First of all a little description of out McAfee infrastructure:
We have an ePolicy Orchestrator 5.0.1 server
Our clients have VirusScan 8.8.0 patch 2 (we don't have windows 8 machines).
We also use the latest SiteAdvisor and Real Time Client.
The last few months we had a lot of problems with client computers who couldn't connect trough VPN. To be able to connect trough VPN here computers need to have an up-to-date antivirus installed.
Most of the time I noticed these users had a recent DAT file (at most a few versions behind current version) but their On-Access Scanner was disabled.
The last result of their update task is also always "The Update Failed".
And in the Event Viewer they always have EventID 5022.
Apparently this means that their current DAT file or some other files have become corrupt.
And manual or scheduled updates no longer work.
The only solution seems to be completely uninstalling the VirusScan and then reinstalling it. After this the update works and everything seems normal again.
The biggest problem is that this happens on a couple of machines every day. And it's very difficult to find out when it happens or where it happens.
And I also have no idea why this happens.
I hope somebody else has an idea our knows a solution for this.