Exploit Prevention Policy is daily shown as not compliant

[Olsen]

Hello Folks,

i actually have a problem with the Endpoint Security: Policy Compliance.
Every day the ePO Server tell me that the Endpoint Security Threat Prevention > Exploit Prevention Policy is not Up-To-Date on my machines. I don't understand why. I don't have changed the rule for days. Every other Policy is working fine and will be only defined and shown as old when i changed something on this rule.

I have already deleted the policy and created it new. This will only work for one day.

Can anyone give me a advice how i can resolve this issue. may be it is a bug and should be reported.

I hope i can get here some helpful hints.

thank you in advanced

Olsen

[Thussain]

Thank you for posting your query

May I know what is the version of ePO, ENS and McAfee Agent installed on the machine. 

Is this happening only on one machine or multiple machines? 

Are you seeing it in the Endpoint Security Threat Prevention: Exploit Prevention Compliance Status Monitor in the Endpoint Security : Compliance Status Dashboard ? 

[Olsen]

Hello,

sorry for my late response. Here are the Information you are ask for.

EPO-Server 5.9.1

Agent 5.6.1.157 + 308

ENS (Mostly) 10.6.1.

ESP: 1607

TP: 1666

WC:1435

FW: n/a

It is happening on a lot of machines and yes i see it in the monitor you have named.

It affects machines that have not been seen for more than a day, though on the policy were no changes were made.

I will post any screenshots later , also for your colleague.

It concerns machines that have not been seen for more than one day, although no changes have been made to the directiveEM in Client ViewENS VersionsDashboard Complianc ViewCompliance ViewVersions of Extensions

It concerns machines that have not been seen

[AdithyanT]

Hi @Olsen 

Thanks for your post here. Added to the above, May I know what is the version of Endpoint Security Platform and Endpoint Security threat prevention installed on the endpoint? I would also like to know the version of their corresponding extension from the ePO --> menu --> Extensions.

I can not recall any known issues with respect to this. It is quite strange and I have seen these kind of issues in the past when the version of installed endpoint does not match up with the version of extensions installed on the ePO. Please let me know what you observe with these versions I have requested to be collected. To verify your self if the components' versions and their extension versions are matching up, you can refer to this KBA.

I sincerely hope this helps.