EPO agent is not working

[Former Member]

Hi

I have about 344 pcs under EPO 4.0 management. sometimes, I don't know why some PCs stop communicating with EPO server. I tried to get info of the agent by typing http:\\pcname:8081 I got no display page. I noticed that when I shutdown or log off that PC. It prompt message mcafee update is not responding.
I foreced install agent from EPO, it did not work.
If I installed at client PC, it works.
Is there the way that I can remotely restart the agent?
why agent 4.0 behavoir that way?
thanks for any input
Joe

[Former Member]

MCafee epo agent 4.0 is having too many issues. I too faced similar problems with this. Then I removed it and checked-in ePO agent 3.6.03. This one is working perfectly.

MCafee has documented number of issues and solutions for agent 4.0 in its knowledgebase.

[tonyb99]

**** there is no 3.6.03 agent, the best version 3.6 agent is 3.6.608. There may be issues with the agent you are using but there are will all agent versions. This is why the agent is always being hotfixed and moving upwards.

Make sure your agent is hotfixed to the latest stable version ( for 4 I like 4.0.0.1180 for 3.6 I like 3.6.608)

Add the option under epo agent policy to run an exe after DAT update and put in the agent path with the switches to check and enforce policy and send details back to epo:
c:\program files\mcafee\common framework\cmdagent.exe -P -E -C

you can restart the agent by connecting via remote pc services and restarting the framework service, altern you can stop this kill GUID key in reg and restart to get a real new agent type feel. (for more info on GUID search the forum or knowlbase)

[Former Member]

I ran the queries to find duplicate agentGUID, I don't understand the output. Would someone help to explain..thank you very much

1) C:\>osql -E -i c:\listcomputer.sql -d ePO4_ZOSO
1> 2> 3> 4> 5> 6> 7> 8> 9> 10> 11> AgentGUID
TargetHostName
B554E662-9A03-475D-8F1D-727F39F0D817
KHINM

B554E662-9A03-475D-8F1D-727F39F0D817
KYAWZ


3C667778-0524-46C7-99EC-C1CFEE5A96F7
NGOK


3C667778-0524-46C7-99EC-C1CFEE5A96F7
NGOK1


549E595E-6D9D-41DF-AD17-C505A59A2AC4
MCKINSONE2


549E595E-6D9D-41DF-AD17-C505A59A2AC4
XP-A8N32-IMAGE


(6 rows affected)

2) C:\>osql -E -i c:\listagent.sql -d ePO4_ZOSO
1> 2> 3> 4> 5> 6> 7> 8> 9> AgentGUID
------------------------------------
B554E662-9A03-475D-8F1D-727F39F0D817
3C667778-0524-46C7-99EC-C1CFEE5A96F7
549E595E-6D9D-41DF-AD17-C505A59A2AC4

(3 rows affected)

3) C:\>osql -E -i c:\listall.sql -d ePO4_ZOSO
1> 2> 3> 4> 5> 6> 7> 8> 9> 10> AgentGUID

------------------------------------ -----------
B554E662-9A03-475D-8F1D-727F39F0D817 1704
3C667778-0524-46C7-99EC-C1CFEE5A96F7 600
549E595E-6D9D-41DF-AD17-C505A59A2AC4 14

(3 rows affected)

[twenden]

The SQL scripts is basically showing you which computers are sharing the same EPO Agent GUID.

In your examples, you have 6 systems that have issues. Computers with the name KHINM and KYAWZ are sharing the same Agent GUID B554E662-9A03-475D-8F1D-727F39F0D817. McAfee will only allow one of these two systems to be visible in your EPO directory.

What you need to do is to fix the EPO Agent GUID on one of the systems. You do this by deleting the appropriate registry keys. Repeat this for the other systems sharing the other EPO Agent GUID that your scripts shows.

We use a batch file that has the command listed below that will fix the issues:

reg delete "hklm\Software\Network Associates\ePolicy Orchestrator\Agent" /v agentguid /f
reg delete "hklm\Software\Network Associates\ePolicy Orchestrator\Agent" /v macaddress /f
net stop "mcafee framework service"
net start "mcafee framework service"
"%ProgramFiles%\Network Associates\Common Framework\cmdagent.exe" /p

B554E662-9A03-475D-8F1D-727F39F0D817 - This is the EPO agent guid
KHINM
KYAWZ

3C667778-0524-46C7-99EC-C1CFEE5A96F7 - This is the EPO agent guid
NGOK
NGOK1

549E595E-6D9D-41DF-AD17-C505A59A2AC4 - - This is the EPO agent guid
MCKINSONE2
XP-A8N32-IMAGE

[Former Member]

thank you for replying.
I fixed duplicating agent UD, but I have another questions, (note: I am newbie on EPO :confused:)
I check the systems. I noticed that some PCs which updated by SYSTEM and some update on user ID. I set up schedule update between 5am - 6pm daily. Moreover, User locked PC and update could not run (RPC service is setting to logon as local system account???). How do I re-enforce the policy that all PCs are run update regardles PC is locked
note:I meant update includes dat, engine, patches...
I am running EPO 4.0, agent 4.0.0.1180

DOLKART1 Workstation 172.30.2.200 dolkart[/B] 10/27/08 8:25:24 AM
DOLMAD Workstation 172.30.2.124 SYSTEM 10/27/08 7:55:59 AM