Updates not applied because detection scripts were not found in Previous branch: DAT

[SypsG]

Hello all. I've had a ticket open with McAfee for a few weeks now, and they cannot seem to figure out this problem we have on 70% of our Enterprise (thousands of devices):

15-Oct-2020 01:11:28 (+00:00 UTC) 15012 Information Update Finished
15-Oct-2020 01:11:28 (+00:00 UTC) 15009 Information Completed
15-Oct-2020 01:11:28 (+00:00 UTC) 15010 Information Update Finished
15-Oct-2020 01:11:28 (+00:00 UTC) 15010 Information Updates were not applied because the detection scripts were not found in the Previous branch: DAT.
15-Oct-2020 01:11:11 (+00:00 UTC) 15010 Information Starting Engine update.
15-Oct-2020 01:11:09 (+00:00 UTC) 15010 Information Loading update configuration from: PkgCatalog.xml
15-Oct-2020 01:11:09 (+00:00 UTC) 15010 Information Extracting PkgCatalog.z.
15-Oct-2020 01:11:09 (+00:00 UTC) 15010 Information Verifying PkgCatalog.z.
15-Oct-2020 01:11:09 (+00:00 UTC) 15010 Information Downloading PkgCatalog.z.
15-Oct-2020 01:11:08 (+00:00 UTC) 15010 Information Verifying V2engdet.mcs.

This is the same error we are getting on Windows machines as well as Linux ones.

Please help.

[SypsG]

FYI:

VSEL 2.0.3

VSE 8.8.0

ePO 5.9.0

Problem is that DATs are not updating.

Thanks again.

[Hem]

Hi,

Good morning,

Make sure that you have DAT available in previous branch.

It seems that in MA policy->General policy->update tab-> for DAT, you selected 'previous branch' where as DAT is available in Current branch.

Please either modify MA policy and set Current branch for DAT or Copy the DAT file to Previous branch. That should fix the issue.

[SypsG]

Thank you, Hem.

The MA General Policy was indeed set to use Previous for DAT, and there was only Current and Evaluation branches for the DAT.

I have copied the Current to Previous, and have changed the policy to use the Current branch, but it is still giving the same error. I pulled policies and enforced on the Agent, and even uninstalled VSEL through ePO and then reinstalled it. Same error.

Is there any way to tell which branch the Agent's policy is currently using from the CLI/file system of the effected devices?

Is there any way to tell why this is NOT a problem on our VSEL Engine 5900 devices, but only on the VSEL 5800 devices? Also note that we do not have Engine nor Linux Engine 5800 checked into our Master Repository, and I'm having a problem figuring out how to find it in order to do so.

Thanks again.

[cdinet]

This will tell you what logs to look at for update failures.

https://community.mcafee.com/t5/ePolicy-Orchestrator-ePO/SOLVED-HOW-TO-TROUBLESHOOT-CLIENT-UPDATE-DE...

The 5800 engine has been end of life for several years, why are you running that engine?  It would not be compatible with newer dats.  The latest is 6100.  I wouldn't even trust the 5900 engine to be compatible, as that is end of life also.

[SypsG]

Thank you.

We are trying to figure out how to update the engines on everything, and we have no idea why the 5800 engine is getting installed, because only the 5900 engine is available on our ePO.

If the 5800 engine is not in the Previous branch, will that prevent the 5900 engine (in Current branch) from being able to be upgraded to?

R/S,

George

[cdinet]

That depends on what your agent policy is set to. Why are you running end of life engines?  Current dats are not tested against them and may not be effective.  5900 engine was eol end of April, 2019.  Even the 6000 engine will be end of life soon.  What versions of AV products are you running?  Check your agent general policy, updates tab.  The engine needs to be set to the branch the engine version you are trying to install.  Don't use the older engine versions please, you are doing yourself a disservice and reducing your security posture.

[SypsG]

Doing some manual testing and I see that I cannot access the C:\ProgramData\McAfee\Agent\Current folder due to an Access Denied problem.

Could it be possible that the McAfee apps cannot access it either, and that is why it is reporting that the detection scripts were not found in the Current branch for DATs? The Permissions are currently set to Full Control for SYSTEM and local Administrators, and the McAfee services are running as Local System.

[SypsG]

Shouldn't there be something in here for DATs themselves, and not just for EXTRADAT1000?

Directory of c:\ProgramData\McAfee\Agent\Current

08/24/2020 03:45 PM <DIR> .
08/24/2020 03:45 PM <DIR> ..
06/19/2020 09:03 AM <DIR> BOCVSE__1000
08/24/2020 03:45 PM <DIR> EPOAGENT3000
09/14/2020 12:21 AM <DIR> EPOAGENT5000META
05/07/2018 09:16 AM <DIR> EXTRADAT1000
08/24/2020 05:12 PM <DIR> VIRUSCAN8800
10/26/2020 07:27 PM <DIR> VSCANENG1000
0 File(s) 0 bytes
8 Dir(s) 22,492,467,200 bytes free

If so, how can I determine why it is missing?

Thanks,

George

[cdinet]

Those are only populated when downloaded.  Did you check your agent policy to see where it is set to pull the specific updates from, either current or previous?  I still think you are pulling from the wrong branch.