Upgrading from the ENS 10.7 June 2022 release requires a reboot if EDR 4.x is also installed and enabled

Technical Articles ID: KB96542
Last Modified: 2023-05-30 07:36:36 Etc/GMT

Environment

Endpoint Detection and Response (EDR) 4.1.x
Endpoint Security (ENS) Adaptive Threat Protection (ATP) 10.7
ENS Firewall 10.7
Endpoint Security Storage Protection (ENSSP) 2.x
ENS Threat Prevention 10.7
ENS Web Control 10.7

Problem

Upgrading from the ENS 10.7 June 2022 release fails if EDR 4.x is present and EDR tracing is enabled.

NOTE: This issue was addressed in the ENS 10.7 November 2022 release. Hosts already using this release or newer aren't impacted.

When using a Product Deployment task, assigned to the systems as a Client Task, the task fails.
When using the Run Client Task Now option within ePolicy Orchestrator (ePO) and selecting a deployment task, the task shows as Failed once the task completes execution and the reboot condition is set.
When performing a local installation using SetupEP.exe, the installation fails and a popup message prompts the user stating that a reboot is required to continue the installation.

NOTE: ENS doesn't currently have a method to create an event for ePO reporting related to the required reboot. Without reviewing the installation logs created by the first upgrade attempt, the reason for the install failure is unknown to the administrator.

To confirm that this specific upgrade failure is occurring, review the following log and check for the relevant error messaging.
The installation logs are created within C:\Windows\Temp\McAfeelogs when performing an ePO-based deployment. They're created within the logged-on user's temp folder, %temp%\McAfeelogs, when performing a local installation.

For example:

McAfee_Common_VSCore_Install_All_<date/time stamp>
McAfee_Common_VSCore_Install_All_24052023112615147.log

[11:26:20:990] - InstallCopyFile: Copy to C:\Program Files (x86)\Common Files\McAfee\SystemCore\mfehcinj.dll succeeded but existing file was renamed to temp with deferred delete.
[11:26:20:990] - MfeHidinHotfix::hotfixInstallStandalone A reboot is required. Returning ERROR_SUCCESS_REBOOT_REQUIRED.
[11:26:21:006] - VSCore version is [23.2.0.184.4], per manifest [ALL.xml]
[11:26:21:006] - Reboot required after complete uninstall - LastVersion: 99.99.99.99.17557 ThisVersion: 23.2.0.184.4
[11:26:21:006] - ERROR. A reboot is required before Installation can proceed.
Please reboot before trying to install again.

Cause

The Common Platform installer sets a reboot condition prior to continuing with the installation task. If the reboot condition isn't met, the upgrade can't continue.

This issue only impacts systems that are currently using the 10.7 June 2022 release, and that are also using EDR 4.x with tracing enabled.

Solution

To successfully upgrade from the ENS 10.7 June 2022 release, in the presence of EDR 4.x, you must install a hotfix using the Common Platform installer.

IMPORTANT: Installation of this hotfix requires mfehcinj.dll to be renamed and deleted on reboot. This allows a new version of the dll to be copied to the disk. The renaming of the dll and the required reboot is because EDR makes use of the dll during the ENS upgrade attempt.

Workaround 1

For systems where the task has already been executed, reboot them and run the deployment task again.

NOTE: When using a Product Deployment task with a schedule of Run Immediately, that same task doesn't run again unless you make a change to the task.
Changing the name of the Product Deployment task allows this type of task to run again during the next Agent-to-server communication interval.

Workaround 2

For systems where the upgrade has not been attempted, disable EDR tracing before attempting the upgrade. If the upgrade has already been attempted, please use the first Workaround.

Edit the assigned EDR General policy.
Click the Trace tab and deselect Enable the trace and the Enable deep inspection of Windows API calls options.
Save the policy.
Enforce the policy change and send an Agent wakeup call.
Run the deployment task.

When you disable the policy options above and then enforce the policy, EDR attempts the removal of mfehcinj.dll and if sucessful, the upgrade succeeds.

IMPORTANT: Once the installation is complete, enable tracing for EDR by returning the EDR policy back to its original configuration, and sending a new Agent wakeup call.

Related Information

Also see KB96049 - Upgrading Tellix Endpoint or EDR 4.1 requires a reboot as part of the install or upgrade process.

Affected Products

Languages:

This article is available in the following languages:

Knowledge Center

Upgrading from the ENS 10.7 June 2022 release requires a reboot if EDR 4.x is also installed and enabled

Environment

Problem

Cause

Solution

Workaround 1

Workaround 2

Related Information

Affected Products

Languages:

Title

Title

Knowledge Center

Upgrading from the ENS 10.7 June 2022 release requires a reboot if EDR 4.x is also installed and enabled

Environment

Problem

Cause

Solution

Workaround 1

Workaround 2

Related Information

Affected Products

Languages:

Choose your region

Title

Title