I'm trying to install HIPS on Windows XP machines that are booting off ISCSI Luns but i'm having issues getting it working. Everytime i install it Windows blue screens
I don't think this has been tested before, nor would be supported. Have you tried it with newer OSes (Windows 7 or 8)?
but when i install HIPS on a machine with a local hard drive "McAfee Core NDIS Intermediate Filter miniport" never shows up in the device manager.
Make sure you've enabled VIEW -> VIEW HIDDEN DEVICES. That is the HIPS NDIS driver for Windows XP, that is required for Network IPS and Firewall functionality. If it doesn't show, then HIPS probably isn't installed properly.
I got it working, for the most part. HIPS is installed and running on the diskless machine. I had to unbind McAfee Core NDIS Intermediate Filter miniport from the interface that the machine boots from. I'm hoping i can rebind it back to that interface ( i have a support ticket open)
Incase anyone else runs into this refer to http://support.microsoft.com/kb/976042
I'm trying to find more information on McAfee Core NDIS Intermediate Filter miniport but cant find any information on it, do you know where i can get some documentation on it? Also is it possible to install it manually without having to push HIPS? I would like to install it manually then push HIPs so i can automate the process.
I found a way to install the driver manually. If you open the network connections and go to the properties of one of the NICs you can install new drivers. You will want to select Service and will need access to the inf, sys, and cat files. I cant remember which ones i used (i believe it was mfendisk), you can search a system that has HIPs installed for mfe and find all of the files.
You can also use bindview (source code is available from microsoft, or you can find the binary by doing a google search). I read that ProtInstall will do the same but didnt try it. If you are courious you can install it using the INetCfg API in windows. I havent found a way to enable it on the main interface yet, I'm going to hold off on this task for a bit.
Hope this helps someone.