ePO 5.10 Service Pack 1 Update (ePO 5.10 SP1 CU):

[SelsKurt]

WMI is clearly the culprit on all epo i'm managing. No more issue on my side as the number of sucessfull update grows. 

of course this let to trellix the fact that the next epo updater should take care of it or alert the customer. and of course there is still the rollback process (registry key) to correct.

[AndyWan]

@cdinet , thanks so much for this post, it helped us to finally determine a resolution for our broken ePO server. Hopefully this helps someone else as well.

We had updated to SP1 but any attempt to rollback would fail, indicating the Tomcat service could not be stopped. The repair option via the ePOUpdater in the new SP1 CU package would fail with the same error.

We were facing a wipe/rebuild when we stumbled upon your post and with some slight tweaks, here's what ultimately got the Repair option to work for us:

1. Navigated to the "HKLM\System\CurrentControlSet\Services\MCAFEETOMCATSRV5100" Registry key
   
   
2. Renamed the "MCAFEETOMCATSRV5100" key to "EPOTOMCATSRV5100" (opposite of what seems to be working for others in other posts)
   
   
3. Updated the nested "imagePath" value to:
   "C:\PROGRA~2\McAfee\EPOLIC~1\Server\bin\tomcat9.exe //RS//EPOTOMCATSRV5100"
   
   (which was previously set to C:\PROGRA~2\McAfee\EPOLIC~1\Server\bin\tomcat9.exe //RS//MCAFEETOMCATSRV5100)
   
   
4. Rebooted the server
   
   
5. Disabled all Trellix services (as well as the Windows Management Instrumentation service, since this had been mentioned a few times in other posts)
   
   
6. Attempted the Repair option from the ePOUpdater within the ePO 5.10 SP1 CU package
   
   
7. The repair completed successfully; we confirmed we could log into the ePO, and clients began checking in and updating successfully

Thanks again!

[SWISS]

* Failure on Server 1809

* EPO 5.10.0 BUILD 2428

* TIE/ATD/DXL/MSME/ENS

Just watched the SP1 go through yesterday and thought they forced work on the Update system now at Trellix....

I download the EPO 5.10 SP1 yesterday 05.06.2023 from Software Manager for two customer.

One smaller customer with only EPO5.10 latest the SP1 went through. 

One larger customer with TIE/ATD/DXL the SP1 did not went through. Rollback did not function.

After Reboot Server still down. Did a revert back to OFF Snapshot in VMWARE because could not loose any time.

I don't like the RENAME the Service with a ROLLBACK from the MSI Package. When it's known why don't you guys fix the download package asap?

Maybe a dynamic pre-check page from within the EXE/MSI which displays a latest know issues HTML page? Just some keynotes?

Sorry no more info this time did not have the nerves to copy away debug info or collect info for a case.

I will wait this time until others solve it and Trellix posts a new version to downloads.

[cdinet]

Dev is aware of rollback problems.  Most of the problems with failed installs for sp1 are with the 2 wmi services locking files.  The best solution has been to stop and disable these services prior to attempting to install and after all backups have been taken.

Windows Management Instrumentation

WMI Performance Adapter

Be sure to re-enable and start them after sp1 installs.

[SWISS]

Hello CDINET,

Thank you, once again, for helping here and direct to use.

I can report that the solution worked with disabling the 2 WMI before UPDATE and then PRIOR reboot the EPO Server.

We are unsure if we will have to do THIS for every customer we will have to update. For the smaller SBS we normally don't do VM Snapshots before such update and we would have, worst-case, fallback to VEEAM from last night.

When will the DOWNLOAD from Software be fixed for this.

It don't want to fight who problem this is (I assume Microsoft changed something) but if you write a Windows Installer MSI package you have options to monitor/Trigger exact such things.

So Re-post 2 Please asap.

Greetings from Switzerland

[cdinet]

Microsoft didn't change anything, we changed our performance counters, which wmi services monitor.  Those haven't been changed in a lot of versions, so wmi never cared about any other epo changes, but since our counters changed, wmi has to have a part in that.  So as a result, files are in use during the install with that monitoring and can't be updated.  We are working with dev on how to get that resolved for the install issues, but there is no eta on how that will get resolved specifically or when.  

[andrew_robinson]

Just had the same issue here. Registered a high sev inc with support and they sent a script within 20 mins. By then I had found this and fixed myself though....not a pleasant experience.

[BobbyDropTables]

VMware 7, Windows 2016, SQL 2016 SP3, all current Microsoft updates.  Updating from ePO CU 16 to SP1.  

[BobbyDropTables]

I tried updating yesterday from CU 15 to SP1.  As suggested, I stopped and disabled both WMI services and the three ePO services, disabled ENS, and ran the updater as administrator. 

The updater seemed to complete, as it showed 100%, but I waited a while longer to be sure then re-enabled the ePO services and rebooted the ePO server.  After the reboot only two of the ePO services were running, the Trellix ePolicy Orchestrator 5.10.0 / Apache /2.4.56 OpenSSL Service would not start - Error 1075:  The dependency service does not exist or has been marked for deletion.  The service just refused to start. 

I copied what log files I could find that the updater created, and lucky for me I had made a snapshot of this VM, so reverting was quick and easy.

It's been a couple of months - has Trellix published an improved SP1 installer that doesn't have this issue?

Anything else I can try to get SP1 installed?

[Radu]

Hi,

After first attempt to install SP1 and failed, restored from backup the ePO server and ePO database, tried a second attempt with WMI services disabled and this time it was completed without errors (this was in my test environment).

Thank you.