1 2 Previous Next 18 Replies Latest reply on Feb 27, 2015 8:01 AM by rosskii

    Problem with WinPE v3 creation

    zarberg

      So I'm going through the steps of the WinPE v3 creation and have come across a bit of a problem ... in the instructions, it states to copy the following:

       

      MfeEpePC.sys

      MfeEEAlg.sys

       

      I'm not finding MfeEEAlg.sys in the current files. There appears to be an MfeEEAlgFIPS.sys and an MfeEEAlgNOFIPS.sys on some of the encrypted PCs in my workplace, but I can't find MfeEEAlg.sys.

       

      (page 21 of the Eetech 6.2 guide)

        • 1. Re: Problem with WinPE v3 creation
          kevinjt4

          Hi zarberg - I am having the same exact problem, the MFeEEAlg.sys fil is missing. I am also missing 5 .pbf font files as well.  Did you ever find that Alg file?

          • 2. Re: Problem with WinPE v3 creation

            use the FIPS or NOFIPS version, depending on what mode you are operating in.

             

            Everything should be in the EETech.zip file in /winPE/Win32 ?

            • 3. Re: Problem with WinPE v3 creation
              kevinjt4

              What is FIPS or NOFIPS. No idea what you are talking about? An NO, I have downloaded the EETech.ZIp i have and the same files are still missing.  Where else can I get this EETech.zip file?  I have essentially told the user that their data is lost on thei encrypted drive because nothing from McAfee works to encrypt their hard drive.

              • 4. Re: Problem with WinPE v3 creation

                FIPS  - http://en.wikipedia.org/wiki/Federal_Information_Processing_Standards

                 

                I hate to say this, but it seems to work for everyone else. My guess is you're perhaps downloading a different version of the ZIP than the documentation you're referring to?

                 

                Telling the user their data is lost is perhaps a bit harsh. After all - you could use the standalone version of EETech off a boot CD or something and start decrypting immediately - abit a lot slower than the WinPE version.

                • 5. Re: Problem with WinPE v3 creation
                  kevinjt4

                  The EETech CD i have that does work, decypt does not work as it says the MBR is missing or wrong.  Unless you know of a way to recover the mbr and decrypt so I can either recover the users data through software or 3rd party data recovery - the users data is gone.

                  • 6. Re: Problem with WinPE v3 creation

                    can you tell us EXACTLY what the error message says?

                     

                    And of course, share what the problem you are trying to fix is? What position is the user in - did they catch a root kit or something?

                    • 7. Re: Problem with WinPE v3 creation
                      kevinjt4

                      We are migrating McAfee servers from one to another. The laptop was in transition it seems and was not listed on either ePO server adn the user was locked out of McAfee ePO SSO. We waited a few days and the laptop still wasnt listed on the server. Admin recovery wasnt working and so we tried the EETech CD but it reqired the .xml file (which didn't exist since the laptop wasn't on either ePO server to create.)  I did find a tool on the Mcafee forums that was made by a user to make an .xml file from the Drive Information numbers generated fromthe EETech CD (whether this is a legit .xml file is hard to say, but the Authentication area of EETech accepts it.)  Once Authorized and all, selecting Remove EE generates error EF060002: Incorrect Key Removal Stopped.

                      • 8. Re: Problem with WinPE v3 creation
                        kevinjt4

                        If I do an Emergency Boot I get a Windows Boot Manager error: 0x0C000000f  The boot selection failed because the required device is inaccessible.

                        • 9. Re: Problem with WinPE v3 creation

                          So, the pre-boot works, but the user locked out their account?

                           

                          Did you search for the key in your ePO servers using the API and key check value? The key is NEVER deleted, and EEPC won't activate until the key has been uploaded, so in the vast majority of cases the key can be found in EPO.

                           

                          Creating an XML is not going to help without the key of course.

                           

                          Do you have another user you could authenticate on the machine? Most people have the owner, plus a bunch of admins/tech people assigned to each machine...

                          1 2 Previous Next