3 Replies Latest reply on Jan 6, 2015 11:44 AM by londonsec

    McAfee agent install alert in SCOM

    stickman

      Hi guys,

       

      Hope someone can clarify this, from my understanding this alert is generated because of McAfee Agent install client task running in EPO. Can someone please confirm?

       

      "The McAfee epo agent install service is marked as an interactive service. However, the system is configured to not allow interactive services. the service may not function properly."

       

      scomalert.png

        • 1. Re: McAfee agent install alert in SCOM
          justav

          Hello, to my believing installing the McAfee Agent is always interactive in a way.

          It exchanges keys for secure communications for starters which puts the Agent in an interactive state at that point.

          If you add a commandline to your installation (right after the install, like: CMDAGENT /P) you will minimize that issue and it will turn the Agent to active.

          This forces the agent to communicate right after it has been installed, and hopefully before SCOM Agent will trigger this event (you can give SCOM some slack too to respond to these states or let it wait if it exists for longer than a certain period.

           

          Worth a try I think...

          Have a look in this kb for more info on cmdline and the agent:

          https://kc.mcafee.com/corporate/index?page=content&id=KB73389

           


          cheers and goodluck

          • 2. Re: McAfee agent install alert in SCOM
            JoeBidgood

            Actually, this is isn't the agent - it's something different

             

            In order to ensure that the installation is done using the System account, the agent installer doesn't actually install the agent: it creates a service configured to run as System, and it's this service that actually performs the installation. Once the install is complete the service is removed.

            This is the service that's generating the message: to the best of my knowledge this has never indicated a problem, and can be safely ignored.

             

            HTH -

             

            Joe

            • 3. Re: McAfee agent install alert in SCOM
              londonsec

              So now the question is how to ignore this or not have it show up in the server event logs...any ideas?