Hmm, some extra searching thru epo, and i can answer my question myself.
Duplicate 3 default policies:
- Access Protection Plicies
- On Delivery Email Scan Policies
- On -Access General Policies
Edit the dublicate (i called them 'disable'), and uncheck almost all checkboxes i could find.
Go to the system tree, and edit the assignments, and broke the inheritance and assign the 'disable' policy.
Then on the machines, checked for new policies and enforced them. (Or just wait until Epo updates the policies automatically).
I don't think you can disabled via ePO
You could possibly do it by disabling access protection via a policy and then using a cmd script to disable McAfee services with 'SC'
SC is a command line program used for communicating with the Service Control Manager and services.
sc <server> [command] [service name] <option1> <option2>...
The option <server> has the form "\\ServerName"
Further help on commands can be obtained by typing: "sc [command]"
So the following will disable the framework service and VSE service
sc \\computer stop McAfeeFramework
sc \\computer stop McShield
or possibly the McAfee Profiler might be a better tool to analyse VSE performance
http://mer.mcafee.com/enduser/downloadmcprofiler.aspx to download it