Afaik eepc will never itself trigger this - it's a decision Windows itself makes, which means you're not going to find the root cause by looking at the McAfee logs - it's the windows logs which would tell you why it chose to start up and go into restore mode.
Thanks for replying dude.
Just really wanted someone - er, you - to rule out EEPC invoking System Restore.
We actually started experiencing the same problem with a few clients here. We use the McAfee Drive Encryption 7.1 on all our notebooks. This week we have had reports of some clients not booting anymore. They get the endpoint authentication screen, give in their login details and then windows immediately goes into repair mode. Feels like the disk is not being decrypted properly so windows cannot start?
Since it happens after the encryption login and its not a single isolated case, me too would start to look for a cause with drive encryption.
I wanted to try to remove the drive encryption, see if that makes the machine bootable again. Although im having problems with DETech 7.1 aswell, when booting it, it says that it cannot find a valid DE on the system. When the EPO reports that the client in question does hve the DE 7.1 software installed.
why are you booting DEtech on the system? What's the problem you were trying to solve?
I wanted to remove the encryption on the drive and then see if i can find any problems with windows itself and repair if possible. I managed to start decrypting the partitions manually.
If the machine was working (but going into recovery mode) and the pre-boot seemed to function fine, but then DETech told you MDE was not installed, then there's a good chance you have a rootkit infection on the machine masking the MBR.
You might want to to run the McAfee rootkit detector on the machine (or others like it).