Endpoint Security Platform isn't running

Technical Articles ID: KB88029
Last Modified: 2022-06-17 09:53:53 Etc/GMT

Environment

Endpoint Security (ENS) 10.x

Problem

The McAfee icon in the notification area displays in gray with a red exclamation point. When reviewing the Security Status screen, the following error displays:

Endpoint Security Platform is not running!

Cause

There can be multiple causes for this error. Usually, this error is a direct indicator of a third-party injection into our code.

Solution

To determine the cause of the issue, perform the following steps:

Collect the following data:
- Process Monitor capture
- AMTrace with the now option
- Minimum Escalation Requirements (MER) file (run as Administrator)
- Copy of the assigned ENS Common Options Policy
For instructions on how to collect the appropriate data, see KB86691 - Minimum data collection steps for Endpoint Security issues.
View the EndpointSecurityPlatform_Errors.log in the log folder (default is %deflogdir%) to determine what issue is occurring. After you open the log, press Ctrl+F and search for injectionmgr. If you find this entry within the log, you have most likely found the issue.
- If you see this entry, perform the following steps. These steps determine the certificate that's causing the issue.
  1. Find the certificates listed within the EndpointSecurityPlatform_Errors.log.
  2. Open the policy in ePolicy Orchestrator (ePO), click Show Advanced, and then view the Certificates section.
  3. Locate the certificates that you found in the EndpointSecurityPlatform_Errors.log. One at a time, select the Allow checkbox, enforce policies on the client, and check whether the issue is resolved.
    
    NOTE: We recommend that you allow only trusted applications that are needed for the product to function correctly. Allowing a vendor to run code within our processes might result in compatibility issues and reduced security.
- If you do not see this entry, perform the following steps. These steps determine any non-McAfee or non-Microsoft DLLs that are causing the issue.
  1. Open the Process Monitor capture.
  2. Press Ctrl+L.
  3. Add the filters below to look at the following processes:
    - mfeconsole.exe
    - mfecanary.exe
    - mfeesp.exe
    Process Name is mfeconsole.exe Include
    Process Name is mfecanary.exe Include
    Process name is mfeesp.exe Include
    Operation is Process Exit Include
  4. In the filtered results, right-click the first process.
  5. Click Properties.
  6. Click the Process tab.
  7. In the table below, filter by Company by clicking the Company tab.
  8. Search for any non-McAfee or non-Microsoft DLLs that might be causing the issue.
    
    NOTE: We use both icudt.dll (The ICU Project) and libcef.dll (unsigned), and they're not the cause of the issue.

Affected Products

Languages:

This article is available in the following languages:

Knowledge Center

Endpoint Security Platform isn't running

Environment

Problem

Cause

Solution

Affected Products

Languages:

Title

Title

Knowledge Center

Endpoint Security Platform isn't running

Environment

Problem

Cause

Solution

Affected Products

Languages:

Choose your region

Title

Title