Install Epo 4.5 Remotely via Command line

[Former Member]

I'm trying to install epo agents remotely.  I know I can do it via EPO.  But i want the command line so i can run it remotely.

I'm currently using PSEXEC and it doesn't work.

psexec \\computer -u <user> -p ,password> -w \\server\folder\ "\\\server\folder\FRAMEPKG.exe /INSTALL=AGENT /SILENT" > F:\eporesults.txt

I extracted the framepkg.exe and have the following files:

cleanup.exe

frminst.exe

mfeagent.msi

reqseckey.bin

sitelist.xml

srpubkey.bin

I think i can i run:

frminst.exe /install=agent /siteinfo=<full path of target server’s sitelist.xml file>

but what would the full path of the target server's xml file be?  Can it be a UNC?  like this?

frminst.exe /install=agent /siteinfo=\\server\folder\sitelist.xml

Or is the file on the server or destination machine?  Can I use any path and is it just used once?

So my questions are:

1) What would the right PSEXEC command be?

2) What would be the correct framinst.exe command be ?

3) Can i run the MFEagent.msi with switches?

[Sk1dMARK · Accepted solution]

I use psexec to install agents remotely from time to time.  My process is a bit different and may be too tedious for you.  Here is how I do it:

1.) connect to the target machine by opening windows explorer and typing in: \\target machine name\c$ Press <enter> and then typing in my domain admin credentials.

2.) Copy the framepkg.exe to the c:\temp folder on the target machine.

3.) Open a CMD prompt and type the following using the domain admin credentials that correspond to the domain membership of the target machine: runas /user:domain\username cmd.exe   Press <enter>  (NOTE: I made a bunch of batch files for this step that allow me to one-click to open an admin CMD prompt for each domain I am an admin in.)

4.) I paste the following into the admin window: ""C:\Documents and Settings\<my user name>\Desktop\psexec.exe" \\target_machine_name cmd" Press <enter> (NOTE: your path to psexec will be different)

5.) I now have admin CMD prompt on the remote machine.

6.) navigate to the temp dir by typing "cd \temp" Press <enter>

7.) type in the install command "framepkg.exe /install=agent /forceinstall /silent"  Press <enter> (NOTE: you may not need the /forceinstall switch.  I use it as the only time I am forced to install an agent remotely is to fix a problem with the agent itself. e.g., the famous "Can't access path" of frameworkmanifest.xml file.)

8.) Wait 10 seconds and then Press <enter>

9.) Keep repeating step 8 for up to 5 times.  If you get no "movement" type: "cd\" Press <enter> to get back to c:\ and then type "cd \temp" Press <enter> to go back to c:\temp.

10.) Repeat step 8 a few more times if needed.  If you still get no movement, it is not going to work and you will need to log on to this specific target machine via RDP to attempt the fix.

My success rate using this process is over 99%.

Hope this helps.

Regards,

Mark

[Former Member]

That will work for me...

i forgot to ask in my original question...

Do you know the command line to update the virus definition (DAT) file silently? Or with ePO 4.5 it's called Update Security?

[Former Member]

It doesn't seem to work..  I get this after I run it.

C:\Program Files\McAfee\Common Framework>fdintCABINET_INFO
  next cabinet     =
  next disk        =
  cabinet path     = C:\WINDOWS\TEMP\mfe14A.tmp\
  cabinet set ID   = 12345
  cabinet # in set = 0 (zero based)

Extracting 'cleanup.exe'(70976) to 'C:\WINDOWS\TEMP\mfe14A.tmp\'
fdintCLOSE_FILE_INFO
   file name in cabinet = cleanup.exe

Extracting 'FrmInst.exe'(378176) to 'C:\WINDOWS\TEMP\mfe14A.tmp\'
fdintCLOSE_FILE_INFO
   file name in cabinet = FrmInst.exe

Extracting 'MFEagent.msi'(6201344) to 'C:\WINDOWS\TEMP\mfe14A.tmp\'
fdintCLOSE_FILE_INFO
   file name in cabinet = MFEagent.msi

Extracting 'reqseckey.bin'(437) to 'C:\WINDOWS\TEMP\mfe14A.tmp\'
fdintCLOSE_FILE_INFO
   file name in cabinet = reqseckey.bin

Extracting 'SiteList.xml'(2442) to 'C:\WINDOWS\TEMP\mfe14A.tmp\'
fdintCLOSE_FILE_INFO
   file name in cabinet = SiteList.xml

Extracting 'srpubkey.bin'(412) to 'C:\WINDOWS\TEMP\mfe14A.tmp\'
fdintCLOSE_FILE_INFO
   file name in cabinet = srpubkey.bin

Then i press enter and nothing.

[Former Member]

Looks like that worked.  it took a few minutes but it worked.!!

This is the command line to update the DAT silently..

C:\Program Files\McAfee\VirusScan Enterprise\mcupdate /update /quiet

[Sk1dMARK]

Glad to hear you got it to work.  Yes, I could've been more clear.  Sorry about that.  You only need to do step 8 until you see movement.  By movement, I mean what appears to be feedback from the target machine back into the CMD prompt window and it looks just like what you pasted two posts up.  Once you see movement, just wait for a time until all movement ceases (NOTE: it may pause for a bit and then more movement...after a few times doing it, you will recognize what it looks like when it is finished...it always looks the same.) and then Press <enter> once more to get back to the c: prompt.  Your install is now complete!

Regards,

Mark