7 Replies Latest reply on Nov 13, 2009 3:21 AM by chr.kj

    Protecting McAfee agent from being uninstalled?

      Hello.

      Maby a silly question, but how do I protect McAfee Agent (McAfee Virus Scan Enterprise 8.5) from being uninstalled by users? Is it possible to protect it with a password or something like that?

      The agents are being managed by ePO 4.0

      Thanks in advance for the help.

      Regards
        • 1. Re: Protecting McAfee agent from being uninstalled?

          You can lock down the VSE console with a password from the policy settings in ePO, but if the users are still admins on computers there will always be a way to uninstall whatever applications they don't want, depending on their skills with 'puters .

          • 2. Re: Protecting McAfee agent from being uninstalled?

            Set up an alert in ePO for machines having VSE removed and send automatically to HR every day.. problem solved

             

            Otherwise, as the previous poster said, you can set up access protection rules but if people have admin rights on the machines then there are always way around this. But at least it's not as simple as going to Add/Remove Programs or stopping and disabling the services anymore. A combination of this and an ePO dashboard showing unprotected machines is probably your best bet.

             

            Cheers,

            Matt

            • 3. Re: Protecting McAfee agent from being uninstalled?
              ZeusMaster

              I recall logging a case on behalf of a customer for this once.

              McAfee said they were going to fix this in a later release of the agent but looks like they missed that one. The 4.5 Agent is still listed in ADD/REMOVE

               

              I would recommend logging a case with McAfee. They mentioned that there is a registry entry you could change to stop the agent from being displayed in ADD/REMOVE.

              • 4. Re: Protecting McAfee agent from being uninstalled?

                Try to lock down with one of the VSE Access Protection policies that protects mcafee files and settings. Also enable "Prevent McAfee serives from being stopped.

                 

                As advised earlier you can also set your deployment task to continously check for MA and if not found re-push to that system =) Soon the user will get tired of un-installing...

                 

                - AB

                • 5. Re: Protecting McAfee agent from being uninstalled?
                  wwarren

                  As the earlier comments say, anything that McAfee does to prevent the software from being removed is moot when the user has administrative privileges and some familiarity with Windows. All that can be done in those conditions is make it more difficult for the software to be removed, and that has pros and cons too, or trying to ensure the product gets reinstalled soon after removal (also with pros and cons).

                   

                  Using a password is pretty effective, but problematic if it's required and nobody in the company knows what it is because the person who created it left. And having a password-override defeats the purpose of having a password.

                  Hiding the remove option via add/remove programs might raise the bar for users being able to remove the product (or Agent), but they'll learn how to remove the product anyway if they're determined. Itis only a registry value, and an admin can edit the registry or could google to find out how it's done. Likewise with hiding the product from displaying at all in add/remove programs.

                  McAfee is also hesitant when it comes to providing "loaded guns" to customers - features so powerful if used incorrectly you can cripple your business. Access Protection is like that, but is required for zero-day protection. My point is, coming up with a way to prevent removal of the software (or components of it) needs careful consideration.

                   

                  The best answer at this time is to not give users administrative privileges. But please, do not hesitate from submitting Feature Modification Requests and including the business justification behind the idea, even if you think it has been submitted before. Repetition gains visibility, and warrants further thought for a solution.

                  • 6. Re: Protecting McAfee agent from being uninstalled?

                    For details on submitting a Feature Modification Request (FMR), see KnowledgeBase article  KB60021

                     

                    For contact details:
                    Go to: http://www.mcafee.com/us/about/contact/index.html
                    Non-US customers - select your country from the list of Worldwide Offices.


                    Alternatively:
                    Log in to the ServicePortal at: https://mysupport.mcafee.com:

                    If you are a registered user, type your User Id and Password and click OK.
                    If you are not a registered user, click New User and complete the required fields. Your password and login instructions will be emailed to you.



                    • 7. Re: Protecting McAfee agent from being uninstalled?

                      Thanks for all of the replys

                       

                      Now I have something to work with.