3 Replies Latest reply on Apr 10, 2013 9:50 AM by alexn

    Rogue Issue

    Iain Green

            New to McAfee ePO and been tasked with managing rogue detections.

       

      We have an issue with Server showing as a rogue however it appears in our Managed devices and in the rogue list? 

      Checked the system tree and there is only one device.   Checked McAfee on the device its self and it's reporting and updating correctly.

       

      Don't understand why it is reporting as a rogue!  Thinking of uninstalling and re-installing the agent while also removing the devices from the database to see if this corrects the issue?

       

      Edit: appears I have one IP address but two mac address! Rogue has a different MAC to the managed device!

       

      Message was edited by: iain.green on 4/10/13 9:28:09 AM CDT
        • 1. Re: Rogue Issue
          brenns1

          Hi Iain,

           

          It sounds like either a duplicate PC or a problem with the rogue sensor. And seeing your update it  screams that its a duplicate.

           

          It might be worth Deleting the sensor data from the particular sensor (through looking at the rogue sensor details) and allow it to re-scan. This will provide you with a fresh set of data.

           

          If this machine still shows as a rogue i would check your network for a duplicate machine name. If it doesnt then its just the sensor keeping maybe old information.

           

          Will be interested to hear how you get on.

           

          Thanks

          • 2. Re: Rogue Issue
            Iain Green

            More digging has resulted in finding out that McAfee is ignoring a Teamed network card and is reporting on the indivdual cards. 

             

            Hence two macs and one IP address! can't locate an option to merge the two, so will have to add it to my ignore list unless any one comes up with another option?

            • 3. Re: Rogue Issue
              alexn

              Hi Green,

               

              Have you changed Detected System definitions settings under Server configuration.

               

              Manue|Server Configuration|System Defication Settings|See rough system settings change them to point epo not to decet rough system.

              Edit option is at the bottom of page.

               

              Regds

               

              Alexn