2 Replies Latest reply on Jun 8, 2011 9:49 AM by Marvin

    Source Code to force McAfee agent to create new AgentGUID

      I wrote a little VB.net 2010 application and thought I would share it

      Since I read in the McAfee agent documentation that you have to delete some registry values in order to use the McAfee Agent in an image deployment and me being lazy decided to write a program to automate this. Below is the source code.

       

      If you would like to use this

      1. download  VB.net 2010 express edition.

      2. Create a new Console Application

      3. Paste in code

      4. Make sure the computer in question has .Net 4.0 and Windows installer 3.1 installed on it.

       

      It was tested for 32-bit but should work for 64-bit

      Note:

      I am not a programmer just took a class on it in college so there could be some code improvements.

       

      If you see something i could add let me know

       

      ________________________________________________________________________________ ____________________

       

       

      Code

      Imports System.ServiceProcess


      'Program:
      ' 1.Stops the mcafee agent service
      ' 2.Deletes some registry keys that will force the McAfee agent to create a new AgentGUID on service restart
      ' 3.Tells McAfee Agent to send a properties update to the EPO server

      ' This program worked for me on 32-bit clients I added 64-bit support but I didn't test to make sure it would work.
      '
      'License
      'You take a risk using this program that you will not hold me responsible for if it breaks anything or it causes the end of the world etc.
      'Anyone is free to use this, alter it, or whatever they want except McAfee employees or a third party employed by McAfee
      'Condition of McAfee or said third party to use source code:
      '              1. Purchase me a 12 pack of Fat Tire Beer since i can't get any in my state
      '
      'Notes
      'This program needs some more error handling on some things as I am not a programmer nor claim to be
      'I did a half *** job on the commenting but I have seen worse

      'This program was made for Mcafee Agents using default paths
      'Version tested with 4.5 of agent and EPO 4.6
      'I offer no support
      'Nor is this supported by or created by McAfee


      'Requires .NET 4.0
      'Windows installer 3.1

       


      Module McafeeAgentGuidChange

          Sub Main()


              Console.WriteLine("This batch file removes McAfee Agent GUID and MacAddress reg values")
              Console.WriteLine("and forces the McAfee Agent to collect and send its properties")
              Console.WriteLine("__________________________________________")
              Console.Write("Checking if McAfee Agent is installed...")
              Call CheckIfServiceExists() ' Check if service exists
              Dim strComputerName As String ' Computer name
              Dim sc As New ServiceController("McAfeeFramework") ' Mcafee agent service that must be stopped
              Dim InfLoopPrev As Integer ' Used to break a loop

              strComputerName = Environment.MachineName ' get computer name
              InfLoopPrev = 0
              '________________________________________________________________________
              'Different Ways to get a computer name
              'string name = System.Net.Dns.GetHostName();
              'string name = System.Windows.Forms.SystemInformation.ComputerName;
              'string name = System.Environment.GetEnvironmentVariable(“COMPUTERNAME”);
              '_________________________________________________________________________


              Console.WriteLine("The McAfeeFramework service status is currently set to {0}", sc.Status)

              'Stop program if image
              'This is done based on computer name for my company so if the computername is the default image name then end program
              If strComputerName = "ComputerName" Then
                  Console.WriteLine("Please change the name of this PC before updating the AgentGUID with EPO")
                  Console.ReadLine()
                  End
              End If

              Call CheckIfServiceExists() ' checks if service exists if not terminate program


              'This just assumes that the mcafee agent will stop if in a stop pending status Could be some code improvements here
              If sc.Status.Equals(ServiceControllerStatus.Stopped) Or sc.Status.Equals(ServiceControllerStatus.StopPending) Then

              Else
                  ' Stop the service if its status is not set to "Stopped".
                  Console.WriteLine("Stopping the McAfeeFramework service...")
                  sc.Stop()
              End If


              ' Refresh and display the current service status.
              sc.Refresh()
              Console.WriteLine("The McAfeeFramework service status is set to {0}.", sc.Status)

              'Delete Registry Keys for Mcafee Agent
              Call DeleteMcafeeKeys()


              ' Start the McAfee service
              Console.WriteLine("Starting the McAfeeFramework service in 5 seconds...")
              Console.WriteLine()
              'some reason an exception would occur so i had to sleep it for a few secondsA
              Sleep(10000) ' Sleep for 5 seconds
              sc.Start() 'Mcafee agent service started


              Sleep(10000) ' sleep 10 seconds to allow Mcafee service to start
              sc.Refresh() ' refresh service

              'Try to force collection send to epo only if service started attempt 3 times on third break loop and send error
              Do Until sc.Status = ServiceControllerStatus.Running Or InfLoopPrev >= 3
                  If sc.Status = ServiceControllerStatus.Running Then
                      ForceCollectionSend()
                  Else
                      Console.WriteLine("Service didn't start trying again " & InfLoopPrev & " of 3")
                      Console.WriteLine()
                      Sleep(5000)
                      InfLoopPrev = InfLoopPrev + 1
                      sc.Refresh()
                  End If

              Loop

              'If loop prevention reached 3 times send error
              If InfLoopPrev >= 3 Then
                  Console.WriteLine("Error: You will have to manualy start the McAfeeFramwork service and Send collect and send properties")
                  Console.WriteLine()
              Else
                  ForceCollectionSend()
                  Console.WriteLine("Seems to have worked Enjoy!")
                  Console.WriteLine()
                  Sleep(4000) ' Sleep 4 seconds
              End If
          End Sub

          Sub DeleteMcafeeKeys()

              'You could shorten this part just got lazy
              'Deletes AgentGUID and MacAddress values in with the str32bitpath or str64bitPath
              Console.Write("Attempting to Delete Keys")

              Dim StrAgentGUID As String = "AgentGUID"
              Dim StrMacAddress As String = "MacAddress"
              Dim str32BitPath As String = "SOFTWARE\Network Associates\ePolicy Orchestrator\Agent"
              Dim str64bitPath As String = "Software\Wow6432Node\Network Associates\ePolicy Orchestrator\Agent"

              Try
                  'Checks if OS is 64-bit or 32-bit
                  If Environment.Is64BitOperatingSystem = False Then

                      '32-bit Keys
                      'AgentGUID
                      Console.WriteLine()
                      Console.Write("Deleting 32-bit AgentGUID")
                      Console.WriteLine()
                      Console.Write("Deleting " & StrAgentGUID)
                      Console.WriteLine()
                      My.Computer.Registry.LocalMachine.OpenSubKey(str32BitPath, True).DeleteValue(StrAgentGUID)

                      'MacAddress
                      Console.Write("Deleting 32-bit MacAddress")
                      Console.WriteLine()
                      Console.Write("Deleting " & StrMacAddress)
                      Console.WriteLine()
                      My.Computer.Registry.LocalMachine.OpenSubKey(str32BitPath, True).DeleteValue(StrMacAddress)

       

                  ElseIf Environment.Is64BitOperatingSystem = True Then

                      '64-bit Keys
                      'AgentGUID
                      Console.Write("Deleting 64-bit AgentGUID")
                      Console.WriteLine()
                      Console.Write("Deleting " & StrAgentGUID)
                      Console.WriteLine()
                      My.Computer.Registry.LocalMachine.OpenSubKey(str64bitPath, True).DeleteValue(StrAgentGUID)

                      'MacAddress
                      Console.Write("Deleting 64-bit MacAddress")
                      Console.WriteLine()
                      Console.Write("Deleting " & StrMacAddress)
                      Console.WriteLine()
                      My.Computer.Registry.LocalMachine.OpenSubKey(str64bitPath, True).DeleteValue(StrMacAddress)
                  End If
              Catch ex As Exception ' Writes errors to console
                  Console.WriteLine()
                  Console.Write(ex)
                  Console.WriteLine()
              End Try
              Console.WriteLine()
              Console.WriteLine("Finished Removing Values...")

          End Sub


          Sub CheckIfServiceExists()
              'checks if service exists if not stop program
              Dim services() As ServiceController =
           ServiceController.GetServices()

              For Each service As ServiceController In services

                  If service.ServiceName.Contains("McAfeeFramework") Then
                      Console.WriteLine("McAfee Agent is installed")
                      Exit Sub
                  End If

              Next
              Console.WriteLine("Error: McAfee Agent isn't installed")
              Console.WriteLine("um in order to change the Agent GUID")
              Console.WriteLine("McAfee Agent has to be installed.... ")
              Console.ReadLine()
              End
          End Sub


          Private Declare Sub Sleep Lib "kernel32" (ByVal dwMilliseconds As Long)
         
          Sub ForceCollectionSend()
              Dim str32BitPath As String = "SOFTWARE\Network Associates\ePolicy Orchestrator\Agent"
              Dim str64bitPath As String = "Software\Wow6432Node\Network Associates\ePolicy Orchestrator\Agent"
              Dim strInstallPath As String
              Dim strPath As String
              strInstallPath = "Installed Path"

              'Checks if 64-bit os or 32-bit to get installation path
              'Then runs the cmdagent.exe /p command which forces a collection and send of properties
              If Environment.Is64BitOperatingSystem = False Then
                  strPath = My.Computer.Registry.LocalMachine.OpenSubKey(str32BitPath, True).GetValue(strInstallPath)
              ElseIf Environment.Is64BitOperatingSystem = True Then
                  strPath = My.Computer.Registry.LocalMachine.OpenSubKey(str64bitPath, True).GetValue(strInstallPath)
              Else
                  strPath = My.Computer.Registry.LocalMachine.OpenSubKey(str32BitPath, True).GetValue(strInstallPath)
              End If


              Shell(strPath & "\cmdagent.exe /P") ' uses the cmdagent mcafee program to force send properties

          End Sub
      End Module

       

       

       

       

       

      Message was edited by: tonyu on 5/20/11 8:45:16 AM CDT

       

      Message was edited by: tonyu on 5/20/11 8:47:26 AM CDT

       

      Message was edited by: tonyu on 5/20/11 8:49:59 AM CDT

       

      Message was edited by: tonyu on 5/20/11 8:54:34 AM CDT