ePO 5.10 Service Pack 1 Update (ePO 5.10 SP1 CU):

[SelsKurt]

For my own case, that is NOT the main one of this conversation but the same, i did many checks.

the rollback error workaround (registry forgotten rollback name for tomcat) has been tested with success. 

after that check, i targeted the update error itself and the wmi process conflict. i stopped not one but two services related to WMI and then proceed to the update itself. With a final success. WMI is the problem in my case.

So both workaround for both issues are being seen as the main solution. So let's expect that the epolauncher process will be updated soon with those fixces to obtain a real functionnal SP1 package.

Thanks to the support for the analysis. Now it is Dev Time 😉

[rpd]

Hi folks,

I ran into this stupid error because I forgot to activate the 8.3 names when I rebuilt the server months ago. However, all previous patches could be installed without errors, including patch 15.

The install of SP1 failed and so the roll back.

Please double check:

fsutil behavior set disable8dot3 0

See:

https://kcm.trellix.com/corporate/index?page=content&id=KB76582 and

https://kcm.trellix.com/corporate/index?page=content&id=KB96464&locale=en_US

Happy patching.

[ree5g]

Followed all the guidance from here and support call before updating - update failed.

Setup.exe error - failed to apply update. All applied changes have been reverted.

(no services restart)

Restarting services error - Windows could not start the Trellix ePolicy Orchestrator 5.10.0 Server service on Local Computer. eRROR 1075: The dependency service does not exist or has been marked for deletion. 

[rpd]

Yes. See on page 9:

The entry with: Rename EPOTOMCATSRV5100 to MCAFEETOMCATSRV5100

Reboot.

[cdinet]

These 2 services, in addition to the epo services, need to be stopped before applying sp1.

Windows Management Instrumentation
WMI Performance Adapter

Be sure to restart them manually after the install.

[ree5g]

Thank you @rpd and @cdinet - it seems Windows Management Instrumentation was still running during the first attempt.

2nd attempt this service was definitely stopped. Update applied successfully 

[cdinet]

Glad to hear it!

[SelsKurt]

WMI is clearly the culprit on all epo i'm managing. No more issue on my side as the number of sucessfull update grows. 

of course this let to trellix the fact that the next epo updater should take care of it or alert the customer. and of course there is still the rollback process (registry key) to correct.

[AndyWan]

@cdinet , thanks so much for this post, it helped us to finally determine a resolution for our broken ePO server. Hopefully this helps someone else as well.

We had updated to SP1 but any attempt to rollback would fail, indicating the Tomcat service could not be stopped. The repair option via the ePOUpdater in the new SP1 CU package would fail with the same error.

We were facing a wipe/rebuild when we stumbled upon your post and with some slight tweaks, here's what ultimately got the Repair option to work for us:

1. Navigated to the "HKLM\System\CurrentControlSet\Services\MCAFEETOMCATSRV5100" Registry key
   
   
2. Renamed the "MCAFEETOMCATSRV5100" key to "EPOTOMCATSRV5100" (opposite of what seems to be working for others in other posts)
   
   
3. Updated the nested "imagePath" value to:
   "C:\PROGRA~2\McAfee\EPOLIC~1\Server\bin\tomcat9.exe //RS//EPOTOMCATSRV5100"
   
   (which was previously set to C:\PROGRA~2\McAfee\EPOLIC~1\Server\bin\tomcat9.exe //RS//MCAFEETOMCATSRV5100)
   
   
4. Rebooted the server
   
   
5. Disabled all Trellix services (as well as the Windows Management Instrumentation service, since this had been mentioned a few times in other posts)
   
   
6. Attempted the Repair option from the ePOUpdater within the ePO 5.10 SP1 CU package
   
   
7. The repair completed successfully; we confirmed we could log into the ePO, and clients began checking in and updating successfully

Thanks again!