Upgrading from 10.5.1 to 10.6.1 was not successful

[User16096767]

Upgrading from 10.5.1 to 10.6.1 was not successful. High CPU Usage mfehidin.exe. We are currently unable to kill mfehidin.exe. Self Protection is already disabled.

Log Shows: SGX related KEY(benabledSGXMode) not found.

[akatt]

Mfehidin.exe is the installer process for what we refer to as syscore.  Essentially, a fancy name for kernel drivers.  High CPU exhibited by this process would indicate that the installation is running, but of course we don't expect a long installation time.  If this was observed for a few minutes, and then completed installation sucessfully, we would consider it as-designed.  If this is running for an extended amount of time, and failing to complete, then we would certainly want to investigate further, and possibly review additional data sets, such as a Procmon and AMTrace (McAfee utility) along with a MER result.  Due to the nature of the issue, this would best be worked through an open service request with support.

Was my reply helpful?

If this information was helpful in any way, or answered your question, will you please select "Accept as Solution" in my reply, or give kudos as appropriate, so together we can help other members?

[User16096767]

What is the best way to kill Mfehidin.exe? Its consuming 60% CPU. Self Protection is disabled and still getting Access Denied. I am using Admin login.

[akatt]

@User16096767 Check the services and see if the Windows Installer is currently "running."  If so, can try and stop that service, since the McAfee installer makes use of the Windows Installer.  This might allow for then stopping the mfehidin process.  In doing so, we will most likely end up with a partial install, which will create the need to then run the Endpoint Product Removal (EPR) tool, reboot, and then perform a clean installation.  That being said, we might already be at this point, if the installer will not fail on its own and roll-back successfully.

Also, make sure that Access Protection within the ENS console is disabled (provided the current install is still functional).  The self-protection disabling does not necessarily stop all of the Access Protection blocking that can occur, if we are referring to the self-protection policy itself.  Disabling both Access Protection and the enhanced self-protection should allow more manual control over the McAfee processes.

Worst case scenario, a reboot will allow it to close out as well.

Was my reply helpful?

If this information was helpful in any way, or answered your question, will you please select "Accept as Solution" in my reply, or give kudos as appropriate, so together we can help other members?

[User16096767]

Windows Installaer is already stopped. Mcafee Service Controller is the one we were not able to stop. 

Rebooting the server is the last resort since this server is in Production.

[akatt]

@User16096767   Are we confident that all protection features, even Access Protection, is disabled? If so, we can try a taskkill command for the process PID, but can't guarantee that will work. The installer being in hung state is not a typical issue, and if we can't get any control of it through normal methods, we may be stuck with a reboot. Time permitting, it would be worth opening a service request to have a TSE review the symptoms on a remote, to see if there are other methods we could possibly apply to stop the process, without a reboot being necessary.

Could also try the EPR tool, to see if the logic within that tool will allow the processs to stop, provided it can stop all necessary services needed to perform the removal. The caveat to this, is that if it works the system will be in an unprotected state, until the system can be restarted and the product reinstalled.

Was my reply helpful?

If this information was helpful in any way, or answered your question, will you please select "Accept as Solution" in my reply, or give kudos as appropriate, so together we can help other members?

[Daniel_S]

Maybe try running the product-removal-tool without reboot?

[User16096767]

EPR tool failed to remove ENS. It did remove the agent though. It shows removed in EPR tool, but the product is still there.

[Daniel_S]

Yeah then it needs a reboot...

[User16096767]

That is what I thought we end up doing. Since this is not a workstation, we have to go through different team to accomplish rebooting.