A colleague of mine who looks after the day to day running of our ePO system told me that all our SuperAgent repositories were gone. They are not in the distributed repositories at all, only our 2 UNC repositories are there.
I've done a bit of testing and it looks as though none of the agent policies assigned to any of the SuperAgent clients are being applied. I have tested by changing the ePO to agent comms time, enable self-protection etc. and none of these changes are applied.
The first client I looked at was running MA 188.8.131.522 so I downgraded to an older version 184.108.40.206 (which we still have many clients in our ePO on this version) but again no policy changes were applied. The client is reporting back to the ePO server fine though. If I run a collect and send props from the client's agent and then check on the ePO server I can see the last communicated time is indeed that. The only other product on the clients is VSE 8.8 patch 7. These policies appear to be working and if I make a change at the ePO server, that change is applied at the client.
My colleague has been making some changes recently due to some recommendations after a recent security scan which we must comply to. He has been updating clients to VSE 8.8 patch 7 (previously we would have been on a mixture of patches) and also he has been updating the agents.
Where do I start looking to identify the problem? Log files on the client or the ePO server and where are they? I've looked in C:\ProgramData\McAfee\Agent\logs and neither of the 3 files macmnsvc, macompatsvc or masvc appear to indicate any problems.
We were running ePO 5.3.1 but yesterday (after the fault was brought to my attention) I upgraded to 5.3.2 hoping that would cure the fault.
Start with the audit log in ePO. Since you have a rough time period, you need to do a little detective work. Give support a call and have them login. You will see which logs they will use to help
pinpoint where the issue is. Some logs are on the ePO server under xx:\Program Files (x86)\McAfee\ePolicy Orchestrator\DB\Logs. There are others as well.