2 Replies Latest reply on Apr 3, 2012 6:14 PM by Kary Tankink

    HIPS 8, having big problems

    Steve Chmiewliski

      Hello All

       

      Current set-up is ePO 4.5 and Agent 4.5.0.1852, HIPS 8 (8.0.0.1919

       

      Please I need some help, have installed HIPS 8 in a test environment, deployedand have it working with Windows Xp and Windows 7 with no issues what so ever.

       

      The issue I now have is that I have added HIPS 8 into the production ePO environment, but when it is deployed to an endpoint I'm missing the manage feature McAfee Host Intrusion Prevention from the agent shield in the system task tray. All settings / policies are set the same as in the test environment

      Also if I manually start the console by running McAfeeFire.exe from within the systemdrive:\Program Files\McAfee\Host Intrusion Prevention I only see 2 tabs Firewall Policy and Activity Log. It seems to be a complete mess, also there are a bunch of log files missing including the HipShield.log.

      I have tried re-adding the software to the ePO repository, uninstalling HIPS from the client and re-installing it, but still get the same issue

       

      Has anyopne seen this before and if so how did you fix it.

       

      Thanks in advance

      Steve

        • 1. Re: HIPS 8, having big problems
          masten

          Have you checked that you have all of the three Host IPS extensions installed? When I read your description it seems that ePO is missing the license extension for Host IPS.

           

          /Magnus

           

          HIPS Extensions.png

           

          on 4/3/12 10:44:08 PM CEST
          • 2. Re: HIPS 8, having big problems
            Kary Tankink

             

            The issue I now have is that I have added HIPS 8 into the production ePO environment, but when it is deployed to an endpoint I'm missing the manage feature McAfee Host Intrusion Prevention from the agent shield in the system task tray.

            Make sure your Host IPS 8.0 General Client UI policy is set to show the HIPS tray icon.  Once this is active on the client, you will see the HIPS product listed under McAfee Agent Manage Features.  When installing Host IPS, the default configuration that it uses is NOT to show the tray icon, until it gets a policy from the ePO server to show it.

             

             

            Also if I manually start the console by running McAfeeFire.exe from within the systemdrive:\Program Files\McAfee\Host Intrusion Prevention I only see 2 tabs Firewall Policy and Activity Log.

            This is by design with Host IPS 8.0.  IPS is not activated until it contacts the ePO server that has the Host IPS 8.0 IPS License extension installed.  Until the McAfee Agent communication has been done, you will not see the IPS tab in the Host IPS Client UI (this is as-designed functionality that has changed from the Host IPS 7.0 product version).

             

             

            It seems to be a complete mess, also there are a bunch of log files missing including the HipShield.log.

            The default configuration that Host IPS 8.0 installs with is to disable all logging (edit: except for logging to the Host IPS Activity log), until the McAfee Agent has communicated with the ePO server to download the General Client UI policy (where you might have enabled Host IPS logging).

             

            Message was edited by: ktankink on 4/3/12 6:14:55 PM CDT