Endpoint Security Threat Prevention versions

[ryan190]

Hi all

I checked in the november update to Endpoint Security Threat Prevention but some of my clients do not see that there is an update available in EPO. As seen below:

i have tried to force the agent to update but it doesnt seem to see that there is an update.

To be clear im trying to move the 10.6.1.1128 to .1169

[Former Member]

The November Update will only be applied to systems running ENS 10.5.5 and 10.6.1

Any other clients would need to be updated to these versions prior to being able to update to the version 1169.

You mentioned the systems running 1128 are also not upgrading though - here it would be worth checking that those systems are set to update from the branch where you have put the update into (mcafee agent - general policy - updates). If this is correct then I would suggest looking for any errors when you run the update task in the mcafee agent logs (logs can be found in %Programdata%\Mcafee\Agent or CommonFramework\Logs) / on the mcafee agent status monitor i.e. "unvalid repository" errors. If this all seems fine, then it's worth checking for any installation logs and seeing if these were successful or if they failed (logs can be found in C:\Windows\Temp\McAfeeLogs)

[ryan190]

Thanks for this

I cant see any errors in the logs.

Oddly i can only see "McAfee_ThreatPrevention_Caspercore_install_112618" log. That does has 112618 was installed two days ago ( 27th ). But this isnt the 10.6.1.1169 hotfix is it?

"McAfee_ThreatPrevention_HotFix_181113_Bootstrapper" details the following:

26/11/2018 12:29:26.86 [10392] [BootstrapperMain] Installing Blade HotFix
26/11/2018 12:29:26.86 [10392] [BootstrapperMain] msiexec.exe /p"C:\ProgramData\McAfee\Agent\Current\ENDP_AM_1060\HotFix\181113\0000\McAfee_Threat_Prevention_HF_x64.msp" /qn QUARANTINEFOLDER=NOTPROVIDED /l* "C:\Windows\TEMP\McAfeeLogs\McAfee_ThreatPrevention_HotFix_181113_Install_26112018122925964.log" REINSTALLMODE=OS REINSTALL=ALL /norestart HFNUMBER=181113 PACKAGEDAMCORE=18.10.0.324.4 BOOTSTRAPPERDIR="C:\ProgramData\McAfee\Agent\Current\ENDP_AM_1060\HotFix\181113\0000\"

[Former Member]

McAfee_ThreatPrevention_Caspercore_install_112618" log. >> this is the date you installed it 26/11/18

However  C:\ProgramData\McAfee\Agent\Current\ENDP_AM_1060\HotFix\181113\0000\McAfee_Threat_Prevention_HF_x64.msp - this is the November Update

Scroll to the bottom of each log file that you can see that was fun for that HF. Check the exit status. It should be 0. If you see a return code i.e. return code 1603 at the bottom of log this would inidicate a failure.

[ryan190]

Return codes all look good to me. Here is the full log

MSI (s) (98:80) [12:29:26:629]: Final Patch Application Order:
MSI (s) (98:80) [12:29:26:629]: {23AE186D-29D4-4FF9-8107-07361D8904AD} - C:\ProgramData\McAfee\Agent\Current\ENDP_AM_1060\HotFix\181113\0000\McAfee_Threat_Prevention_HF_x64.msp
=== Logging started: 26/11/2018 12:29:26 ===
Action start 12:29:26: INSTALL.
Action start 12:29:26: WindowsFolder_x86_VC.D371D00B_69EC_3F8E_A622_74710A89ADC1.
Action ended 12:29:26: WindowsFolder_x86_VC.D371D00B_69EC_3F8E_A622_74710A89ADC1. Return value 1.
Action start 12:29:26: SystemFolder_x86_VC.D371D00B_69EC_3F8E_A622_74710A89ADC1.
Action ended 12:29:26: SystemFolder_x86_VC.D371D00B_69EC_3F8E_A622_74710A89ADC1. Return value 1.
Action start 12:29:26: WindowsFolder_amd64_VC.C7F737EB_3325_3BEE_8D0D_DEF2DE62486A.
Action ended 12:29:26: WindowsFolder_amd64_VC.C7F737EB_3325_3BEE_8D0D_DEF2DE62486A. Return value 1.
Action start 12:29:26: System64Folder_amd64_VC.C7F737EB_3325_3BEE_8D0D_DEF2DE62486A.
Action ended 12:29:26: System64Folder_amd64_VC.C7F737EB_3325_3BEE_8D0D_DEF2DE62486A. Return value 1.
Action start 12:29:26: ISSetupFilesExtract.
1: Starting to extract setup files
1: Getting SUPPORTDIR property :
1: Extracting SetupFiles to: C:\Windows\TEMP\{21A798B9-A5A1-49D7-9F96-CC8B14F7EAEF}
1: Getting ISSetupFile table view
1: Executing ISSetupFile table view
1: Extracting Setup File:
1: C:\Windows\TEMP\{21A798B9-A5A1-49D7-9F96-CC8B14F7EAEF}\license.txt
1: Extracting Setup File:
1: C:\Windows\TEMP\{21A798B9-A5A1-49D7-9F96-CC8B14F7EAEF}\MfeEpAac_mfeprotect.exe
1: Extracting Setup File:
1: C:\Windows\TEMP\{21A798B9-A5A1-49D7-9F96-CC8B14F7EAEF}\MfeEpAac.exe
1: Extracting Setup File:
1: C:\Windows\TEMP\{21A798B9-A5A1-49D7-9F96-CC8B14F7EAEF}\LogDebugSetter.exe
1: Setting SUPPORTDIR property to:
1: Setting ISSETUPFILESCOMPLETED property
Action ended 12:29:26: ISSetupFilesExtract. Return value 1.
Action start 12:29:26: AppSearch.
Action ended 12:29:26: AppSearch. Return value 1.
Action start 12:29:26: SetENSHotfix.
Action ended 12:29:26: SetENSHotfix. Return value 1.
Action start 12:29:26: WriteCustomActionLogPath.
Action ended 12:29:26: WriteCustomActionLogPath. Return value 1.
Action start 12:29:26: GainAACAccess_Immediate.
12:29:26:876 - McAfee CustomAction : Begin GainAACAccess_Immediate
12:29:26:878 - CLIENTPROCESSID obtained from msi. Value : 9752
12:29:26:879 - SUPPORTDIR obtained from msi. Value : C:\Windows\TEMP\{21A798B9-A5A1-49D7-9F96-CC8B14F7EAEF}
12:29:26:880 - McAfee CustomAction : Begin GainMsiExclusion
12:29:26:887 - The PID obtained is a msiexec.exe. Proceed further!
12:29:26:888 - This is a 64 bit system
12:29:26:890 - RegOpenKeyEx passed
12:29:26:891 - RegQueryValueEx passed. The path of szInstallDir32 : C:\Program Files (x86)\McAfee\Endpoint Security\
12:29:26:892 - RegOpenKeyEx passed
12:29:26:893 - RegQueryValueEx passed. The path of szInstallDir64 : C:\Program Files\McAfee\Endpoint Security\
12:29:26:894 - "C:\Windows\TEMP\{21A798B9-A5A1-49D7-9F96-CC8B14F7EAEF}\MfeEpAac_mfeprotect.exe" -add -rootlocation "C:\Program Files\McAfee\Endpoint Security" -rootlocation "C:\Program Files (x86)\McAfee\Endpoint Security" -folder "C:\ProgramData\McAfee\Endpoint Security" -MsiPID 9752
12:29:26:895 - RunCommandLine: "C:\Windows\TEMP\{21A798B9-A5A1-49D7-9F96-CC8B14F7EAEF}\MfeEpAac_mfeprotect.exe" -add -rootlocation "C:\Program Files\McAfee\Endpoint Security" -rootlocation "C:\Program Files (x86)\McAfee\Endpoint Security" -folder "C:\ProgramData\McAfee\Endpoint Security" -MsiPID 9752
12:29:27:29 - RunCommandLine: Process return code : 0
12:29:27:30 - Running application to gain installer exclusion succeeded.
12:29:27:30 - McAfee CustomAction : End GainMsiExclusion
Action ended 12:29:27: GainAACAccess_Immediate. Return value 1.
Action start 12:29:27: CheckForENS_TIE_or_ATP_Presence.
Action ended 12:29:27: CheckForENS_TIE_or_ATP_Presence. Return value 1.
Action start 12:29:27: StorePreviousHotfixNumbers.
12:29:27:54 - McAfee CustomAction : Begin StorePreviousHotfixNumbers
12:29:27:55 - Previously installed HF versions =
12:29:27:56 - McAfee CustomAction : End StorePreviousHotfixNumbers
Action ended 12:29:27: StorePreviousHotfixNumbers. Return value 1.
Action start 12:29:27: FindRelatedProducts.
Action ended 12:29:27: FindRelatedProducts. Return value 0.
Action start 12:29:27: SetWindowsOSVersionProps.
12:29:27:67 - McAfee CustomAction : Begin SetWindowsOSVersionProps
12:29:27:69 - major version 10
12:29:27:70 - minor version 0
12:29:27:71 - build version 17134
12:29:27:72 - McAfee CustomAction : End SetWindowsOSVersionProps
Action ended 12:29:27: SetWindowsOSVersionProps. Return value 1.
Action start 12:29:27: ValidateProductID.
Action ended 12:29:27: ValidateProductID. Return value 1.
Action start 12:29:27: CA_WindowsFolder_amd64_VC.C7F737EB_3325_3BEE_8D0D_DEF2DE62486A.
Action ended 12:29:27: CA_WindowsFolder_amd64_VC.C7F737EB_3325_3BEE_8D0D_DEF2DE62486A. Return value 1.
Action start 12:29:27: CA_System64Folder_amd64_VC.C7F737EB_3325_3BEE_8D0D_DEF2DE62486A.
Action ended 12:29:27: CA_System64Folder_amd64_VC.C7F737EB_3325_3BEE_8D0D_DEF2DE62486A. Return value 1.
Action start 12:29:27: CA_WindowsFolder_x86_VC.D371D00B_69EC_3F8E_A622_74710A89ADC1.
Action ended 12:29:27: CA_WindowsFolder_x86_VC.D371D00B_69EC_3F8E_A622_74710A89ADC1. Return value 1.
Action start 12:29:27: CA_SystemFolder_x86_VC.D371D00B_69EC_3F8E_A622_74710A89ADC1.
Action ended 12:29:27: CA_SystemFolder_x86_VC.D371D00B_69EC_3F8E_A622_74710A89ADC1. Return value 1.
Action start 12:29:27: CostInitialize.
Action ended 12:29:27: CostInitialize. Return value 1.
Action start 12:29:27: FileCost.
Action ended 12:29:27: FileCost. Return value 0.
Action start 12:29:27: IsolateComponents.
Action ended 12:29:27: IsolateComponents. Return value 0.
Action start 12:29:27: setUserProfileNT.
Action ended 12:29:27: setUserProfileNT. Return value 1.
Action start 12:29:27: setAllUsersProfile2K.
Action ended 12:29:27: setAllUsersProfile2K. Return value 1.
Action start 12:29:27: CostFinalize.
Action ended 12:29:28: CostFinalize. Return value 1.
Action start 12:29:28: MigrateFeatureStates.
Action ended 12:29:28: MigrateFeatureStates. Return value 0.
Action start 12:29:28: SetARPINSTALLLOCATION.
Action ended 12:29:28: SetARPINSTALLLOCATION. Return value 1.
Action start 12:29:28: SetODBCFolders.
Action ended 12:29:28: SetODBCFolders. Return value 0.
Action start 12:29:28: InstallValidate.
Action ended 12:29:28: InstallValidate. Return value 1.
Action start 12:29:28: ResetAmcoreContent.
Action ended 12:29:28: ResetAmcoreContent. Return value 1.
Action start 12:29:28: RemoveExistingProducts.
Action ended 12:29:28: RemoveExistingProducts. Return value 0.
Action start 12:29:28: InstallInitialize.
Action ended 12:29:28: InstallInitialize. Return value 1.
Action start 12:29:28: GetQuarantineFolder.
Action ended 12:29:28: GetQuarantineFolder. Return value 1.
Action start 12:29:28: Delete_VSCoreUninstHelper_During_RB.
Action ended 12:29:28: Delete_VSCoreUninstHelper_During_RB. Return value 1.
Action start 12:29:28: Extract_VSCoreUninstHelper.
12:29:28:275 - McAfee CustomAction : Begin Extract_VSCoreUninstHelper
12:29:28:286 - Extracted path of vscore helper : C:\Windows\TEMP\MfeVSCoreUninst.exe
12:29:28:287 - McAfee CustomAction : End Extract_VSCoreUninstHelper
Action ended 12:29:28: Extract_VSCoreUninstHelper. Return value 1.
Action start 12:29:28: SetCAData_AppendHotfixVersion_RB.
Action ended 12:29:28: SetCAData_AppendHotfixVersion_RB. Return value 1.
Action start 12:29:28: AppendHotfixVersion_RB.
Action ended 12:29:28: AppendHotfixVersion_RB. Return value 1.
Action start 12:29:28: SetCAData_AppendHotfixVersion.
Action ended 12:29:28: SetCAData_AppendHotfixVersion. Return value 1.
Action start 12:29:28: AppendHotfixVersion.
Action ended 12:29:28: AppendHotfixVersion. Return value 1.
Action start 12:29:28: SetCAData_AppendHotfixRegistryUnderNA.
Action ended 12:29:28: SetCAData_AppendHotfixRegistryUnderNA. Return value 1.
Action start 12:29:28: AppendHotfixRegistryUnderNA.
Action ended 12:29:28: AppendHotfixRegistryUnderNA. Return value 1.
Action start 12:29:28: ProcessComponents.
Action ended 12:29:28: ProcessComponents. Return value 1.
Action start 12:29:28: UnpublishComponents.
Action ended 12:29:28: UnpublishComponents. Return value 1.
Action start 12:29:28: MsiUnpublishAssemblies.
Action ended 12:29:28: MsiUnpublishAssemblies. Return value 0.
Action start 12:29:28: UnpublishFeatures.
Action ended 12:29:28: UnpublishFeatures. Return value 1.
Action start 12:29:28: StopServices.
Action ended 12:29:28: StopServices. Return value 1.
Action start 12:29:28: DeleteServices.
Action ended 12:29:28: DeleteServices. Return value 1.
Action start 12:29:28: SetCAData_StopMMSService_RB.
Action ended 12:29:28: SetCAData_StopMMSService_RB. Return value 1.
Action start 12:29:28: StopMMSService_RB.
Action ended 12:29:28: StopMMSService_RB. Return value 1.
Action start 12:29:28: SetCAData_StopMMSService.
Action ended 12:29:28: SetCAData_StopMMSService. Return value 1.
Action start 12:29:28: StopMMSService.
Action ended 12:29:28: StopMMSService. Return value 1.
Action start 12:29:28: UnregisterComPlus.
Action ended 12:29:28: UnregisterComPlus. Return value 0.
Action start 12:29:28: SelfUnregModules.
Action ended 12:29:28: SelfUnregModules. Return value 1.
Action start 12:29:28: UnregisterTypeLibraries.
Action ended 12:29:28: UnregisterTypeLibraries. Return value 1.
Action start 12:29:28: RemoveODBC.
Action ended 12:29:28: RemoveODBC. Return value 1.
Action start 12:29:28: UnregisterFonts.
Action ended 12:29:28: UnregisterFonts. Return value 1.
Action start 12:29:28: RemoveRegistryValues.
Action ended 12:29:28: RemoveRegistryValues. Return value 1.
Action start 12:29:28: UnregisterClassInfo.
Action ended 12:29:28: UnregisterClassInfo. Return value 1.
Action start 12:29:28: UnregisterExtensionInfo.
Action ended 12:29:28: UnregisterExtensionInfo. Return value 1.
Action start 12:29:28: UnregisterProgIdInfo.
Action ended 12:29:28: UnregisterProgIdInfo. Return value 1.
Action start 12:29:28: UnregisterMIMEInfo.
Action ended 12:29:28: UnregisterMIMEInfo. Return value 1.
Action start 12:29:28: RemoveIniValues.
Action ended 12:29:28: RemoveIniValues. Return value 1.
Action start 12:29:28: RemoveShortcuts.
Action ended 12:29:28: RemoveShortcuts. Return value 0.
Action start 12:29:28: RemoveEnvironmentStrings.
Action ended 12:29:28: RemoveEnvironmentStrings. Return value 1.
Action start 12:29:28: RemoveDuplicateFiles.
Action ended 12:29:28: RemoveDuplicateFiles. Return value 1.
Action start 12:29:28: RemoveFiles.
Action ended 12:29:28: RemoveFiles. Return value 0.
Action start 12:29:28: RemoveFolders.
Action ended 12:29:28: RemoveFolders. Return value 1.
Action start 12:29:28: ExtractAmCore05ContentHelper.
12:29:28:345 - McAfee CustomAction : Begin ExtractAmCore05ContentHelper
12:29:28:347 - Temp path obtained successfully
12:29:28:348 - Appended AMCore05ContentHelper Temp Path successfully : C:\Windows\TEMP\AmCore05ContentHelper.exe
12:29:28:349 - Install path obtained successfully
12:29:28:350 - Appended AMCore05ContentHelper to Install Path successfully : C:\Program Files\McAfee\Endpoint Security\\Threat Prevention\AMCore\Content\AmCore05ContentHelper.exe
12:29:28:352 - McAfee CustomAction : End AMCore05ContentHelper
Action ended 12:29:28: ExtractAmCore05ContentHelper. Return value 1.
Action start 12:29:28: CreateFolders.
Action ended 12:29:28: CreateFolders. Return value 1.
Action start 12:29:28: MoveFiles.
Action ended 12:29:28: MoveFiles. Return value 1.
Action start 12:29:28: Extract_BOP_Binaries.B0543E55_ECD7_4CB6_89C0_A49DF5349B0E.
12:29:28:365 - McAfee CustomAction : Driver : Begin Extract_EP
12:29:28:367 - >> Platform is 64-bit
12:29:28:368 - Temp path obtained successfully
12:29:29:132 - McAfee CustomAction : Driver : End Extract_EP
Action ended 12:29:29: Extract_BOP_Binaries.B0543E55_ECD7_4CB6_89C0_A49DF5349B0E. Return value 1.
Action start 12:29:29: CAD_CleanupBOPBins_RB.B0543E55_ECD7_4CB6_89C0_A49DF5349B0E.
Action ended 12:29:29: CAD_CleanupBOPBins_RB.B0543E55_ECD7_4CB6_89C0_A49DF5349B0E. Return value 1.
Action start 12:29:29: CleanupBOPBinaries_Rollback.B0543E55_ECD7_4CB6_89C0_A49DF5349B0E.
Action ended 12:29:29: CleanupBOPBinaries_Rollback.B0543E55_ECD7_4CB6_89C0_A49DF5349B0E. Return value 1.
Action start 12:29:29: SetCAData_CopyBOPBinaries.B0543E55_ECD7_4CB6_89C0_A49DF5349B0E.
Action ended 12:29:29: SetCAData_CopyBOPBinaries.B0543E55_ECD7_4CB6_89C0_A49DF5349B0E. Return value 1.
Action start 12:29:29: CopyBOPBinaries.B0543E55_ECD7_4CB6_89C0_A49DF5349B0E.
Action ended 12:29:29: CopyBOPBinaries.B0543E55_ECD7_4CB6_89C0_A49DF5349B0E. Return value 1.
Action start 12:29:29: CAD_CleanupBOPBins_CT.B0543E55_ECD7_4CB6_89C0_A49DF5349B0E.
Action ended 12:29:29: CAD_CleanupBOPBins_CT.B0543E55_ECD7_4CB6_89C0_A49DF5349B0E. Return value 1.
Action start 12:29:29: CleanupBOPBinaries_Commit.B0543E55_ECD7_4CB6_89C0_A49DF5349B0E.
Action ended 12:29:29: CleanupBOPBinaries_Commit.B0543E55_ECD7_4CB6_89C0_A49DF5349B0E. Return value 1.
Action start 12:29:29: SetCAData_Install_BOP_CusDr.B0543E55_ECD7_4CB6_89C0_A49DF5349B0E.
Action ended 12:29:29: SetCAData_Install_BOP_CusDr.B0543E55_ECD7_4CB6_89C0_A49DF5349B0E. Return value 1.
Action start 12:29:29: Install_BOP_CustomDriver.B0543E55_ECD7_4CB6_89C0_A49DF5349B0E.
Action ended 12:29:29: Install_BOP_CustomDriver.B0543E55_ECD7_4CB6_89C0_A49DF5349B0E. Return value 1.
Action start 12:29:29: SetCAData_Install_NIP_CusDr.B0543E55_ECD7_4CB6_89C0_A49DF5349B0E.
Action ended 12:29:29: SetCAData_Install_NIP_CusDr.B0543E55_ECD7_4CB6_89C0_A49DF5349B0E. Return value 1.
Action start 12:29:29: Install_NIPS_CustomDriver.B0543E55_ECD7_4CB6_89C0_A49DF5349B0E.
Action ended 12:29:29: Install_NIPS_CustomDriver.B0543E55_ECD7_4CB6_89C0_A49DF5349B0E. Return value 1.
Action start 12:29:29: InstallFiles.
Action ended 12:29:29: InstallFiles. Return value 1.
Action start 12:29:29: SetCAData_Copy2015RedistAsPrivateAssembly.
Action ended 12:29:29: SetCAData_Copy2015RedistAsPrivateAssembly. Return value 1.
Action start 12:29:29: Copy2015RedistAsPrivateAssembly.
Action ended 12:29:29: Copy2015RedistAsPrivateAssembly. Return value 1.
Action start 12:29:29: PatchFiles.
Action ended 12:29:29: PatchFiles. Return value 1.
Action start 12:29:29: Extract_MfeIST.
12:29:29:423 - McAfee CustomAction : Begin ExtractmfeISTUtility
12:29:29:425 - Temp path obtained successfully
12:29:29:425 - Appended MfeIST Temp Path successfully : C:\Windows\TEMP\MfeIST.exe
12:29:29:444 - Failed to create mfeIST, Error 1
12:29:29:445 - McAfee CustomAction : End ExtractmfeISTUtility
Action ended 12:29:29: Extract_MfeIST. Return value 1.
Action start 12:29:29: SetCAData_Install_CasperSDK_UPD.
Action ended 12:29:29: SetCAData_Install_CasperSDK_UPD. Return value 1.
Action start 12:29:29: Install_CasperSDK.
Action ended 12:29:29: Install_CasperSDK. Return value 1.
Action start 12:29:29: DuplicateFiles.
Action ended 12:29:29: DuplicateFiles. Return value 1.
Action start 12:29:29: BindImage.
Action ended 12:29:29: BindImage. Return value 1.
Action start 12:29:29: CreateShortcuts.
Action ended 12:29:29: CreateShortcuts. Return value 0.
Action start 12:29:29: RegisterClassInfo.
Action ended 12:29:29: RegisterClassInfo. Return value 1.
Action start 12:29:29: RegisterExtensionInfo.
Action ended 12:29:29: RegisterExtensionInfo. Return value 1.
Action start 12:29:29: RegisterProgIdInfo.
Action ended 12:29:29: RegisterProgIdInfo. Return value 1.
Action start 12:29:29: RegisterMIMEInfo.
Action ended 12:29:29: RegisterMIMEInfo. Return value 1.
Action start 12:29:29: WriteRegistryValues.
Action ended 12:29:29: WriteRegistryValues. Return value 1.
Action start 12:29:29: WriteIniValues.
Action ended 12:29:29: WriteIniValues. Return value 1.
Action start 12:29:29: WriteEnvironmentStrings.
Action ended 12:29:29: WriteEnvironmentStrings. Return value 1.
Action start 12:29:29: RegisterFonts.
Action ended 12:29:29: RegisterFonts. Return value 1.
Action start 12:29:29: InstallODBC.
Action ended 12:29:29: InstallODBC. Return value 0.
Action start 12:29:29: RegisterTypeLibraries.
Action ended 12:29:29: RegisterTypeLibraries. Return value 1.
Action start 12:29:29: SelfRegModules.
Action ended 12:29:29: SelfRegModules. Return value 1.
Action start 12:29:29: RegisterComPlus.
Action ended 12:29:29: RegisterComPlus. Return value 0.
Action start 12:29:29: InstallServices.
Action ended 12:29:29: InstallServices. Return value 1.
Action start 12:29:29: MsiConfigureServices.
Action ended 12:29:29: MsiConfigureServices. Return value 1.
Action start 12:29:29: StartServices.
Action ended 12:29:29: StartServices. Return value 1.
Action start 12:29:29: SetCAData_StartMMSService_RB.
Action ended 12:29:29: SetCAData_StartMMSService_RB. Return value 1.
Action start 12:29:29: SetCAData_StartMMSService.
Action ended 12:29:29: SetCAData_StartMMSService. Return value 1.
Action start 12:29:29: StartMMSService_RB.
Action ended 12:29:29: StartMMSService_RB. Return value 1.
Action start 12:29:29: StartMMSService.
Action ended 12:29:29: StartMMSService. Return value 1.
Action start 12:29:29: SetCAData_RestartService.
Action ended 12:29:29: SetCAData_RestartService. Return value 1.
Action start 12:29:29: RestartService.
Action ended 12:29:29: RestartService. Return value 1.
Action start 12:29:29: RegisterUser.
Action ended 12:29:29: RegisterUser. Return value 0.
Action start 12:29:29: RegisterProduct.
Action ended 12:29:29: RegisterProduct. Return value 1.
Action start 12:29:29: SetCAData_SetQuarantineFolderDacl.
Action ended 12:29:29: SetCAData_SetQuarantineFolderDacl. Return value 1.
Action start 12:29:29: SetQuarantineFolderDacl.
Action ended 12:29:29: SetQuarantineFolderDacl. Return value 1.
Action start 12:29:29: Delete_MfeIST.
Action ended 12:29:29: Delete_MfeIST. Return value 1.
Action start 12:29:29: PublishComponents.
Action ended 12:29:29: PublishComponents. Return value 1.
Action start 12:29:29: MsiPublishAssemblies.
Action ended 12:29:29: MsiPublishAssemblies. Return value 0.
Action start 12:29:29: PublishFeatures.
Action ended 12:29:29: PublishFeatures. Return value 1.
Action start 12:29:29: PublishProduct.
Action ended 12:29:29: PublishProduct. Return value 1.
Action start 12:29:29: SetCAData_UpdateVersion.
Action ended 12:29:29: SetCAData_UpdateVersion. Return value 1.
Action start 12:29:29: UpdateVersion.
Action ended 12:29:29: UpdateVersion. Return value 1.
Action start 12:29:29: Delete_VSCoreUninstHelper.
Action ended 12:29:29: Delete_VSCoreUninstHelper. Return value 1.
Action start 12:29:29: DeleteCustomActionLogPath.
Action ended 12:29:29: DeleteCustomActionLogPath. Return value 1.
Action start 12:29:29: InstallFinalize.
12:29:29:526 - McAfee CustomAction : Begin AppendHotfixRegistry
12:29:29:527 - /ModuleName=AV; /CurrentHotfixVersion=181113
12:29:29:528 - Retrieved property from CustomAction Data: ModuleName=AV
12:29:29:529 - AV
12:29:29:530 - Retrieved property from CustomAction Data: CurrentHotfixVersion=181113
12:29:29:531 - 181113
12:29:29:532 - SOFTWARE\McAfee\Endpoint\AV
12:29:29:533 - RegOpenKeyEx passed
12:29:29:534 - RegQueryValueEx passed. HotfixVersion =
12:29:29:535 - RegSetValueEx passed
12:29:29:536 - McAfee CustomAction : End AppendHotfixRegistry
12:29:29:545 - McAfee CustomAction : Begin AppendHotfixRegistryUnderNA
12:29:29:546 - /ModuleName=ENDP_AM_1060; /CurrentHotfixVersion=181113
12:29:29:548 - Retrieved property from CustomAction Data: ModuleName=ENDP_AM_1060
12:29:29:549 - Retrieved property from CustomAction Data: CurrentHotfixVersion=181113
12:29:29:550 - SOFTWARE\Network Associates\ePolicy Orchestrator\Application Plugins\ENDP_AM_1060
12:29:29:551 - RegOpenKeyEx passed
12:29:29:552 - RegQueryValueEx passed. HotfixVersion =
12:29:29:553 - RegSetValueEx passed
12:29:29:554 - McAfee CustomAction : End AppendHotfixRegistryUnderNA
12:29:29:731 - McAfee CustomAction : Begin StopMMSService
12:29:29:732 - /ServiceName=mfetp
12:29:29:733 - Retrieved property from CustomAction Data: ServiceName=mfetp
12:29:29:734 - The service named retrieved from custom action data is : mfetp
12:29:29:776 - MmsControlCreate succeeded
12:29:29:777 - OpenMSManager success
12:29:29:779 - >> Service opened successfully
12:29:29:780 - Service stop API called successfully
12:29:32:782 - Current state of service : 1
12:29:32:783 - Service is in stopped state now
12:29:32:784 - McAfee CustomAction : End StopMMSService
12:29:32:813 - Retrieved property from CustomAction Data: VSCore=C:\Program Files (x86)\McAfee\Endpoint Security\Endpoint Security Platform\VSCore\
12:29:32:814 - C:\Program Files (x86)\McAfee\Endpoint Security\Endpoint Security Platform\VSCore\
12:29:32:815 - Retrieved property from CustomAction Data: InstallDir=C:\Program Files\McAfee\Endpoint Security\Threat Prevention\IPS
12:29:32:816 - >> Platform is 64-bit
12:29:32:817 - Retrieved property from CustomAction Data: InstallDir32=C:\Program Files (x86)\McAfee\Endpoint Security\Threat Prevention\IPS
12:29:32:818 - C:\Program Files (x86)\McAfee\Endpoint Security\Endpoint Security Platform\VSCore\x64
12:29:32:821 - Copy file succeededed for mfeepmpk.xml
12:29:32:824 - Copy file succeededed for mfeepmpk.sys
12:29:32:826 - Copy file succeededed for mfeepmpk.inf
12:29:32:828 - Copy file succeededed for mfeepmpk.cat
12:29:32:830 - Copy file succeededed for mfeepnfcp.xml
12:29:32:833 - Copy file succeededed for mfeepnfcp.sys
12:29:32:835 - Copy file succeededed for mfeepnfcp.inf
12:29:32:838 - Copy file succeededed for mfeDrvInstaller.exe
12:29:32:840 - File AppMon.dat already existing on target system, not replacing it
12:29:32:841 - File Content.bin already existing on target system, not replacing it
12:29:32:843 - File Gbop.dat already existing on target system, not replacing it
12:29:32:845 - File HIPHandlers64.dat already existing on target system, not replacing it
12:29:32:847 - File HIPHandlers64.dll already existing on target system, not replacing it
12:29:32:848 - File Signatures_8.xml already existing on target system, not replacing it
12:29:32:851 - File ips_hooking_whitelist_8.xml already existing on target system, not replacing it
12:29:32:853 - File ENS_AP_Rules.dat already existing on target system, not replacing it
12:29:32:855 - File Hiphandlers.dat already existing on target system, not replacing it
12:29:32:856 - File HIPHandlers.dll already existing on target system, not replacing it
12:29:32:857 - McAfee CustomAction : End CopyBOPBinaries
12:29:32:870 - McAfee CustomAction : Driver : Begin ExecuteCustomDriverInstall
12:29:32:872 - /DriverInstDir=C:\Program Files (x86)\McAfee\Endpoint Security\Endpoint Security Platform\VSCore\x64\; /DriverName=mfeepmpk; /DriverShortName=EP
12:29:32:873 - Retrieved property from CustomAction Data: DriverInstDir=C:\Program Files (x86)\McAfee\Endpoint Security\Endpoint Security Platform\VSCore\x64\
12:29:32:874 - C:\Program Files (x86)\McAfee\Endpoint Security\Endpoint Security Platform\VSCore\x64\
12:29:32:875 - Retrieved property from CustomAction Data: DriverName=mfeepmpk
12:29:32:875 - mfeepmpk
12:29:32:876 - Retrieved property from CustomAction Data: DriverShortName=EP
12:29:32:877 - Temp path obtained successfully
12:29:32:878 - Appended Install log directory to Temp Path successfully
12:29:32:879 - Install log directory already exists
12:29:32:880 - >> Installing Custom Driver: "C:\Program Files (x86)\McAfee\Endpoint Security\Endpoint Security Platform\VSCore\x64\mfeDrvInstaller.exe" -i mfeepmpk -s mfeepmpk.sys -c mfeepmpk.cat -f mfeepmpk.inf -l "C:\Windows\TEMP\\McAfeeLogs\McAfee_Threat_Prevention_EP_ENS_Install_112618_122932.log"
12:29:32:880 - RunCommandLine: "C:\Program Files (x86)\McAfee\Endpoint Security\Endpoint Security Platform\VSCore\x64\mfeDrvInstaller.exe" -i mfeepmpk -s mfeepmpk.sys -c mfeepmpk.cat -f mfeepmpk.inf -l "C:\Windows\TEMP\\McAfeeLogs\McAfee_Threat_Prevention_EP_ENS_Install_112618_122932.log"
12:29:33:138 - RunCommandLine: Process return code : 0
12:29:33:140 - >> Custom Driver install succeeded
12:29:33:141 - McAfee CustomAction : Driver : End ExecuteCustomDriverInstall
12:29:33:156 - McAfee CustomAction : Driver : Begin ExecuteCustomDriverInstall
12:29:33:157 - /DriverInstDir=C:\Program Files (x86)\McAfee\Endpoint Security\Endpoint Security Platform\VSCore\x64\; /DriverName=MfeEpNfcp; /DriverShortName=NIPS
12:29:33:158 - Retrieved property from CustomAction Data: DriverInstDir=C:\Program Files (x86)\McAfee\Endpoint Security\Endpoint Security Platform\VSCore\x64\
12:29:33:159 - C:\Program Files (x86)\McAfee\Endpoint Security\Endpoint Security Platform\VSCore\x64\
12:29:33:160 - Retrieved property from CustomAction Data: DriverName=MfeEpNfcp
12:29:33:160 - MfeEpNfcp
12:29:33:161 - Warning : cat not present for driver.
12:29:33:162 - Retrieved property from CustomAction Data: DriverShortName=NIPS
12:29:33:162 - Temp path obtained successfully
12:29:33:163 - Appended Install log directory to Temp Path successfully
12:29:33:164 - Install log directory already exists
12:29:33:165 - >> Installing Custom Driver: "C:\Program Files (x86)\McAfee\Endpoint Security\Endpoint Security Platform\VSCore\x64\mfeDrvInstaller.exe" -i MfeEpNfcp -s MfeEpNfcp.sys -f MfeEpNfcp.inf -l "C:\Windows\TEMP\\McAfeeLogs\McAfee_Threat_Prevention_NIPS_ENS_Install_112618_122933.log"
12:29:33:167 - RunCommandLine: "C:\Program Files (x86)\McAfee\Endpoint Security\Endpoint Security Platform\VSCore\x64\mfeDrvInstaller.exe" -i MfeEpNfcp -s MfeEpNfcp.sys -f MfeEpNfcp.inf -l "C:\Windows\TEMP\\McAfeeLogs\McAfee_Threat_Prevention_NIPS_ENS_Install_112618_122933.log"
12:29:33:228 - RunCommandLine: Process return code : 0
12:29:33:229 - >> Custom Driver install succeeded
12:29:33:230 - McAfee CustomAction : Driver : End ExecuteCustomDriverInstall
12:29:33:426 - McAfee CustomAction : Start Copy2015RedistAsPrivateAssembly
12:29:33:427 - Retrieved property from CustomAction Data: InstallDir=C:\Program Files\McAfee\Endpoint Security\Threat Prevention
12:29:33:428 - RegOpenKeyEx passed
12:29:33:429 - RegQueryValueEx passed. The path of szInstallDir64 : C:\Program Files\McAfee\Endpoint Security\Endpoint Security Platform
12:29:33:430 - Copy attempted from C:\Program Files\McAfee\Endpoint Security\Endpoint Security Platform\Microsoft.VC140.CRT to C:\Program Files\McAfee\Endpoint Security\Threat Prevention
12:29:33:442 - RegOpenKeyEx passed
12:29:33:444 - RegQueryValueEx passed. The path of szInstallDir64 : C:\Program Files\McAfee\Endpoint Security\Endpoint Security Platform
12:29:33:444 - Copy attempted from C:\Program Files\McAfee\Endpoint Security\Endpoint Security Platform\Microsoft.UniversalCRT to C:\Program Files\McAfee\Endpoint Security\Threat Prevention
12:29:33:510 - Copy succeeded for 2015 CRT and UCRT
12:29:33:511 - Retrieved property from CustomAction Data: InstallDir32=C:\Program Files (x86)\McAfee\Endpoint Security\Threat Prevention
12:29:33:512 - RegOpenKeyEx passed
12:29:33:513 - RegQueryValueEx passed. The path of szInstallDir32 : C:\Program Files (x86)\McAfee\Endpoint Security\Endpoint Security Platform
12:29:33:513 - Copy attempted from C:\Program Files (x86)\McAfee\Endpoint Security\Endpoint Security Platform\Microsoft.VC140.CRT to C:\Program Files (x86)\McAfee\Endpoint Security\Threat Prevention
12:29:33:524 - RegOpenKeyEx passed
12:29:33:525 - RegQueryValueEx passed. The path of szInstallDir32 : C:\Program Files (x86)\McAfee\Endpoint Security\Endpoint Security Platform
12:29:33:526 - Copy attempted from C:\Program Files (x86)\McAfee\Endpoint Security\Endpoint Security Platform\Microsoft.UniversalCRT to C:\Program Files (x86)\McAfee\Endpoint Security\Threat Prevention
12:29:33:588 - x86 Copy succeeded for 2015 CRT and UCRT
12:29:33:589 - McAfee CustomAction : End Copy2015RedistAsPrivateAssembly
Info 1603.The file C:\Program Files\McAfee\Endpoint Security\Threat Prevention\IPS\EpMPApi.dll is being held in use. Close that application and retry.
12:30:18:653 - McAfee CustomAction : Driver : Begin ExecuteCasperSDKInstall
12:30:18:654 - Retrieved property from CustomAction Data: QuarantineFolder=C:\Quarantine
12:30:18:655 - Retrieved property from CustomAction Data: CasperSDK=C:\Program Files\McAfee\Endpoint Security\Threat Prevention\AMCore\
12:30:18:656 - C:\Program Files\McAfee\Endpoint Security\Threat Prevention\AMCore\Install\mfeamcin.exe
12:30:18:656 - McAfee CustomAction : Begin CheckIfNewerAMCorePackaged
12:30:18:657 - Retrieved property from CustomAction Data: PACKAGEDAMCORE=18.10.0.324.4
12:30:18:658 - Reg key opened successfully : SOFTWARE\McAfee\Endpoint\AV\ENSAMCoreVersionTrack
12:30:18:660 - The AMCore package available with ENS on the target system is : 18.9.0.293.2
12:30:18:661 - The AMCore package carried by this installer is : 18.10.0.324.4
12:30:18:661 - A newer AMCore installer is carried by this package. Setting a property to indicate newer AMCore packaged
12:30:18:663 - McAfee CustomAction : End CheckIfNewerAMCorePackaged
12:30:18:663 - Retrieved property from CustomAction Data: PackagedAMCoreDir=C:\ProgramData\McAfee\Agent\Current\ENDP_AM_1060\HotFix\181113\0000\\PackagedAMCore
12:30:18:664 - Directory created successfully : C:\Program Files\McAfee\Endpoint Security\Threat Prevention\AMCore\Install\
12:30:18:706 - Directory created successfully : C:\Program Files\McAfee\Endpoint Security\Threat Prevention\AMCore\Install\\x86
12:30:18:709 - Directory created successfully : C:\Program Files\McAfee\Endpoint Security\Threat Prevention\AMCore\Install\\x86_64
12:30:18:712 - copying config file from C:\Program Files\McAfee\Endpoint Security\Threat Prevention\AMCore\mfeavsconfigVse9.xml to C:\Program Files\McAfee\Endpoint Security\Threat Prevention\AMCore\Install\mfeavsconfigVse9.xml.
12:30:18:713 - Installing AMCore...
12:30:18:714 - Retrieved property from CustomAction Data: ReInstallMode=OS
12:30:18:714 - !> Value of ReInstall is: OS
12:30:18:715 - Retrieved property from CustomAction Data: AVSolution=C:\Program Files\Common Files\McAfee\AVSolution\
12:30:18:716 - Retrieved property from CustomAction Data: EngineDir=C:\Program Files\Common Files\McAfee\Engine\
12:30:18:717 - Temp path obtained successfully
12:30:18:717 - Appended Engine cab to Temp Path successfully : C:\Windows\TEMP\Amcore_OEM_Content.cab
12:30:18:718 - Temp path obtained successfully
12:30:18:719 - Appended MfeIST Temp Path successfully : C:\Windows\TEMP\MfeIST.exe /DisableSP
12:30:18:720 - >> Running MfeIST: C:\Windows\TEMP\MfeIST.exe /DisableSP
12:30:18:720 - RunCommandLine: C:\Windows\TEMP\MfeIST.exe /DisableSP
12:30:19:943 - RunCommandLine: Process return code : 0
12:30:19:944 - MfeIST called succesfully. Return code 0
12:30:19:946 - MfeIST ran successfully
12:30:19:947 - Extracting C:\Windows\TEMP\Amcore_OEM_Content.cab to C:\Program Files\Common Files\McAfee\Engine
12:30:19:966 - Extraction succeeded
12:30:19:967 - Temp path obtained successfully
12:30:19:968 - Appended MfeIST Temp Path successfully : C:\Windows\TEMP\MfeIST.exe /EnableSP
12:30:19:968 - >> Running MfeIST: C:\Windows\TEMP\MfeIST.exe /EnableSP
12:30:19:969 - RunCommandLine: C:\Windows\TEMP\MfeIST.exe /EnableSP
12:30:20:120 - RunCommandLine: Process return code : 0
12:30:20:121 - MfeIST called succesfully. Return code 0
12:30:20:122 - MfeIST ran successfully
12:30:20:123 - Temp path obtained successfully
12:30:20:124 - Appended Install log directory to Temp Path successfully
12:30:20:125 - Install log directory already exists
12:30:20:126 - >> Installing CasperSDK: "C:\Program Files\McAfee\Endpoint Security\Threat Prevention\AMCore\Install\mfeamcin.exe" -r -l "C:\Windows\TEMP\\McAfeeLogs\McAfee_ThreatPrevention_Caspercore_install_112618_123020.log" -etl "C:\Windows\TEMP\\McAfeeLogs\McAfee_ThreatPrevention_Caspercore_install_112618_123020.etl" -x "C:\Program Files\McAfee\Endpoint Security\Threat Prevention\AMCore\Install\mfeavsinst_ens10_6.xml" -s "C:\Program Files\McAfee\Endpoint Security\Threat Prevention\AMCore\Install\mfeavsconfigVse9.xml" -d "C:\Program Files\Common Files\McAfee\AVSolution" -c "C:\Program Files\Common Files\McAfee\Engine" -q "C:\Quarantine"

[Former Member]

If that is the full log file, then the installation didn't complete. Was the system shutdown whilst the update was running?

[ryan190]

Yes it is.

No not that i remember as this is the log from my computer.

In the event that the computer was restarted, will the update not try to install again? as i cannot speak for the other users and if they had a restart

[Former Member]

Yes, it should attempt the installation again - depends how far it got though as the installation might be corrupt. Try starting the update task again and see how far it gets.

As we've now confirmed there is no McAfee Agent or commuincation issue, you know to look at the ENS logs for reasons why it failed.

[ryan190]

didnt seem to do anything and i dont see anything in the log

However i was looking at the "about" and the hotfix is installed but the version number is wrong? i may be reading it incorrectly

But here is one that is at version 10.6.1.1169 and hotfix 181113

[ryan190]

just did the standalone update and it reports compelted but makes no changes. Its as if its now stuck