7 Replies Latest reply on Jul 24, 2017 10:51 AM by bretzeli

    ENS 10.5.1 new HF2 over old HF2 ???

    zahni

      Hi,

       

      we had already deployed the  old  HF2 on some machine. We are now experience some delay an other  issues on our Windows 7 machines.

      How can we  deploy the new HF2 on all machines? Both patches  are not the same, the MSP installer has different contents. After installation, some DLLs seams to be changed, compared to the first version of that HF2.

      Sadly, the build numbers of the new HF2 are the same and our clients don't download and install the new version over the old HF2.

       

      Some examples of changed DLLs:

       

      exclusionbl.dll 

      ScriptScanBL.dll

      amcfg.exe

      JcmInterfaceDll.dll

      [...]

        • 1. Re: ENS 10.5.1 new HF2 over old HF2 ???
          yaz

          McAfee Endpoint Security 10.5.1 Hotfix 2 is now available.

          For a full list of changes, see the Release Notes in PD27121:https://kc.mcafee.com/corporate/index?page=content&id=PD27121

           

           

          It is mandatory to have AMcore content version 3004.0 (released on June 7th) or higher in the ePO repositories before installing HF2. HF2 will upgrade the AMCore version to 1.5.0.2900.7 which requires the latest content: https://kc.mcafee.com/corporate/index?page=content&id=KB89510

           

           

          Do not check in HF2 or HF1 into the same branch of the ePO master repository as ENS 10.5 patch 1 MSP package KB89469: https://kc.mcafee.com/corporate/index?page=content&id=KB89469

           

           

          Ensure verification of installation and preferably reboot. For version reporting info see KB89399:https://kc.mcafee.com/corporate/index?page=content&id=KB89399

           

           

          HF2 only applies to ENS 10.5.1 RTW or 10.5.1 RTW + HF1.

          To download McAfee Endpoint Security 10.5.1 Hotfix 2, go to the Product Downloads site at:http://www.mcafee.com/us/downloads/downloads.aspx

           

           

          For a list of Known Issues, see KB82450: https://kc.mcafee.com/corporate/index?page=content&id=KB82450

          • 2. Re: ENS 10.5.1 new HF2 over old HF2 ???
            zahni

            Thx, but not helpful. I already known that.

             

            The problem (again): The old Hotfix 2 (was pulled by Mcafee) contains not the same code as the new Hotfix 2.

            We are unable to install the new Hotfix 2 over the old Hotfix 2.

            • 3. Re: ENS 10.5.1 new HF2 over old HF2 ???
              dvarnell

              Here is the KB article for the original HF2:

               

              McAfee Corporate KB - Endpoint Security 10.5.1 Hotfix 2 has been reposted to the download server KB89509

               

              1. After installation of ENS 10.5.1 Hotfix 2, the AMCore content version is reported as .5. After the hotfix installation, a content update will run and download new content. Ensure the repository that the updates run from has content newer than AMContent 3004 (released June 7, 2017).

               

              2. If the ENS 10.5.1 package and the ENS 10.5.1 Hotfix 2 package are in the same branch of the Master Repository, the ENS 10.5.1 package is downloaded to the end node at each McAfee Agent agent-to-server communication interval (ASCI).

               

              Therefore, if these scenarios don't apply, then there would be no reason to replace the existing HF2 on machines that have it with the new one, but I would probably go ahead and remove the original HF2 from ePO and just use the new one for further upgrades.

              • 4. Re: ENS 10.5.1 new HF2 over old HF2 ???
                zahni

                THX, but again: This ist not my problem.

                 

                The Problem  OLD Hotfix 2 <> NEW Hotfix 2

                The new Hotfix contains different code but the  same build numbers.

                NEW Hotfix  2  will be correctly deployed to system without OLD or NEW Hotfix 2.

                But systems  with the old Hotfix 2  does not install NEW Hotfix 2 because the  same build numbers,

                • 5. Re: ENS 10.5.1 new HF2 over old HF2 ???
                  bretzeli

                  Hello @Zahni,

                   

                  Same <maybe> here. Any further inof on this? Did you open a case with Mcafee on your side?

                  Did you identify the different version by?

                   

                  * New File

                  * Date of Files

                   

                  Thanks

                   

                  Plattform: 10.5.1.1216

                  Endpoint Security Threat Prevention: 10.5.1.1294

                  Endpoint Security Adaptive Threat Protection: 10.5.1.1166

                  DLP Endpoint: 11.0.0.1162

                  McAfee DXL Client: 3.0.0.285

                  Agent: 5.0.5.658

                  • 6. Re: ENS 10.5.1 new HF2 over old HF2 ???
                    bretzeli

                    TODAY:

                     

                    2 (TWO) TIER 2 Support person JUST explained me today on PHONE that:

                     

                    * You can easy detect if you have Original HF2 Post OR if you have Re-Post HF2

                    * I told them that this is not possible by EPO or GUI of client. We need more INFO regarding DLL/FILE/Registry to identify the HF2 malformed which where DEPLOYED. With a LINK to Forum entry where two partner mentioned that

                    * MCAFEE gave a recommandation to FULLY deinstall ENS 10.5.X with the HF2 MSP and then ROLL out the correct version in a 24/7 operation goverment just a few days away from next impact of ransomware...

                     

                    10 Minutes later we get an E-Mail that it's not possible to IDENTIFY the malformed or correct RE-post.

                    The guy who opend the ticket did not even read it. Asking questions which where 1:1 in the ticket.

                     

                    Wie soeben besprochen, ist das weitere Vorgehen wie gefolgt:

                     

                    Entfernen Sie die komplette ENS Suite entweder via Client Task oder via Removal Tool und installieren Sie nach erfolgreicher Deinstallation die ENS 10.5.1 inkl. neue HF 2.

                     

                    Ich habe erneut beim SEO nachgefragt und offenbar gibt es doch keinen Unterschied zwischen den Build-Nummern von den Hotfix Versionen
                    (leider). Hier ist zu mindest die Liste der aktuellen Build-Nummern:

                     

                    https://kc.mcafee.com/resources/sites/MCAFEE/content/live/PRODUCT_DOCUMENTATION/ 27000/PD27121/en_US/Endpoint_Security_10_5_1_Hotfix_2_Release_Notes.pdf

                     

                    Es wäre ev. trotzdem ein Versuch Wert eine Abfrage mit der Versionen zu erstellen, um zu sehen, ob es Unterschiede gibt. Ich habe
                    meine Version hiervon angehängt, vielleicht hilft es ja.

                     

                    Sollten Sie Unterstützung brauchen oder Fragen haben, zögern Sie bitte nicht, mich zu kontaktieren.

                     

                    Freundliche Grüsse

                     

                    Endpoint Product Specialist

                    EMEA Business Support

                    Mcafee

                    • 7. Re: ENS 10.5.1 new HF2 over old HF2 ???
                      bretzeli

                      Hello,

                       

                       

                      The HF2 original Post AND the Re-Post of HF2 seemed identical in Binary AND function is our latest info from Mcafee side. Uclear to us why it was re-released in that case.

                       

                      We have "heard" that there is an early BETA from ENS PATCH 10.5.2 which will address this issue regarding performance. It's unclear to date when that version will come out RTM.

                       

                       

                      Greeting from Switzerland

                      1 of 1 people found this helpful