Moved to ePO for faster response.
How did you create the eicar-testfile exactly?
did you check if the exclude-options were applied to the client?
What is the detecting mechanism for the Eicar testfile?
where can i check the exclude-option on the client? Should they appear on "ON-Access Scan Properties" Tab "Exclusions"?
I have created a text file and entered the eicar string, after save the txt it was deleted.
Detecting Type is "Test".
i have assignt another system and the policy worked fine. Both Servers (CLients) had the same Config (OS, Agent ...). Strange, i will reinstall vse and the agent.
so you rightclick on your McAfee Symbol in the taskbar -> Functions -> Virusscan Enterprise
Then you select the On-Access-Scanner and select properties.
Then it depends on whether you have choosen a one for all policy or if you made a decision between high-risk and low-risk processes.
There sould be a "disk-Symbol" on the left side and when you select it you see a "exclusions" tab on the right side. Do you see your exlusion listed there?
Do you type the whole string by hand or do you copy and paste from the internet? The file you create will be temporarely stored somewhere else during creation.
Detecting type shoudln´t be test, this is something different. You should get an info whether the on-access-scanner or the access-prottection feature blocked the creation.
Re-Install has no effect.
There are no exclusions listed. Also the Interface isnt locked with password, how defined in another policy.
So i think the server dosnt apply any Policy. Any Idea how to fix?
i have many ideas ^^
Maybe we start with the basics:
Does the ePO see the client?
Can you reactivate the client from ePO and do you see in the Agent-Monitor that there is some communication going on?
If you can answer all these questions with yes we´re half way done.
Next apply the policy manually to the client via ePO:
Choose the system in the systemtree and select "Actions -> Agent -> Modify Policies on a single system"
Select VSE - Select Access Protection and on the right choose edit assignment.
Now apply your testpolicy and check again if after an agent wakeup-call the exclusions are now visible on the client.
you can double-check with another test-machine.
And now we need to check which policy you changed exactly. Maybe another screenshot?