3 Replies Latest reply on Jan 6, 2015 11:44 AM by londonsec

    McAfee agent install alert in SCOM


      Hi guys,


      Hope someone can clarify this, from my understanding this alert is generated because of McAfee Agent install client task running in EPO. Can someone please confirm?


      "The McAfee epo agent install service is marked as an interactive service. However, the system is configured to not allow interactive services. the service may not function properly."



        • 1. Re: McAfee agent install alert in SCOM

          Hello, to my believing installing the McAfee Agent is always interactive in a way.

          It exchanges keys for secure communications for starters which puts the Agent in an interactive state at that point.

          If you add a commandline to your installation (right after the install, like: CMDAGENT /P) you will minimize that issue and it will turn the Agent to active.

          This forces the agent to communicate right after it has been installed, and hopefully before SCOM Agent will trigger this event (you can give SCOM some slack too to respond to these states or let it wait if it exists for longer than a certain period.


          Worth a try I think...

          Have a look in this kb for more info on cmdline and the agent:



          cheers and goodluck

          • 2. Re: McAfee agent install alert in SCOM

            Actually, this is isn't the agent - it's something different


            In order to ensure that the installation is done using the System account, the agent installer doesn't actually install the agent: it creates a service configured to run as System, and it's this service that actually performs the installation. Once the install is complete the service is removed.

            This is the service that's generating the message: to the best of my knowledge this has never indicated a problem, and can be safely ignored.


            HTH -



            • 3. Re: McAfee agent install alert in SCOM

              So now the question is how to ignore this or not have it show up in the server event logs...any ideas?