Skip navigation
McAfee Secure sites help keep you safe from identity theft, credit card fraud, spyware, spam, viruses and online scams
This discussion is archived
1483 Views 3 Replies Latest reply: Nov 30, 2012 11:09 AM by JoeBidgood RSS
HerbSmith Apprentice 92 posts since
Dec 9, 2009
Currently Being Moderated

Nov 14, 2012 5:47 PM

ePO 4.6 Patch 4 and Dat Reporting

Upgraded from ePO 4.6P3 to ePO 4.6P4 today.  Upgrade went smoothly.  Services were down for about 12 minutes.

 

However something happened with the Dat version that a lot of clients were reporting.  Before the grade I had about 80 machines that were talking regularly to ePO that did not have their DAT current.   After the upgrade the same dashboard monitor was report over 1100 out of spec.  During the day that has declined to around 450.  But still a terrible blow to my compliance numbers.   This is out of  population of about 20,000 which includes about 3700 labtops.  Most of the problem machines were showing a DAT from several weeks ago on Products Page in the DAT column by the VSE product.

 

All endpoints are running MA 4.6.0.2935.  VSE 8.8.849.  All laptops have hips 7.0 P9 and EEPC 6.2.

 

These are about 99% laptops.   About 2/3 of the problems machines had last connected via our VPN or via the Agent Handler in the DMZ.  The remote machines were way over represented in the problem population.

 

Displaying the client events for the problem machines I could see entries for update to todays DAT.  I check some agent logs and they showed the end point has updated it DAT last night to the current version.   It appears that sending a wake up call with force full policy and task update would fix many of them.   Without the force full policy and task the success rate was much lower.   Can't send wake up calls to those connecting via the agent handler in the DMZ.  (Nat'ed firewalls at both ends).   And many VPN users check in only every few days so who knows how long it will take to clear up.

 

What kind of issues could have caused this?

What other hidden damage may have been done to my data by the upgrade?

 

Thanks

  • JoeBidgood McAfee SME 2,881 posts since
    Sep 11, 2009
    Currently Being Moderated
    1. Nov 15, 2012 10:48 AM (in response to HerbSmith)
    Re: ePO 4.6 Patch 4 and Dat Reporting

    I'm really not sure what could have happened there. As far as I'm aware there's nothing in this upgrade that would cause this - it almost sounds as though some of the machines' properties were changed, which the upgrade doesn't do.

    I'm really at a loss here, I'm afraid

     

    What DAT version is being reported by the machines that are showing as non-compliant?

     

    Thanks -

     

    Joe




    (Please post questions to the forum, as I am unable to respond to private messages. Thanks!)



  • JoeBidgood McAfee SME 2,881 posts since
    Sep 11, 2009
    Currently Being Moderated
    3. Nov 30, 2012 11:09 AM (in response to HerbSmith)
    Re: ePO 4.6 Patch 4 and Dat Reporting

    Very strange, but at least things are back to normal. Thanks for letting us know

     

    Joe




    (Please post questions to the forum, as I am unable to respond to private messages. Thanks!)



More Like This

  • Retrieving data ...

Bookmarked By (0)

Legend

  • Correct Answers - 5 points
  • Helpful Answers - 3 points