ePolicy Orchestrator prematurely deploys a McAfee product software patch or update

Technical Articles ID: KB77063
Last Modified: 2023-07-10 12:03:58 Etc/GMT

Environment

ePolicy Orchestrator (ePO) 5.x

Problem

A McAfee product software patch, update, or hotfix that has been checked in to the ePO Master Repository is deployed prematurely.

This issue can occur under any of the following conditions:

The product is enabled in Selected packages in the McAfee Agent: Product Update task configuration – All clients updated by this task receive the patch.
Individually created and managed client task objects and tasks – Any client with a Local update task enabled receives the update.
Global Updating is enabled in the ePO server configuration – All managed clients receive the update.
Update Now (One-Click Update) is selected from the McAfee Agent or VirusScan Enterprise (VSE) system tray icon – Only this client receives the update.
McAfee product installation using the McAfee Agent Deployment Task is executed on the client – All clients that execute a product installation through the deployment task receive the patch.

Cause

The Global Updating functionality is accessible from Menu, Configuration, Global Updating. Global Updating displays the same list of products as Selective Updating, but functions in a different way. The list of products in Global Updating is not a selective update list. It determines which item begins a Global Update task, not which products are updated. When a Global Update has been initiated, which triggers a One-Click update.

The Selected packages functionality is accessible within McAfee Agent: Product Update. This option instructs the Agent to apply or ignore updates and service packs for a specific product when running an Update task. By deselecting a specific product in the McAfee Agent: Product Update task, Patches, and Service packs are not applied.

A One-Click update doesn't use the configurations of update tasks. It checks for all available updates in the repository and applies any patch or Service Pack found for each listed product. One-Click updates occur automatically at the end of any software installation completed using the McAfee Agent Deployment task, or when selecting Update Now from the VSE or McAfee Agent system tray icon. The One-Click update that occurs at the end of a product installation is not a configurable option, and execute.

Solution

Use the following information to ensure that a McAfee product patch or Service Pack is not automatically distributed to client systems:

Use an alternate repository branch
Check the patch or Service Pack into a branch other than Current in ePO. By default, the McAfee Agent policy is configured to access updates from the Current branch. Checking the package into the Evaluation or Previous branch until it is ready to be deployed to the environment is the preferred method. The One-Click update that occurs at the end of the McAFee product installation cannot be configured or disabled. If you are deploying products through ePO, the only way to prevent unintended updates to patches or service packs is to use an alternate branch that is not configured to be accessible through policy. For information about configuring this feature, see the "Repository branches and their purposes" section in the respective ePolicy Orchestrator Product Guide.

For product documents, go to the Product Documentation portal.

Disable Global Updating
Global Updating triggers a One-Click update. See the Cause section of this article for a detailed explanation of One-Click update.

Log on to the ePO console.
Click Menu, Configuration, Server Settings.
In the Setting Categories section, click Global Updating.
In the lower-right section of the page, click Edit.
In the Status section, select Disabled.
Click Save.

NOTES:
- When viewing Global Updating after this procedure is performed, you see a status of Disabled.
- If you deploy any products using the deployment task, a One-Click update occurs. Which causes all products to be updated, including any updates that are checked in to the repository.

Disable Selective Updating for VSE
Selective Updating instructs the Agent to apply or ignore updates and service packs for a specific product when running an Update task.

Log on to the ePO console.
With System Tree selected, click the Assigned Client Tasks tab.
Select the relevant update task.
In the Patches and Service Packs section, deselect VirusScan Enterprise 8.8.0 and click Save.

Ensure that the client systems do not have any local update tasks enabled with the default settings
The option Get other available updates (service packs, upgrades) is enabled by default on any local update task. With this option enabled, any VSE Patch or Service Pack that has been checked in to the repository is applied.

Log on to the ePO console.
With System Tree selected, click Assigned Policies.
Select VirusScan Enterprise 8.8.0 from the drop-down list.
Open General Options Policies.
On the Display Options tab, click Disable default AutoUpdate task schedule and click Save.

NOTES:
- By default, this option only applies to workstations affected by this policy. If you also want to disable this task schedule on servers, you must use the drop-down list to select Servers and repeat the previous steps.
- This option only disables the default AutoUpdate task that is part of a VSE default installation. Any AutoUpdate tasks created locally by the user is not disabled and can still apply updates or service packs. This option needs to be set for any servers that have VSE installed, because workstation is set by default for the VSE policy.
Send an Agent Wakeup Call to all client systems at the Site level.

Disable the ePO Agent Icon in the system tray
The Update Now option, available by right-clicking the ePO Agent icon, triggers a One-Click update.

Log on to the ePO console.
Select System Tree, and then click the Assigned Policies tab.
Select McAfee Agent from the drop-down list.
Open General.
On the General tab, deselect Show the McAfee system tray icon (Windows only) and click Save.
Send an Agent Wakeup Call to all client systems at the Site level.

Set VSE System Tray Icon to display minimal options
The Update Now option, available by right-clicking the VSE System Tray icon, triggers an update to occur based on the default local AutoUpdate task settings.

Log on to the ePO console.
Select System Tree, and then click the Assigned Policies tab.
Select VirusScan Enterprise 8.8.0 from the drop-down list.
Open General Options Policies.
On the Display Options tab, select Show the system tray icon with minimal menu options and click Save.

IMPORTANT: Make the above change for both servers and workstations.
Send an Agent Wakeup Call to all client systems at the Site level.

Affected Products

Languages:

This article is available in the following languages:

Knowledge Center

ePolicy Orchestrator prematurely deploys a McAfee product software patch or update

Environment

Problem

Cause

Solution

Affected Products

Languages:

Title

Title

Knowledge Center

ePolicy Orchestrator prematurely deploys a McAfee product software patch or update

Environment

Problem

Cause

Solution

Affected Products

Languages:

Choose your region

Title

Title