1 2 Previous Next 10 Replies Latest reply on Jun 7, 2011 6:52 AM by JoeBidgood

    EPO and MCAFEE AGENT in NLB Enviorment



      This is the scenario:


      I have 2 servers (Windows 2003) in NLB cluster enviorment. In the EPO Console I register one, but when the other one does a agent wakeup it eliminates the first one from the EPO  :s


      I tried KB:



      With no success.....


      any sugestions?

        • 1. EPO and MCAFEE AGENT in NLB Enviorment

          I had  the same problem, and used the kb57886 and it work. I started with uninstalling the agent on both my nlb machines first, then i disable the macsearch, restartet the Epo Server Services, install agent on pc1 at get it all the way into EPO, then i installed pc2, and both machines was in epo on the same time, if you dont uninstall the agent complete, the agent guid id in registry are still the same, and the agent will only use this for communication with epo. It is possible that you could try stoppe agent framework om the two pc's and delete the agent guid from registry and start agent again, but I have never tried that

          • 2. EPO and MCAFEE AGENT in NLB Enviorment

            It appears that someone has edited that document and introduced a mistake     I have corrected this and taken steps to prevent it happening again...


            The correct steps are given below: the important part is the Options subkey.


            Step 1 - Disable the MAC search 

            1. Click Start, Run, type regedit and click OK.

              Navigate to and select the following registry key:
                  [HKEY_LOCAL_MACHINE\SOFTWARE\Network Associates\ePolicy Orchestrator]

            3. Right-click the ePolicy Orchestrator key and select New, Key.
            4. Type Options as the name of the new key.
            5. Right-click the new Options key and select New, String Value.
            6. Name the new string DisableMACSearch.
            7. Right-click the DisableMACSearch key and select Modify.
            8. Set the Value data to 1 and click OK.
            IMPORTANT: It is essential that the new value is created in the correct key. Confirm that the new key is:
            • [HKEY_LOCAL_MACHINE\SOFTWARE\Network Associates\ePolicy Orchestrator\Options\DisableMACSearch]
            • Value data for DisableMACSearch is specified as 1



            If you follow these steps you should be able to get both machines added to ePO: make sure you turn the mac search on again when they are


            Thanks -



            • 3. EPO and MCAFEE AGENT in NLB Enviorment

              I managed to resolve this, making a tweak on the XML file of the agent on one of the servers, just changed the mac address temporarily until both got registered.


              First you have DisableMACSearch registry key as mentioned above.


              Then change the registry key: HKLM\SOFTWARE\Network Associates\ePolicy Orchestrator\Agent\MacAddress.


              And then:


              C:\Documents and Settings\All Users\Application Data\McAfee\Common Framework\


              You have to tweak lastprop.xml and incrprop.xml. just change the MacAddress Temporarily, then make a Collect and Send Props.


              The object its to fake EPO with another mac address until both server get registered on EPO. You're going to see it on Lost&Found.



              • 4. EPO and MCAFEE AGENT in NLB Enviorment

                Hm - you shouldn't have needed to edit any files: just disabling the mac search should have been enough - but at least it's OK now


                Regards -



                • 5. Re: EPO and MCAFEE AGENT in NLB Enviorment

                  Hi guy's, I'm having the same problem with my new installed Epo 4.6.

                  DisableMACSearch worked fine for Epo4.5 and lower but it's not worlking for Epo 4.6

                  Please help.

                  I also tried with the "Detected System Matching" in the server settings but that didn't help.



                  • 6. Re: EPO and MCAFEE AGENT in NLB Enviorment

                    Hello blindpepper,


                    In our case, I tried something more technical, I tricked the common framwork XML file.


                    There are 3 XML files in the All Users\Application Data\McAfee\Common Framework.


                    First you have to disable MAC Search as JoeBidGood posted, then you change the mac address on the files:





                    -Issue send props.


                    What is going to happen its that both servers are going to register in the console with different mac address, then you can fix the Mac address on the host system or delete these files, the agent is going to generate it again.


                    Consider that you have to put these systems on exceptions in Rogue System Detection


                    If you want more info just sent me a message.





                    • 7. Re: EPO and MCAFEE AGENT in NLB Enviorment



                      I've just tested it with 4.6, and DisableMacSearch works in exactly the same way as before. There's no need to edit any agent-side files...

                      Can you confirm that you've definitely created the Options key, the value is a string, and its data is set to 1?


                      Thanks -




                      Message was edited by: JoeBidgood - put DWORD by mistake :) on 01/06/11 15:34:21 GMT
                      • 8. Re: EPO and MCAFEE AGENT in NLB Enviorment

                        Hello Joe,


                        Yes, I created the options key and the string but it is not working for me


                        • 9. Re: EPO and MCAFEE AGENT in NLB Enviorment

                          Ok my fault, I created it under \McAfee\Epolicy Orchestrator and it has to be \Network Assosiates\Epolicy Orch..

                          It's working now. Thanks for the help

                          1 2 Previous Next