I hav ea few machines running Windows XP SP3 and they will n ot upgrade from HIPS 7.0 to HIPS 8.0. I tried to do the installation via ePO and it failed. It did remove HIPS 7.0 but now it will not install HIPS 8.0. The logs state that the upgrade was a success however there are HIPS 8.0 services or programs running on the machines. I also have gotten the McAfee Agent Updater Restart Required Restart the computer to complete the update of Host Intrusion Prevention several times. I restart and I still do not get HIPS 8.0. I have even tried to manually install HIPS 8.0 on these machines to no avail. The installer just quits and says that it failed with a 1603 error in the Windows Application event log. I tried installing HIPS 8.0 with Patch1 and Hips 8.0 with Patch 2 and got the same result. Are there any workarounds for this?
Have you checked the MaxFilters setting in the registry.
I had a similar issue with Windows 7 and installing HIPS 8(allversions) where it would indicate that it was sucessfully installed, asked for a reboot, but upon the reboot HIPS8 was not present.. we too had the generic error 1603..
This resolved out problem
By default, the MaxNumFilters value is 8. You can change it up to 14 using regedit in this location:
Note: If you don't see MaxNumFilters name, you can create it. the Type is REG_DWORD as shown below.
Remember if you are going to make any changes to the registry back it up first
Hope it helps you out.
Thanks for the advice but it did not help in my cases. I now have a service request open with McAfee and it is being escalated to Tier 2/3 for further investigation.
Had tones of these issues with upgrading from 7 to 8 (which is still going on and a very very very slow process).
For these systems that refused to upgrade I had to use the manual removal instructions for HIPS7 and then install HIPS8.
I the end if the systems had issues we used it as a chance to upgrade the machines from XP to windows7 as that is a less painful approach!
Thanks for the response. It has been a very slow process for my site as well. We are in the final phase of upgrades now. I have ~300 to go and ~15,000 running HIPS 8.0. The real headache was the last 500 where they had single standalone HIPS 7.0 rules created locally on the client that would not migrate from HIPS 7.0 to HIPS 8.0. I did run through the manual uninstall documentation form HIPS 7.0 and I still was not able to run the HIPS 8.0 installer successfully. Even the McAfee tech tried to do this and they were not successful. I have not heard anything back from McAfee since working with them on 11/15/2012. I had to submit MER files for two of the 4 I am having this issue with. I will update this post when I know anything further.
How was this ever resolved?