• Procmon monitors and displays all file system activity on a Microsoft Windows operating system in real time. It's used in system administration, computer forensics, and application debugging.
• Procdump is a command-line utility used to monitor an application for CPU spikes. It generates crash dumps during a spike that an administrator or developer can use to determine the cause of the spike.
• Perfmon is a tool that administrators can use to examine how programs, running on their computers, affect the computer's performance. The tool is used in real time to analyze how system performance is affected by running programs. You can also use this tool to collect log file information for system performance data analysis later.
• MER collects event logs, file version details, files, process details, and registry details from our products installed on your computer. Data collected is analyzed and used by Technical Support to resolve problems.
• GFlags allows you to enable and disable advanced internal system diagnostic and troubleshooting features. You can run GFlags from a Command Prompt window or use its graphical user interface dialog box. It's most often used to turn on indicators that other tools track, count, and log.
• WinDbg is a debugger for the Microsoft Windows operating system, distributed by Microsoft. It can be used to debug user mode applications, device drivers, and the operating system itself in kernel mode. It has a graphical user interface and is more powerful than Visual Studio Debugger.
• PoolMon displays data that the operating system collects about memory allocations from the system paged and nonpaged kernel pools, and memory pools used for Terminal Services sessions. The data is grouped by pool allocation tag. Microsoft Technical Support uses that information to find kernel mode memory leaks.
• VMware converter is a free utility from VMware that helps convert Windows and Linux-based physical systems to VMware virtual machines. You can also use it to convert third-party image formats such as backup images and other virtual machines to VMware virtual machines. Use this tool to create virtual machines to provide to Technical Support for troubleshooting.

1. What's the operating system?
2. What's the Solidcore version?
3. If any other Trellix software is installed?
4. What's the system used for (file server, workstation, domain controller)?
5. What's the issue?
6. What troubleshooting has been done?

1. Does the behavior change in any other mode (update, enabled, observe, disabled)?
2. Does the behavior change with MP disabled?
3. Does the behavior change with Execution control disabled?

1. What's the version of ePO?
2. What's the Current Solidcore Extension version?
3. If extension is upgraded, what's the upgrade path of the extension?
4. What's the error message on the screen vs. the Orion log?
5. Provide any screenshots showing the issue.

• Full SQL Backup and Disaster Recovery: Use the Knowledge Base to search for "backup/recovery for ePO" if you have a cluster or "AWS" because there's a separate KB article for each.
• Solidcore Rules
• Solidcore Policy
• Solidcore Policy Assignments
• Solidcore Client Tasks
• Solidcore Client Task Assignments
• Custom Solidcore Dashboards
• Custom Solidcore Queries
• Custom Solidcore Automatic Responses
• Custom Solidcore Permission sets
• Screenshot of any custom Solidcore Settings
• Export table for Certificates (we're unable to export the Certificates; you must have them again)
• Export table for Installer hashes (you must reinsert the hashes and the certs into the installers)
• Server tasks

• Verify that all required root certificates are installed. For details, see the related articles below:

1. Download Procmon.
2. Run Procmon with boot logging.
3. Reproduce the issue.
4. Collect the MER, Gatherinfo, and Procmon files (*.PML).

1. Download Procmon.
2. Run Procmon as Administrator.
3. Reproduce the issue.
4. Collect the MER, Gatherinfo, and Procmon files (*.PML).
5. Collect the following for the application:
   • Process name of application being started
   • Version of application
   • Whether the application is homegrown or made by another company
   • Copy of the application or a link to where to get a trial version

1. Take a screenshot of the Task Manager showing High resource use with process names.
2. Note how often the slow performance happens (every 5 minutes, 60 minutes, overall).
3. Collect Windows Performance Monitor over time of slowness (5 minutes unless longer is needed).
4. Collect the MER, Gatherinfo, and Windows Perfmon files.

• To disable execution control, run "sadmin features disable execution-control"
• To enable execution control, run "sadmin features enable execution-control"

1. Download ProcDump.
2. Extract ProcDump to the Desktop.
3. Open an administrative command prompt, and change the directory to C:\Users\username\Desktop\Procdump
4. Run the following command: procdump -ma <process name/process ID>
5. Collect the dump file created. It's located in the Procdump folder.
6. Collect the MER and Gatherinfo files.

1. Download ProcDump.
2. Extract ProcDump to the Desktop.
3. Open an administrative command prompt, and change the directory to C:\Users\username\Desktop\Procdump
4. Run the following command: procdump -ma -e <process name/process ID>
   
   NOTE: The -e switch instructs Procdump to generate a dump the next time the process crashes.
    
5. Wait for the process to crash again.
6. Collect the created dump file, which is located in the Procdump folder.
7. Collect the MER and Gatherinfo files.

1. Configure the system to create a complete memory.dmp. For details, see KB56023 - How to create a memory dump for analysis by Technical Support.
2. Configure the system to allow for a keyboard crash. See the Forcing a System Crash from the Keyboard Microsoft article.
3. Create the dump file when the issue occurs. Generally, the longer you can wait before generating the dump file, the easier it is to identify the hang condition in the dump.
4. Collect the MER and Gatherinfo files.
5. Collect FLTMC.

1. Configure the system to create a complete memory.dmp. For details, see KB56023 - How to create a memory dump for analysis by Technical Support.
2. Collect the full dump file when the system Bug Check (blue screen) occurs (the dump file is in c:\windows).
3. Collect the MER and Gatherinfo files.
4. Collect FLTMC.

Perform the steps in this section if the symptoms are Slow ePO Performance, Hang or not responsive.

1. Enable Orion Debug.
2. Enable Java Heap Dump.
3. Collect the MER and Java Heap Dump files.

1. Enable Debug Orion.
2. Reproduce the issue (upgrade or install).
3. Collect an ePO MER.

1. Enable Solidcore Extension Debug.
2. Reproduce the issue.
3. Gather screenshots of the events and issue.
4. Collect an ePO MER.

1. Enable Solidcore Extension Debug.
2. Gather a screenshot of the issue with Reproduction steps.
3. Export of Dashboard (typically a query).
4. Collect an ePO MER.

1. Make sure ePO server services are running.
2. Make sure that the client is solidified.
3. Check Inventory Fetch Time (Last and Next).
4. If Inventory time is greater than seven days, rerun the Pull task.
5. If Inventory time is less than seven days, run the Inventory time reset task. To reset the Last time inventory sync on the client, run the following commands:

1. Enable Orion Debug logging.
2. Rerun the Migration task.

1. Enable ePO Server (for eventparser*.log) and Orion debug logging.
2. Enable McAfee Agent (MA) debug logging (log level 8).
3. Create some events on the client.
4. Verify that events are created in the AgentEvents folder (c:\program data\mcafee\agent\agentevents).
5. Copy the events from the client.
6. Sync MA and send the events to ePO.
7. Verify that the events go to the event parser folder (<ePO install dir>\DB\Events).
8. Collect a MER and Gatherinfo from the Client and a MER from the ePO server.

1. Enable Orion debug logging.
2. Log on to the ePO console.
3. Check ePO Registered Servers:
   Menu, Registered Servers, McAfee GTI Server, Actions, Edit
4. Test the connection; make sure it says successful.

• Collect an ePO MER.
• Collect the output of settings for GTI using SQL.

1. Open an Administrator Command Prompt.
2. Recover the local CLI by executing sadmin recover. A password is needed to unlock the local CLI.
3. Execute gatherinfo.bat (Windows) or gatherinfo.sh (UNIX).
4. After gatherinfo is completed, a file named gatherinfo.zip (Windows) or gatherinfo-<Hostname>-<Date>.tar.gz is created in the current directory.

1. On the client, download the MER client.
2. Run MER.exe on the client.
3. Select All applications or manually select ACC.
4. When finished, upload the .tgz file to the case or allow the tool to upload itself.

1. Boot the system into safe mode.
2. Start Registry Editor (Start, Run, regedit).
3. Browse to HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\swin\parameters
4. Edit key RTEModeOnReboot = 2 or 0
5. Reboot:

1. sadmin recover (a password is needed to unlock CLI)
2. sadmin loglevel enable MAHDLR ALL
3. sadmin lockdown to restrict CLI access

1. sadmin recover (a password is needed to unlock CLI)
2. sadmin loglevel disable MAHDLR ALL
3. sadmin loglevel enable MAHDLR ERROR WARNING SYSTEM
4. sadmin lockdown to restrict CLI access

1. sadmin recover (a password is needed to unlock CLI)
2. sadmin config set LogfileNum=n* - (where n* is the number of files in decimal)
3. sadmin config set LogfileSize=nnnn*** - (where nnnn** is the size of the file in kilobytes (KB))
4. sadmin lockdown to restrict

1. sadmin recover (a password is needed to unlock CLI)
2. sadmin config set LogfileNum=4
3. sadmin config set LogfileSize=2048
4. sadmin lockdown to restrict

1. Boot the system into safe mode.
2. Browse to C:\program files\mcafee\solidcore
3. Delete the file Passwd
4. Reboot into normal mode.
5. Recover CLI: sadmin recover

1. Create SC: Run command with the following commands
   • config set InvDiffLastAccessTime=default
   • config set PullInvLastAccessTime=default
2. Send the task to the client.

1. Open an Administrator Command Prompt.
2. Recover the local CLI by executing sadmin recover. A password is needed to unlock the local CLI.
3. Run the following commands:
   • sadmin config set InvDiffLastAccessTime=default
   • sadmin config set PullInvLastAccessTime=default

• sadmin auth -l > auth.txt
• findstr /R /N "^" auth.txt

1. Open an Administrator Command Prompt.
2. Recover the local CLI by executing sadmin recover. A password is needed to unlock the local CLI.
3. Run the following command:
   • sadmin usm get all
4. Check Output.

1. Collect the Install log from the client (C:\windows\solidcore_install.log).
2. Open the logs in a text editor.
3. Search for "Return Value 3."
4. Look for the error.

1. Open an administrative command prompt.
2. Type "fltmc."
3. Collect the output from the fltmc command.

1. Download Process Monitor from Microsoft.
2. Extract the file ProcessMonitor.zip to your Desktop.
3. To start logging, right-click Procmon.exe and choose Run as Administrator to run the tool.
4. Select Options, Enable Boot Logging.
5. Click OK.
6. Restart the computer.
7. When Windows has finished loading, double-click Procmon.exe.

1. Log on to the ePO Console.
2. Select Menu, Configuration, Solidcore Rules.
3. Click the Rule Groups tab.
4. Select the option User created Rules. These rules are the ones with Edit next to them.
5. Click Export.
6. Save the XML on the local computer.

1. Take the XML exported for backup and place it on the computer where you access ePO.
2. Log on to the ePO console.
3. Select Menu, Configuration, Solidcore Rules.
4. Click the Rule Groups tab.
5. Click Import.
6. Select File.
7. Click OK.

1. Log on to the ePO console.
2. Select Menu, Policy, Policy Catalog.
3. Under Product, select Application Control.
   
   NOTE: You must select this value for "Integrity Monitoring," "Change Control," and "General."
    
4. Under Category, select All.
5. On Product Properties, click Export.
6. Right-click Link.
7. Chose Save As to save the XML.

1. Place the backed-up XML of the server tasks on the computer where you access ePO.
2. Log on to the ePO console.
3. Select Menu, Policy, Policy Catalog.
4. On Product Properties, click Import.
   
   NOTE: You have to click this option for "Application Control" "Integrity monitoring," "Change Control," and "General."
    
5. Choose the file.
6. Click OK.

1. Click Start, Run, type regedit, and click OK.
2. Navigate to and expand the following registry key:

3. Select the Java subkey.
4. In the right pane, double-click the Options value and append the value data below to the bottom:

5. Click Start, Run, type services.msc, and click OK.
6. Restart the ePO Application Server service.
7. If the error occurs again, run the Minimum Escalation Requirements (MER) tool for ePO. Make sure that the Java Heap dump is included in the MER results. For more information about collecting ePO MERs, see KB72895 - How to collect a Minimum Escalation Requirements log for ePolicy Orchestrator and McAfee Agent.

1. Navigate to the C:\Program Files\McAfee\ePolicy Orchestrator\Server\conf\orion directory.
2. Open log-config.xml with a text editor.
3. Scroll to the end of file.
4. Append the section below to the end of the file before the </log4j:configuration> ending tag.

5. Save the log-config.xml file.

• Kernel
• Operating system
• X86/64
• Kernel date release
• Number of systems affected

1. Gather the information needed.
2. Open a Service Request in Insights with the following:
   • Title: Kernel Request - <OS> - <KERNEL>
   • Description: Put in the information request fields
3. Submit a JIRA request with the same information:
   • Product: Solidcore Agent
   • Version: 6.3.x
   • Component: General
   • Found build: 6.3.0 (enter the latest build available; for the latest build, see KB87944 - Supported platforms for Application and Change Control)
   • Bug Type: Product
   • Actual origin: Post Release
   • Expected Origin: Post release
   • Hardware: <Fill out your hardware> *if unsure, set to “ALL”
   • Operating system: <Fill out the OS> * if the operating system is not present on the list, select “Linux”
   • Steps to repro: N/A
   • Actual Results: N/A
   • Expected Results: N/A
   • Summary: Linux/UNIX - Kernel Request - <OS> - <KERNEL>
   • Description: Put in the information request fields

SELECT COUNT(ID) AS ROWS, DATA_TYPE

FROM SCOR_DATA_CHANNEL
GROUP BY DATA_TYPE
ORDER BY 1 DESC

SELECT COUNT(ID) AS ROWS, DATA_TYPE
FROM SCOR_STAGING_DATA_CHANNEL
GROUP BY DATA_TYPE
ORDER BY 1 DESC

SELECT * FROM [dbo].[SCOR_CONFIG] WHERE CONTEXT='cloudIntegration' OR CONTEXT='gtiIntegration' ORDER BY CONTEXT
SELECT * FROM [dbo].[OrionRegisteredServers]

select
pt.FeatureTextID,
pt.CategoryTextID,
pt.TypeTextID,
po.Name,
po.PolicyObjectID,
SUM(DATALENGTH(PSV.SettingValue)) DataSize
from EPOPolicySettingValues PSV
inner join epopolicyobjecttosettings pots
on psv.PolicySettingsID = pots.PolicySettingsID
inner join epopolicyobjects po
on pots.policyobjectid = po.policyobjectid
inner join epopolicytypes pt
on po.typeid = pt.typeid
group by pt.FeatureTextID, pt.CategoryTextID, pt.TypeTextID, po.Name, po.PolicyObjectID
having SUM(DATALENGTH(PSV.SettingValue)) > 10240
order by DataSize DESC;

select * from EPOPolicyTypes pt
inner join EPOPolicyObjects po on po.typeid = pt.typeid
where pt.TypeTextID = 'AWL Rules (Windows)' and po.name like 'McAfee Default'

select po.PolicyObjectID, po.Name, po.TypeID,
pt.TypeTextID, pt.CategoryTextID, pt.FeatureTextID,
ps.PolicySettingsID , ps.Name, ps.ParamInt, ps.ParamStr,
psv.PolicySettingValuesID, psv.SectionName, psv.SettingName, psv.SettingValue
from EPOPolicyObjects po
left join EPOPolicyTypes pt on po.TypeID = pt.TypeID
left join EPOPolicyObjectToSettings po2s on po.PolicyObjectID = po2s.PolicyObjectID
left join EPOPolicySettings ps on ps.PolicySettingsID = po2s.PolicySettingsID
left join EPOPolicySettingValues psv on psv.PolicySettingsID = ps.PolicySettingsID
where po.PolicyObjectID = 389

select Distinct po.PolicyObjectID, po.Name, po.TypeID,
pt.TypeTextID, pt.CategoryTextID, pt.FeatureTextID,
ps.PolicySettingsID , ps.Name, ps.ParamInt, ps.ParamStr,
psv.PolicySettingValuesID, psv.SectionName, psv.SettingName, psv.SettingValue
from EPOPolicyObjects po
left join EPOPolicyTypes pt on po.TypeID = pt.TypeID
left join EPOPolicyObjectToSettings po2s on po.PolicyObjectID = po2s.PolicyObjectID
left join EPOPolicySettings ps on ps.PolicySettingsID = po2s.PolicySettingsID
left join EPOPolicySettingValues psv on psv.PolicySettingsID = ps.PolicySettingsID
where pt.FeatureTextID ='SCOR_AWL' and SettingName = 'Group_name' and ps.Name not like '%Settings%'