5 Replies Latest reply on Oct 27, 2008 8:02 AM by vitrun

    EPO agent is not working


      I have about 344 pcs under EPO 4.0 management. sometimes, I don't know why some PCs stop communicating with EPO server. I tried to get info of the agent by typing http:\\pcname:8081 I got no display page. I noticed that when I shutdown or log off that PC. It prompt message mcafee update is not responding.
      I foreced install agent from EPO, it did not work.
      If I installed at client PC, it works.
      Is there the way that I can remotely restart the agent?
      why agent 4.0 behavoir that way?
      thanks for any input
        • 1. RE: EPO agent is not working
          MCafee epo agent 4.0 is having too many issues. I too faced similar problems with this. Then I removed it and checked-in ePO agent 3.6.03. This one is working perfectly.

          MCafee has documented number of issues and solutions for agent 4.0 in its knowledgebase.
          • 2. RE: EPO agent is not working

            **** there is no 3.6.03 agent, the best version 3.6 agent is 3.6.608. There may be issues with the agent you are using but there are will all agent versions. This is why the agent is always being hotfixed and moving upwards.

            Make sure your agent is hotfixed to the latest stable version ( for 4 I like for 3.6 I like 3.6.608)

            Add the option under epo agent policy to run an exe after DAT update and put in the agent path with the switches to check and enforce policy and send details back to epo:
            c:\program files\mcafee\common framework\cmdagent.exe -P -E -C

            you can restart the agent by connecting via remote pc services and restarting the framework service, altern you can stop this kill GUID key in reg and restart to get a real new agent type feel. (for more info on GUID search the forum or knowlbase)
            • 3. query to find GUID
              I ran the queries to find duplicate agentGUID, I don't understand the output. Would someone help to explain..thank you very much

              1) C:\>osql -E -i c:\listcomputer.sql -d ePO4_ZOSO
              1> 2> 3> 4> 5> 6> 7> 8> 9> 10> 11> AgentGUID






              (6 rows affected)

              2) C:\>osql -E -i c:\listagent.sql -d ePO4_ZOSO
              1> 2> 3> 4> 5> 6> 7> 8> 9> AgentGUID

              (3 rows affected)

              3) C:\>osql -E -i c:\listall.sql -d ePO4_ZOSO
              1> 2> 3> 4> 5> 6> 7> 8> 9> 10> AgentGUID

              ------------------------------------ -----------
              B554E662-9A03-475D-8F1D-727F39F0D817 1704
              3C667778-0524-46C7-99EC-C1CFEE5A96F7 600
              549E595E-6D9D-41DF-AD17-C505A59A2AC4 14

              (3 rows affected)
              • 4. RE: query to find GUID
                The SQL scripts is basically showing you which computers are sharing the same EPO Agent GUID.

                In your examples, you have 6 systems that have issues. Computers with the name KHINM and KYAWZ are sharing the same Agent GUID B554E662-9A03-475D-8F1D-727F39F0D817. McAfee will only allow one of these two systems to be visible in your EPO directory.

                What you need to do is to fix the EPO Agent GUID on one of the systems. You do this by deleting the appropriate registry keys. Repeat this for the other systems sharing the other EPO Agent GUID that your scripts shows.

                We use a batch file that has the command listed below that will fix the issues:

                reg delete "hklm\Software\Network Associates\ePolicy Orchestrator\Agent" /v agentguid /f
                reg delete "hklm\Software\Network Associates\ePolicy Orchestrator\Agent" /v macaddress /f
                net stop "mcafee framework service"
                net start "mcafee framework service"
                "%ProgramFiles%\Network Associates\Common Framework\cmdagent.exe" /p

                B554E662-9A03-475D-8F1D-727F39F0D817 - This is the EPO agent guid

                3C667778-0524-46C7-99EC-C1CFEE5A96F7 - This is the EPO agent guid

                549E595E-6D9D-41DF-AD17-C505A59A2AC4 - - This is the EPO agent guid
                • 5. another issues
                  thank you for replying.
                  I fixed duplicating agent UD, but I have another questions, (note: I am newbie on EPO :confused:)
                  I check the systems. I noticed that some PCs which updated by SYSTEM and some update on user ID. I set up schedule update between 5am - 6pm daily. Moreover, User locked PC and update could not run (RPC service is setting to logon as local system account???). How do I re-enforce the policy that all PCs are run update regardles PC is locked
                  note:I meant update includes dat, engine, patches...
                  I am running EPO 4.0, agent

                  DOLKART1 Workstation dolkart[/B] 10/27/08 8:25:24 AM
                  DOLMAD Workstation [B]SYSTEM
                  10/27/08 7:55:59 AM