How to find if the clients get updated latest definition via ePO orchestrator

[Former Member]

Hi everyone, 

Can anyone please help me on this case? All Windows laptops in my my company are installed McAfee Endpoint Security 10.6 via ePO orchestrator 5.9.0. I'm struggling some recent days to find out the way to check on ePO to see if all clients get updated. As an IT admin, I just want to make sure all clients in company have latest virus definitions but I can't see where I can get that information on ePO.

I assume that there is a place on ePO Orchestrator 5.9.0 that shows the list of the computers with McAfee installed and their status (e.g. version, latest update or not...) but I can't find out.

Highly appreciated for any ideas?

Thank you very much,

Regards - Tan

[DEViANCE]

Hi Tan,

Probably the best way to achieve this is by running an ePO Query.

You should have  one already created by default in ePO/Queries & Reports called 

Endpoint Security Threat Prevention: AMCore Content Compliance Status

You can run this which will output a report on which clients are up to date with definitions and which are out of date.

You can also duplicate the query and modify it to your liking if you need to change anything.

Regards,

Dev

[Former Member]

Hi Dev,

Thanks for your quick reply.

I've been having a look all the queries and reports as you instructed but seems there's no the query called Endpoint Security Threat Prevention: AMCore Content Compliance Status under Queries. 

The list below is all of the Queries I see on ePO Orchestrator, can you please have a look if you have time (sorry for this long list as I don't know how to show all of them here):

• Agent Community Summary
• Agent Uninstalls Attempted in the Last 7 Days
• Agent Versions Summary
• Applied Client Tasks
• Applied Policies by Policy Name
• Applied Policies for McAfee Agent
• Client Task Assignment Broken Inheritance
• Duplicate Systems Names
• Failed Product Deployment in the Last 24 Hours
• Failed Product Updates in the Last 24 Hours
• Failed User Actions in ePO Console within Last 30 Days
• Inactive Agents
• Malware Detection History
• Managed Nodes Having Point Product Policy Enforcement Failures
• Managed Nodes Having Point Product Property Collection Failures
• MCP: Endpoint Install Success/Failed events in last month
• Most Numerous Threat Event Description in the Last 60 Days
• New Agents Added to ePO per Week
• Policy Assignment Broken Inheritance
• Policy Assignment Change History by User (30 days)
• Product Deployment in the Last 24 Hours
• Product Update Success (2401) and Failures (2402) Trend for the last 2 Months
• Product Updates in the Last 24 Hours
• Systems per Top-Level Group
• Systems with High Sequence Errors
• Systems with no Recent Sequence Errors
• Threat Event Descriptions in the Last 24 Hours
• Threat Events by Systems Tree Group in the Last 60 Days
• Threat Event in the Last 2 Weeks
• Today’s Detections per Product

I've been trying to run the query one by one to to see how it works.

Thanks Dev again,

Regards - Tan

[DEViANCE]

Cant see one that would match it in your list, however we could create the query from scratch?

In you system tree if you click actions and choose columns;

On the left hand side under available columns do a search for AMCore Content Compliance Status

If you have that field you can easily create a new query to search your managed systems ( windows of course ) to check your machines are up to date.

Happy to help further if you need detailed steps to create the query.

Regards,

Dev

[cdinet]

If you are missing queries, are you sure you have all the required extensions checked in for ENS?  Extensions are what add specific default queries, such as the amcore compliance.  Also, if not logged in as global admin, make sure you have permissions to those queries.

[Former Member]

Thanks for reply @cdinet,
Honestly, as I’m very new with McAfee so I have no ideas about what the extensions checked in for ENS is. Can you please show me how to check the extensions and install it if it’s not up to date.
For the global admin, I’m not really sure if the account I’m using to log in is global one. Going to Menu -> User Management then there is only one account with account permissions as Administrator and that is the one I’m using to log in ePO Orchestrator. Is this also global administrator?
Thanks cdinet

[Former Member]

Hi Dev,

Sorry I still can’t see that field. Following your instruction, I went to Menu – System Tree – Actions – Choose columns:

• I tried to search for AMCore… but there was nothing appear
• I tried to expand the columns manually, one by one, but still no AMCore

Or some thing difference with my account or I miss something on this ePO version. Can you please show me how to create the query in detailed steps if you have time?

Sorry again for many questions because this McAfee ePO Orchestrator and McAfee EndPoint Security are very new and strange for me ☹

Thank you so much again

[cdinet]

Go to software manager and look for the ENS version you are using.  Then you should see if there are any extensions not installed.  You can also click on the bundle for it and choose install or update.  It will not overwrite any existing, but it will install any missing.  You can also check the epo console menu, software, extensions, click on endpoint security, then see what extensions are installed.  If you don't have endpoint security there, you are most likely missing the extensions.  Extensions also add the policies for the point products, so if you don't have ens policies, you are definitely missing extensions.

[Former Member]

@cdinet , thanks for quick reply.

I've googled it as well as followed your instruction to check the extension, but it seems very weird from my site. There's no Extensions link under Software in Menu, pls see the screenshot below

Thank you

[Former Member]

@cdinet , thanks for quick reply

I’ve googled it as well as followed your instruction to check the extensions, but it seems very weird and strange on my site. There’s no Extension link as you stated under Software in ePO Menu. Please see the screenshot below:Thank you