1 2 Previous Next 10 Replies Latest reply on Apr 20, 2012 3:40 AM by JoeBidgood

    How does ePO determine if and what version of McAfee Antivirus is installed on a PC?

    epo4city

      I recently was giving the responsibility of managing the ePO system for the City of Chicago and have been struggling to get this system in shape and all 8000 PC's in compliance.   We run ePO 4.0 update 3 using agent 4.0.0.1494.  One big issue I have noticed with many of the out of complaince machines is the ePO system reports they have no version of McAfee installed and when I check the machine with Landesk it does have the current version, we use 8.7i, along with newest engine and DATS installed and working/updating, properly.  I end up having to manually remove and then reinstall the McAfee antivirus client on these machines to get them to show up in ePO as having the antivirus client installed.  So my question is how does ePO know if the antivirus client is installed on a particular machine?  Is there some reg key that is missing on these machines that is preventing the ePO server from seeing it's installed or any fix that would be easier than manually reinstalling the client on each of these machines?  Thanks!

        • 1. Re: How does ePO determine if and what version of McAfee Antivirus is installed on a PC?
          mmoroz12

          You should be able to make a client task to install McAfee instead of manually reinstalling it.

           

          You may want to also think about upgrading your ePO. ePO 4.0 was end of life september 30 2011

          • 2. Re: How does ePO determine if and what version of McAfee Antivirus is installed on a PC?
            epo4city

            mmoroz12,  I do have a task to install McAfee VSE on the ePO server.  The problem is VSE needs to be uninstalled from the workstation before it can be reinstalled.  I have to use Landesk to run a script to uninstall then I have to run the VSE install task with either Landesk or ePO and it works fine then.  It's just really strange that VSE is actually installed and functioning properly, ie getting DAT updates, but just isn't reported as being installed in ePO.

             

            I know ePO is way out of date.  The system has been seriously neglected the last couple of years.  My plan is to get as many PC's in compliance as possible and then upgrade to 4.6.

             

            Thanks!

            • 3. Re: How does ePO determine if and what version of McAfee Antivirus is installed on a PC?
              mmoroz12

              You might have a problem with the agents on the systems that are showing that they are not compliant.

              • 4. Re: How does ePO determine if and what version of McAfee Antivirus is installed on a PC?
                pankajs

                Did u check the epo & VSE compliance  queries configuration  with the agent version, vse version?

                • 5. Re: How does ePO determine if and what version of McAfee Antivirus is installed on a PC?
                  JoeBidgood

                  When a point product like VirusScan is installed on a client machine, it puts a registry entry in HKLM\Software\Network Associates\ePolicy Orchestrator\Application Plugins. The agent uses these entries to determine what is actually installed on the machine.

                   

                  Can you export this reg key from one of the affected machines and attach it here as a text file? If you can also attach the agent log that would be helpful

                   

                  Thanks -

                   

                  Joe

                  • 6. Re: How does ePO determine if and what version of McAfee Antivirus is installed on a PC?
                    epo4city

                    Joe, Thanks for the information/suggestions i will check it out on Thursday when I'm working on this again and I will try and post the reg entries and agent log from an affected machine.

                    • 7. Re: How does ePO determine if and what version of McAfee Antivirus is installed on a PC?
                      epo4city

                      Joe,  Here's a pic of the state of one of the affected machines.  You can see ePO doesnt think Virusscan is installed even though it is.  Below this is the exported reg information.  Looks to me like there's an entry for virusscan in the registry already.  Finally I've attached a log of the agent right after evoking the task to install/update mcafee.  Looks like it saw mcafee is installed and updated the dat files successfully.  Any insite would be appreciated.  Thanks!

                       

                      ScreenHunter_01 Apr. 19 10.00.jpg

                       

                      Windows Registry Editor Version 5.00

                       

                       

                      [HKEY_LOCAL_MACHINE\SOFTWARE\Network Associates\ePolicy Orchestrator\Application Plugins]

                       

                       

                      [HKEY_LOCAL_MACHINE\SOFTWARE\Network Associates\ePolicy Orchestrator\Application Plugins\CMNUPD__3000]

                      "Plugin Path"="C:\\Program Files\\McAfee\\Common Framework\\agentplugin.dll"

                      "Software ID"="CMNUPD__3000"

                      "Language"="0000"

                      "Product Name"="McAfee AutoUpdate"

                      "Version"="4.0.0.1494"

                      @=""

                      "Plugin Flag"=dword:0000000f

                       

                       

                      [HKEY_LOCAL_MACHINE\SOFTWARE\Network Associates\ePolicy Orchestrator\Application Plugins\EPOAGENT3000]

                      "Language"="0409"

                      @=""

                      "Version"="4.0.0.1494"

                      "Plugin Path"="C:\\Program Files\\McAfee\\Common Framework\\agentplugin.dll"

                      "Software ID"="EPOAGENT3000"

                      "Uninstall Command"="\"C:\\Program Files\\McAfee\\Common Framework\\frminst.exe\" /Remove=Agent /Silent"

                       

                       

                      [HKEY_LOCAL_MACHINE\SOFTWARE\Network Associates\ePolicy Orchestrator\Application Plugins\EPOAGENT3000META]

                      "Plugin Path"="C:\\Program Files\\McAfee\\Common Framework\\agentplugin.dll"

                      "Software ID"="EPOAGENT3000META"

                      "Plugin Flag"=dword:00000001

                      "Uninstall Command"=""

                       

                       

                      [HKEY_LOCAL_MACHINE\SOFTWARE\Network Associates\ePolicy Orchestrator\Application Plugins\PCR_____1000]

                      @=""

                      "Plugin Path"="C:\\Program Files\\McAfee\\Common Framework\\pcrplug.dll"

                      "Version"="4.0.0.1494"

                      "Software ID"="PCR_____1000"

                      "Uninstall Command"=""

                      "Language"="0000"

                      "Product Name"="Product Coverage Report"

                      "Plugin Flag"=dword:00000002

                       

                       

                      [HKEY_LOCAL_MACHINE\SOFTWARE\Network Associates\ePolicy Orchestrator\Application Plugins\SYSPROPS1000]

                      "Plugin Path"="C:\\Program Files\\McAfee\\Common Framework\\agentplugin.dll"

                      "Software ID"="SYSPROPS1000"

                      "Uninstall Command"=""

                      "Plugin Flag"=dword:00000002

                       

                       

                      [HKEY_LOCAL_MACHINE\SOFTWARE\Network Associates\ePolicy Orchestrator\Application Plugins\VIRUSCAN8700]

                      "Product Name"="McAfee VirusScan Enterprise Workstation"

                      "Language"="0000"

                      "CLSID"="{9BE8D8A1-2DB5-4A29-A95F-50C8B27820DA}"

                      "Plugin Path"="C:\\Program Files\\McAfee\\VirusScan Enterprise\\VsPlugin.dll"

                      "Installs CMA"=dword:00000001

                      "Uninstall Command"="msiexec /x {147BCE03-C0F1-4C9F-8157-6A89B6D2D973} REMOVE=ALL REBOOT=R /q"

                      "Install Path"="C:\\Program Files\\McAfee\\VirusScan Enterprise\\"

                      "Version"="8.7.0.570"

                      "McTrayAboutBoxDisplay"=dword:00000000

                      "HotFixVersions"="1"

                      "Software ID"="VIRUSCAN8700"

                      "EngineInstallDate"="20100303085946"

                      "EngineVersion"="5400.1158"

                      "DatDate"="04182012"

                      "DatInstallDate"="20120419071243"

                      "DATVersion"="6685.0000"

                      "Plugin Flag"=dword:00000008

                       

                       

                       

                      Thursday, April 19, 2012 9:58:36 AM  Info  Scheduler  Scheduler: Invoking task [McAfee 8.7]...

                      Thursday, April 19, 2012 9:58:36 AM  Info  Updater  Checking update packages from repository ePO_DC07AVVW01.

                      Thursday, April 19, 2012 9:58:36 AM  Info  Updater  Initializing update...

                      Thursday, April 19, 2012 9:58:36 AM  Info  Updater  Verifying catalog.z.

                      Thursday, April 19, 2012 9:58:36 AM  Info  Updater  Extracting catalog.z.

                      Thursday, April 19, 2012 9:58:36 AM  Info  Updater  Loading update configuration from: catalog.xml

                      Thursday, April 19, 2012 9:58:37 AM  Info  Updater  Checking for software conflicts.

                      Thursday, April 19, 2012 9:58:37 AM  Info  Updater  Verifying VSE870Det.McS.

                      Thursday, April 19, 2012 9:58:38 AM  Info  Updater  Downloading PkgCatalog.z.

                      Thursday, April 19, 2012 9:58:38 AM  Info  Updater  Verifying PkgCatalog.z.

                      Thursday, April 19, 2012 9:58:38 AM  Info  Updater  Extracting PkgCatalog.z.

                      Thursday, April 19, 2012 9:58:38 AM  Info  Updater  Loading update configuration from: PkgCatalog.xml

                      Thursday, April 19, 2012 9:58:39 AM  Info  Updater  Installing VIRUSCAN8700.

                      Thursday, April 19, 2012 9:58:39 AM  Info  Updater  Verifying msistrings.bin.

                      Thursday, April 19, 2012 9:58:39 AM  Info  Updater  Verifying setupvse.exe.

                      Thursday, April 19, 2012 9:58:39 AM  Info  Updater  Verifying setup.ini.

                      Thursday, April 19, 2012 9:58:39 AM  Info  Updater  Verifying Uninst.exe.

                      Thursday, April 19, 2012 9:58:39 AM  Info  Updater  Verifying Uninstx64.exe.

                      Thursday, April 19, 2012 9:58:39 AM  Info  Updater  Verifying UnInst.Ini.

                      Thursday, April 19, 2012 9:58:39 AM  Info  Updater  Verifying VSE870.msi.

                      Thursday, April 19, 2012 9:58:39 AM  Info  Updater  Verifying WindowsInstaller-KB893803-v2-x86.exe.

                      Thursday, April 19, 2012 9:58:45 AM  Info  Updater  Update succeeded to version 8.7.0.

                      Thursday, April 19, 2012 9:58:45 AM  Info  Updater  Verifying MAS870det.mcs.

                      Thursday, April 19, 2012 9:58:45 AM  Info  Updater  Verifying MAS870det.mcs.

                      Thursday, April 19, 2012 9:58:45 AM  Info  Updater  Update Finished

                      Thursday, April 19, 2012 9:58:45 AM  Info  Scheduler  The task McAfee 8.7 is successful

                      Thursday, April 19, 2012 9:58:45 AM  Info  Scheduler  Scheduler: Task [McAfee 8.7] is finished

                      Thursday, April 19, 2012 9:58:45 AM  Info  Updater  Checking update packages from repository ePO_DC07AVVW01.

                      Thursday, April 19, 2012 9:58:45 AM  Info  Updater  Initializing update...

                      Thursday, April 19, 2012 9:58:45 AM  Info  Updater  Verifying catalog.z.

                      Thursday, April 19, 2012 9:58:45 AM  Info  Updater  Extracting catalog.z.

                      Thursday, April 19, 2012 9:58:45 AM  Info  Updater  Loading update configuration from: catalog.xml

                      Thursday, April 19, 2012 9:58:46 AM  Info  Updater  Update list doesn't exist or is empty. Performing one-click update.

                      Thursday, April 19, 2012 9:58:46 AM  Info  Updater  These updates will be applied if they are in the repository: Engine, DAT, EPOAGENT3000META, SUPERDAT1000, VIRUSCAN8700, SUPPMVTCONTENT_1000, SPAMSAFE1000, BOCVSE__1000, VIRUSCAN8600, ENCPTCNT6000, EXTRADAT1000, MASECORE2000, AMCORDAT1000, PATCHTMP1000, PATCHTMP2000, SUPPCLNT1000.

                      Thursday, April 19, 2012 9:58:46 AM  Info  Updater  Downloading PkgCatalog.z.

                      Thursday, April 19, 2012 9:58:46 AM  Info  Updater  Verifying PkgCatalog.z.

                      Thursday, April 19, 2012 9:58:46 AM  Info  Updater  Extracting PkgCatalog.z.

                      Thursday, April 19, 2012 9:58:46 AM  Info  Updater  Loading update configuration from: PkgCatalog.xml

                      Thursday, April 19, 2012 9:58:47 AM  Info  Updater  Verifying V2engdet.mcs.

                      Thursday, April 19, 2012 9:58:47 AM  Info  Updater  Product(s) running the latest Engine.

                      Thursday, April 19, 2012 9:58:47 AM  Info  Updater  Downloading PkgCatalog.z.

                      Thursday, April 19, 2012 9:58:47 AM  Info  Updater  Verifying PkgCatalog.z.

                      Thursday, April 19, 2012 9:58:47 AM  Info  Updater  Extracting PkgCatalog.z.

                      Thursday, April 19, 2012 9:58:47 AM  Info  Updater  Loading update configuration from: PkgCatalog.xml

                      Thursday, April 19, 2012 9:58:48 AM  Info  Updater  Verifying V2datdet.mcs.

                      Thursday, April 19, 2012 9:58:49 AM  Info  Updater  Downloading PkgCatalog.z.

                      Thursday, April 19, 2012 9:58:49 AM  Info  Updater  Verifying PkgCatalog.z.

                      Thursday, April 19, 2012 9:58:49 AM  Info  Updater  Extracting PkgCatalog.z.

                      Thursday, April 19, 2012 9:58:49 AM  Info  Updater  Loading update configuration from: PkgCatalog.xml

                      Thursday, April 19, 2012 9:58:50 AM  Info  Updater  Starting DAT update.

                      Thursday, April 19, 2012 9:58:50 AM  Info  Updater  Downloading DAT.

                      Thursday, April 19, 2012 9:58:50 AM  Info  Updater  Downloading gdeltaavv.ini.

                      Thursday, April 19, 2012 9:58:50 AM  Info  Updater  Downloading avvdat-6685.zip.

                      Thursday, April 19, 2012 9:59:39 AM  Info  Updater  Backing up file(s) Engine DAT

                      Thursday, April 19, 2012 9:59:41 AM  Info  Updater  Pre-notifying for DAT update.

                      Thursday, April 19, 2012 9:59:41 AM  Info  Updater  Copying DAT.

                      Thursday, April 19, 2012 9:59:44 AM  Info  Updater  Update succeeded to version 6685.0000.

                      Thursday, April 19, 2012 9:59:44 AM  Info  Updater  Post-notifying for DAT update.

                      Thursday, April 19, 2012 10:00:10 AM  Info  Updater  Verifying AgtMetaDet.McS.

                      Thursday, April 19, 2012 10:00:10 AM  Info  Updater  Searching available updates for McAfee Agent Plugin.

                      Thursday, April 19, 2012 10:00:10 AM  Info  Updater  Product(s) running the latest Plugin.

                      Thursday, April 19, 2012 10:00:10 AM  Info  Updater  Verifying SuperDATDet.mcs.

                      Thursday, April 19, 2012 10:00:10 AM  Info  Updater  Searching available updates for SuperDAT.

                      Thursday, April 19, 2012 10:00:10 AM  Info  Updater  Product(s) running the latest SuperDAT.

                      Thursday, April 19, 2012 10:00:10 AM  Info  Updater  Verifying VSE870Det.McS.

                      Thursday, April 19, 2012 10:00:10 AM  Info  Updater  Verifying ePOMVTDetect.McS.

                      Thursday, April 19, 2012 10:00:10 AM  Info  Updater  Verifying SK_det.mcs.

                      Thursday, April 19, 2012 10:00:10 AM  Info  Updater  Verifying BocDet_VSE.McS.

                      Thursday, April 19, 2012 10:00:10 AM  Info  Updater  Searching available updates for BOC DAT.

                      Thursday, April 19, 2012 10:00:10 AM  Info  Updater  Product(s) running the latest BOC DAT.

                      Thursday, April 19, 2012 10:00:10 AM  Info  Updater  Verifying VSE850Det.McS.

                      Thursday, April 19, 2012 10:00:11 AM  Info  Updater  Verifying EceptCntDet.mcs.

                      Thursday, April 19, 2012 10:00:11 AM  Info  Updater  Verifying DATDet.mcs.

                      Thursday, April 19, 2012 10:00:11 AM  Info  Updater  Searching available updates for DATs.

                      Thursday, April 19, 2012 10:00:11 AM  Info  Updater  Product(s) running the latest ExtraDAT.

                      Thursday, April 19, 2012 10:00:11 AM  Info  Updater  Verifying Mase_Det.mcs.

                      Thursday, April 19, 2012 10:00:11 AM  Info  Updater  Verifying amcore.mcs.

                      Thursday, April 19, 2012 10:00:11 AM  Info  Updater  Generic script error.

                      Thursday, April 19, 2012 10:00:11 AM  Info  Updater  Verifying PatchTmpDet.McS.

                      Thursday, April 19, 2012 10:00:11 AM  Info  Updater  Verifying PatchTmpDet.McS.

                      Thursday, April 19, 2012 10:00:11 AM  Info  Updater  Verifying SuppClntDet.McS.

                      Thursday, April 19, 2012 10:00:13 AM  Info  Updater  Generic script error.

                      Thursday, April 19, 2012 10:00:13 AM  Info  Updater  Update Finished

                      • 8. Re: How does ePO determine if and what version of McAfee Antivirus is installed on a PC?
                        JoeBidgood

                        Thought so

                         

                        This is the smoking gun:

                         

                         

                        "Plugin Flag"=dword:00000008

                         

                         

                        Have a look at KB60593  for details.

                         

                        HTH -

                         

                        Joe

                        • 9. Re: How does ePO determine if and what version of McAfee Antivirus is installed on a PC?
                          epo4city

                          Oh my you're a genius!!! It worked!!  Thanks so much!!

                          1 2 Previous Next