5th December 2022

Mcafee Agent Install/Update Error and Solution via Mcafee Epo

We want to update Mcafee agent version 5.6.6.232 to version 5.7.2.162 via Mcafee ePO. It seems like it gives an access error when we try to update it. Now we will follow the steps to find the error and its solution.

  • Run Client Task Now

First, we select the “System Tree” option in Mcafee ePO to update Mcafee Agent. We choose the computer we want to update. At the bottom, we click on “Action> Tool> Run Client Task Now”.

Run Client Task Now
Run Client Task Now

 

  • Create New Task

On the “Run Client Task Now” page, we click on “Mcafee Agent> Product Deployment> Create New Task“.

Create New Task
Create New Task

 

  • Run Client Task Now

On the “Run Client Task Now” page, we select the platform we will install. We select the current Mcafee representative with “products and components“. We select the “Install” option as “Action“. We run our task by clicking on the “Run Task Now” option at the bottom.

Run Client Task Now
Run Client Task Now

 

  • Running Client Task Status

Mcafee Agent installed as shown on the “Running Client Task Status” page.

Running Client Task Status
Running Client Task Status

 

  • Server Task Log

When we look at the “Server Task Log” page, it is seen that Mcafee Agent has been successfully installed.

Server Task Log
Server Task Log

 

  • System Tree

In the “System Tree“, we click on the “Products” option of the computer. It looks like the representative has not been updated here.

System Tree
System Tree

 

  • McAfeeLogs

We open the “Frmlnst_DESKTOP-4OEUMOR” file located in “C/Windows/temp/McAfeeLogs“.

LEARN MORE  Creating a Reputation Based Detection System with Python
McAfeeLogs
McAfeeLogs

 

  • Mcafee Agent Installation Log File

When we open the “frmlnst_DESKTOP-4OEUMOR” log file, we see the “Access denied” log as a Mcafee tool installation error.

2021-04-16 10: 59: 55.478 I # 8768 Saplama Pkg	
2021-04-16 10: 59: 55.478 I # 8768 Saplama Pkg BAŞLAT ["C: \ ProgramData \ McAfee \ Agent \\ Evaluation \ EPOAGENT3000 \ Install \ 0409 \ FramePkg.exe" / UseLanguage = 0409 / Install = Agent / Silent / IsFromEPO]
2021-04-16 10: 59: 55.478 I # 8768 Common Pkg CreateDirectory (C: \ Windows \ TEMP \ mfeF7D9D448-6036-4466-A431-B0215A9BBB42.tmp)
2021-04-16 10: 59: 56.135 I # 8768 Common Pkg CreateProcess (C: \ Windows \ TEMP \ mfeF7D9D448-6036-4466-A431-B0215A9BBB42.tmp \ FrmInst.exe, / UseLanguage = 0409 / Install = Aracı / Sessiz / IsFromEPO / FramePkg /OriginalFramePkg="C:\ProgramData\McAfee\Agent\Evaluation\EPOAGENT3000\Install\0409\FramePkg.exe "/ Cleanup =" C: \ Windows \ TEMP \ mfeF7D9D448-6036-4466-A431B42-B02159BB. tmp "/ LOGDIR =" C: \ Windows \ TEMP \ McAfeeLogs "/ EmbeddedUsername =" "/ EmbeddedDomain =" "/ EmbeddedPassword =" ")
2021-04-16 10: 59: 56.150 E # 8768 Ortak Pkg hatası 5: Erişim engellendi.
2021-04-16 10: 59: 56.150 I # 8768 Saplama Pkg SON 1603
Access denied error
Access denied error

 

Solution of Mcafee Agent Install/Update Error

We select the “System Tree” option in Mcafee ePO to find the Mcafee Agent Setup error. We click on the computer we updated.

System Tree
System Tree

 

  • Threat Events

We click on the “Threat Events” tab on the detail screen of the computer. There are “Threat Events” logs. We click on the block log.

Threat Events
Threat Events

 

  • Log detail

When we examine the log, Mcafee’s “Mcafee Adaptive Threat Protection” product is blocking the Mcafee Agent “FramePkg.exe” application.

Mcafee Adaptive Threat Protection
Mcafee Adaptive Threat Protection

 

  • TIE Reputations

If you have Mcafee TIE (Threat Intelligence Exchange) on your system, allow the Mcafee Agent “FramePkg.exe” application. Since it is in our system, we will first allow it from the TIE system. If there is no TIE product, you can allow the MD5 hash of the log. To allow the MD5 hash of the log, follow the “Policy Category> Dynamic Application Containment> My Default” option on Mcafee ePO. Now click “TIE Reputations” from the menu to open Mcafee TIE (Threat Intelligence Exchange).

LEARN MORE  "Failed to connect to server (code: 1006)" Error in ATD and Solution
Mcafee TIE (Tehdit İstihbarat Değişimi)
Mcafee TIE (Threat Intelligence Exchange)

 

We are looking for “FramePkg.exe” on “TIE Reputations“. We select the application “FramePkg.exe” which is not allowed. We allow this by clicking “Process> File Known As Trusted” at the bottom.

TIE Reputations
TIE Reputations

 

  • Add comment

You can make an explanation to the “Add comment” section on the screen. Click the “OK” button.

Add comment
Add comment

 

  • Known Trusted

After the process is finished, click the “Apply” button and search again, the application will appear as “Known Trusted“.

Known Trusted
Known Trusted

 

Leave a Reply

Your email address will not be published. Required fields are marked *