ENS ATP and TP not functioning error meaning and checks

[ninov_n]

Hello,

Recently I came across that error message "Product may not be functioning as expected" in Client Events log for ENS ATP and TP installed modules on multiple machines.

All I can see is that it is under Event ID 2422, Event Description "Agent failed to enforce policy on at least one point product" and Event Type "Policy Enforcement".

My question is:

Is this a 100% indication of an endpoint issue and what should be checked on an endpoint to be sure it was a temp issue but not actual malfunction?

I guess it appears some times during initialisation or when ASCI is reached for communication.

So far we check if there is recent communication in McAfee Agent and if ENS shows malfunction indication. Is that enough?

Best regards,

Nino

[akatt · Accepted solution]

The described symptom leans towards LPC communication failures between the point product (ENS) and the McAfee Agent.  A good test, is to see if we can enforce a policy change for any of the ENS policies.  Something simple, like adding a test.txt file exclusion, or perhaps a simple disabling of a component,to see if the policy enforces.  If not, then there is a problem with the point product registration with the McAfee Agent, and I know we can usually resolve these by reinstalling MA, or upgrading MA.

Was my reply helpful?

If this information was helpful in any way, or answered your question, will you please select "Accept as Solution" in my reply, or give kudos as appropriate, so together we can help other members?