Hello,

Recently I came across that error message "Product may not be functioning as expected" in Client Events log for ENS ATP and TP installed modules on multiple machines.

All I can see is that it is under Event ID 2422, Event Description "Agent failed to enforce policy on at least one point product" and Event Type "Policy Enforcement".

My question is:

Is this a 100% indication of an endpoint issue and what should be checked on an endpoint to be sure it was a temp issue but not actual malfunction?

I guess it appears some times during initialisation or when ASCI is reached for communication.

So far we check if there is recent communication in McAfee Agent and if ENS shows malfunction indication. Is that enough?

Best regards,

Nino