Out of Date DAT Files 1

[helpoutwithmcafee]

Hello guys,

I have an EPO Server 3.6.1 and have deployed the latest CMA. PC's are running VS8.0 with patch 14. Only 1 major issue:
DAT files are not being updated. I have created a task to deploy immediately, but no luck - any suggestions?

 

[VictorySabre]

Did the DAT updates ever work before or is this a clean install/deployment? If this is an existing deployment, do you recall if the clients all stopped doing DATs around the same time?

 

[helpoutwithmcafee]

Hi, thanks for the reply,

The DAT file updates did work before, I upgraded to EPO Server 3.6.1 and CMA 3.6.0.453. The deployment of the latest CMA works fine but the task for the DAT updates are not working, I have 5 or more DAT files out of date. If I change the task to run immediately and do an agent wake up call and set randomization to +/- 45 mins, nothing happens. I have checked policies, have the Virus Scan 8.0i NAP checked in, etc. I have permissions to the workstations as the deployment task works. What could it be....

 

[helpoutwithmcafee]

Here is an extract of the log file:
Strange thing is that is says the update is succesful but the reports on the EPO server show they are out of date

Added a new task Updates to Scheduler's task list
20070320130038 i #3832 Script Backing up file(s) Engine DAT
20070320130038 i #3252 Script Pre-notifying for DAT update.
20070320130038 i #1720 Script Copying DAT.
20070320130039 i #3252 Script Update succeeded to version 4.0.4987.
20070320130039 i #1720 Script Post-notifying for DAT update.
20070320130043 i #3252 Script Update Finished
20070320130043 i #3252 Script Closing the update session.

 

[helpoutwithmcafee]

Only other thing I can think of is the use of NT authentication rather the SQL authentication - do you think that is the issue

 

[VictorySabre]

So it appears your clients are updating, but they are not reporting back to the ePO Server. This is very similar to what I've experienced on my end after I upgraded some of my ePO Agents to CMA 3.6.0.453. Those PCs that upgraded to CMA 3.6.0.453 no longer took any policy changes I made on the ePO Server and DAT updates also never appeared to be reported correctly.

Not sure if the condition I'm seeing is the same as what you have, but it can be an easy check to test on one of your PCs.

On one of your PCs, locate the Agent_PCNAME.log file. (Substitute PCNAME with one of the PCs not reporting correctly) On my PC, it was located at C:\Documents and Settings\All Users\Application Data\McAfee\Common Framework\Db.

See if that log file has any indication of a "SignIt Error -2147483640". (Leave out the double quotes when searching) When I was going through the logs on my PCs that were having these problems, this is what I found on my PC.

Doing a search on McAfee's web site came up with the following web page (KB article #5803947):

https://knowledge.mcafee.com/article/86/5803947_f.SAL_Public.html

When I used the workaround suggested in that KB article on my client PCs and deleted the registry keys mentioned and restarted the service, the agents were able to communicate with my ePO Server and policies were able to be downloaded and applied successfully and DAT updates were reported successfully as well.

Let see if you have the same problem.

 

[helpoutwithmcafee]

Thanks for that, it seems to be the same issue. I have tried the resolution and it fixes the issue. Any idea when mcafee will release a fix for this issue.

 

[VictorySabre]

No idea when/if the fix will come out. Based on that article, they are still investigating the issue. I've basically held off on the deployment of the new agent on my end until I get a good solution/workaround to correct the problem as I deploy the agent.

What I did do was use SMS to roll out the registry deletion and service restart on all the PCs with CMA 3.6.0.453 and that at least got my existing PCs working.

I may have to stick to that solution for the rest of my PCs until the next agent version is released, whenever it is.

 

[jeffatemc]

Thanks for that tip Victory, I was able to correct many,many units that were not reporting. Have a star!

 

[VictorySabre]

Woo-hoo! Thanks for the star!