We have round about 905 machines that either reflect one of two DAT's 1111 or 0.0000. Now even when running a xdat against them they revert back to the previous mentioned DAT's
Is there a fix for this that doesn't require complete uninstall and reinstall of the agent and VSE?
VSE version 188.8.131.525
DAT 1111 tells you a fresh install occurred, and a DAT update is needed.
Fix = Do a DAT update.
DAT 0000 tells you something is wrong with the client. There are a number of possible causes, so the details will have to be discovered on a case by case basis - hopefully they'll be the same issue.
If you want to remediate it on your own without investigating the cause, start with a Reboot or restarting of the McShield service.
Stuck at dat 1111 implies that maybe vsupdate.dll hasn't registered properly.
regsvr32 /s "c:\program files\mcafee\virusscan enterprise\vsupdate.dll"
followed by a forced update should fix this.
DAT 0000 is, in my experience, a corrupted install.
The other circumstance you don't mention but I see here is when the installed product list in ePO shows Virusscan but a blank DAT version, and uninstall via ePO fails.
Uninstall via an ePO task, if that fails, here's the quick (and very dirty) fix I use:
Search hklm\software\microsoft\windows\uninstall for any reference to Virusscan, and delete the key(s) found
delete key HKEY_LOCAL_MACHINE\SOFTWARE\McAfee\ePolicy Orchestrator\Application Plugins\VIRUSCAN8800
delete key HKEY_LOCAL_MACHINE\SOFTWARE\Network Associates\ePolicy Orchestrator\Application Plugins\VIRUSCAN8800
restart the McAfee framework service
You should now be able to run the Virusscan 8,8 install task successfully.
After that, it might be wise to uninstall and then reinstall, just to make sure it's ok (I've needed to do this on one or two broken boxes).
I've fixed around 50 broken systems this way without having to leave my desk or remote in to the broken PCs.
Thanks to this fix, 3694 boxes called home in last 24 hours, of which only 7 aren't reporting up to date DAT files
Message was edited by: PhilR on 10/09/13 11:57:41 IST