5 Replies Latest reply on Feb 3, 2016 1:40 PM by george.perkins

    How to STOP VSE FROM BREAKING ePO? Prevent modification of McAfee Common Management Agent files and settings Action blocked: Create

    george.perkins

      I am trying to install and configure both VirusScan Enterprise 8.8 and EPolicy Orchestrator on a new Windows Server 2008 R2 SP1 machine located in a DMZ. So consequently I've got firewalls between the client and the ePO server. But first things first, why (apparently) is my VSE client blocking ePO communications? I've disabled the Windows Firewall to see if I can punch through, but no luck. I may have blocking going on on the network firewall, but other communication goes through, so right now I'll assume it is open. Because VSE appears to be blocking ePO. Why?

       

      Contents of Agent_Monitor.log:

      Framework Service 1/27/2016 3:36:49 PM Error Agent failed to communicate with ePO Server

      Framework Service 1/27/2016 3:36:13 PM Info Agent is connecting to ePO server

      Framework Service 1/27/2016 3:36:13 PM Info Agent communication session started

      Framework Service 1/27/2016 3:36:13 PM Info Agent is sending PROPS VERSION package to ePO server

      Framework Service 1/27/2016 3:36:13 PM Info Agent started performing ASCI

      Framework Service 1/27/2016 3:36:12 PM Info Collecting Properties

      Framework Service 1/27/2016 2:57:48 PM Info Next collect and send properties in 59 minutes and 21 seconds.

       

      Contents of AccessProtectionLog.txt:

      1/27/2016 2:57:10 PM Blocked by Access Protection rule NT AUTHORITY\LOCAL SERVICE C:\PROGRAM FILES (X86)\MCAFEE\COMMON FRAMEWORK\MACMNSVC.EXE C:\ProgramData\McAfee\Common Framework\db\macmnsvc.db-journal Common Standard Protection:Prevent modification of McAfee Common Management Agent files and settings Action blocked : Create

      1/27/2016 2:57:16 PM Blocked by Access Protection rule NT AUTHORITY\LOCAL SERVICE C:\PROGRAM FILES (X86)\MCAFEE\COMMON FRAMEWORK\MACMNSVC.EXE C:\ProgramData\McAfee\Common Framework\db\macmnsvc.db-journal Common Standard Protection:Prevent modification of McAfee Common Management Agent files and settings Action blocked : Create

      1/27/2016 2:57:21 PM Blocked by Access Protection rule NT AUTHORITY\LOCAL SERVICE C:\PROGRAM FILES (X86)\MCAFEE\COMMON FRAMEWORK\MACMNSVC.EXE C:\ProgramData\McAfee\Common Framework\db\macmnsvc.db-journal Common Standard Protection:Prevent modification of McAfee Common Management Agent files and settings Action blocked : Create

      1/27/2016 3:36:07 PM Blocked by Access Protection rule NT AUTHORITY\LOCAL SERVICE C:\PROGRAM FILES (X86)\MCAFEE\COMMON FRAMEWORK\MACMNSVC.EXE C:\ProgramData\McAfee\Common Framework\db\macmnsvc.db-journal Common Standard Protection:Prevent modification of McAfee Common Management Agent files and settings Action blocked : Create

      1/27/2016 3:36:12 PM Blocked by Access Protection rule NT AUTHORITY\LOCAL SERVICE C:\PROGRAM FILES (X86)\MCAFEE\COMMON FRAMEWORK\MACMNSVC.EXE C:\ProgramData\McAfee\Common Framework\db\macmnsvc.db-journal Common Standard Protection:Prevent modification of McAfee Common Management Agent files and settings Action blocked : Create

       

      What steps can I take to confirm that VSE is not the cause of the problem here?