This content has been marked as final. Show 5 replies
MCafee epo agent 4.0 is having too many issues. I too faced similar problems with this. Then I removed it and checked-in ePO agent 3.6.03. This one is working perfectly.
MCafee has documented number of issues and solutions for agent 4.0 in its knowledgebase.
**** there is no 3.6.03 agent, the best version 3.6 agent is 3.6.608. There may be issues with the agent you are using but there are will all agent versions. This is why the agent is always being hotfixed and moving upwards.
Make sure your agent is hotfixed to the latest stable version ( for 4 I like 184.108.40.2060 for 3.6 I like 3.6.608)
Add the option under epo agent policy to run an exe after DAT update and put in the agent path with the switches to check and enforce policy and send details back to epo:
c:\program files\mcafee\common framework\cmdagent.exe -P -E -C
you can restart the agent by connecting via remote pc services and restarting the framework service, altern you can stop this kill GUID key in reg and restart to get a real new agent type feel. (for more info on GUID search the forum or knowlbase)
I ran the queries to find duplicate agentGUID, I don't understand the output. Would someone help to explain..thank you very much
1) C:\>osql -E -i c:\listcomputer.sql -d ePO4_ZOSO
1> 2> 3> 4> 5> 6> 7> 8> 9> 10> 11> AgentGUID
(6 rows affected)
2) C:\>osql -E -i c:\listagent.sql -d ePO4_ZOSO
1> 2> 3> 4> 5> 6> 7> 8> 9> AgentGUID
(3 rows affected)
3) C:\>osql -E -i c:\listall.sql -d ePO4_ZOSO
1> 2> 3> 4> 5> 6> 7> 8> 9> 10> AgentGUID
(3 rows affected)
The SQL scripts is basically showing you which computers are sharing the same EPO Agent GUID.
In your examples, you have 6 systems that have issues. Computers with the name KHINM and KYAWZ are sharing the same Agent GUID B554E662-9A03-475D-8F1D-727F39F0D817. McAfee will only allow one of these two systems to be visible in your EPO directory.
What you need to do is to fix the EPO Agent GUID on one of the systems. You do this by deleting the appropriate registry keys. Repeat this for the other systems sharing the other EPO Agent GUID that your scripts shows.
We use a batch file that has the command listed below that will fix the issues:
reg delete "hklm\Software\Network Associates\ePolicy Orchestrator\Agent" /v agentguid /f
reg delete "hklm\Software\Network Associates\ePolicy Orchestrator\Agent" /v macaddress /f
net stop "mcafee framework service"
net start "mcafee framework service"
"%ProgramFiles%\Network Associates\Common Framework\cmdagent.exe" /p
B554E662-9A03-475D-8F1D-727F39F0D817 - This is the EPO agent guid
3C667778-0524-46C7-99EC-C1CFEE5A96F7 - This is the EPO agent guid
549E595E-6D9D-41DF-AD17-C505A59A2AC4 - - This is the EPO agent guid
thank you for replying.
I fixed duplicating agent UD, but I have another questions, (note: I am newbie on EPO :confused:)
I check the systems. I noticed that some PCs which updated by SYSTEM and some update on user ID. I set up schedule update between 5am - 6pm daily. Moreover, User locked PC and update could not run (RPC service is setting to logon as local system account???). How do I re-enforce the policy that all PCs are run update regardles PC is locked
note:I meant update includes dat, engine, patches...
I am running EPO 4.0, agent 220.127.116.110
DOLKART1 Workstation 172.30.2.200 dolkart[/B] 10/27/08 8:25:24 AM
DOLMAD Workstation 172.30.2.124 [B]SYSTEM 10/27/08 7:55:59 AM