --> Update DAT and Engine --> ... )

                 

                Sure I can schedule to run the Agent Task at 8 AM and VSE Installation at 8:30 AM, but I just wanted to be sure, that people get the up-to-date software, as soon as they switch on their computers or the laptops.