Updates aren't supported on this platform: EXTRADAT1000

Technical Articles ID: KB92996
Last Modified: 2022-04-20 06:41:28 Etc/GMT

Environment

Endpoint Security (ENS) Threat Prevention 10.x
ePolicy Orchestrator (ePO) 5.x

Summary

McAfee Agent (MA) verifies whether the updates included in an ePO update or deployment task are suitable for the managed ePO client. If MA determines that the operating system isn't suitable for an update, it doesn't apply the update. So, the task might fail. This check occurs for most client tasks initiated from ePO to prevent unsuitable updates from being installed on managed ePO clients.

Problem

In the following scenarios, the rollout of an Extra.DAT can fail because the scripts that drive the update process for Extra.DAT files are missing or outdated:

Air-gapped environments, where content is checked in manually to the ePO repository.
VirusScan Enterprise (VSE) isn't deployed or managed, so no VSE-related update content is pulled into the ePO repository. The scripts are delivered as part of the update content for VSE (v2 DATs).

The McScript.log records lines similar to the following if MA is set to debug logging. For instructions to enable debug logging, see KB82170 - How to enable debug logging for McAfee Agent to troubleshoot Windows.

<time and date>   I   #8716   ScrptMain   START [C:\Program Files\McAfee\Agent\x86\McScript_InUse.exe -script C:\ProgramData\McAfee\Agent\update\UpdateMain.McS -id 13462 -localeid 0409 -logfile C:\ProgramData\McAfee\Agent\logs\McScript -parent FRAMEWORK -initiator 1 -installdir C:\Program Files\McAfee\Agent\\x86\ -taskid 1106]
...
<time and date>   I   #8716   ScrptMgr   These updates will be applied if they are in the repository: EXTRADAT1000.
...

NOTE: Lines that contain X are only logged with active debug logging for McScript.

<time and date>   X   #8716   ScrptExe   Line 11: GetOsInfo szOSType = ALL
<time and date>   X   #8716   ScrptExe   Got the os info requested. Setting szOSType to WINXW:10:0:0
...
<time and date>   X   #8716   ScrptUtl   Found szPlatformID in the global symbol table.
<time and date>   X   #8716   ScrptExe   Line 552: XmlGetItem szPlatformID = PlatformID, , ELEMENT, 3346915045, ProductPackage25\ProductDetection2,
<time and date>   X   #8716   ScrptExe   Got the value of PlatformID. Setting szPlatformID to MAC|LINUX|SCM|WIN95|WIN98|WINME|WNTW|WNTS|W2KW|W2KS|WXPHE|WXPW|WXPS|WVST|WVSTS|WNT7W
<time and date>   X   #8716   ScrptExe   ReturnIf
<time and date>   X   #8716   ScrptExe   Line 553: ReturnIf FALSE, FALSE
<time and date>   X   #8716   ScrptExe   IsPlatformMatch
<time and date>   X   #8716   ScrptUtl   bRet not in the local symbol table. Searching the global symbol table...
<time and date>   X   #8716   ScrptUtl   Found bRet in the global symbol table.
<time and date>   X   #8716   ScrptExe   Line 554: IsPlatformMatch bRet = WINXW:10:0:0, MAC|LINUX|SCM|WIN95|WIN98|WINME|WNTW|WNTS|W2KW|W2KS|WXPHE|WXPW|WXPS|WVST|WVSTS|WNT7W
<time and date>   X   #8716   ScrptExe   Platform match failed. Setting bRet to FALSE
...

NOTE: At this point, McScript tries to match the platform identified to the list of available platforms delivered for the Extra.DAT. Because there's no match, the update process fails.

<time and date>   X   #8716   ScrptExe   Line 1378: ReportStatus Updates were not applied because the updates are not supported on this platform: EXTRADAT1000.
<time and date>   X   #8716   ScrptExe   Updates were not applied because the updates are not supported on this platform: EXTRADAT1000.
...
<time and date>   I   #8716   MueEep   Invoking EndUpdateDialog withTitle " Update Failed" Message " Please check the update log for more details." CountdownMessage "   " CountdownValue" 0"
<time and date>   I   #8716   SessMgr   Final session state is 2
<time and date>   I   #8716   mue   Updater session state = <2>, Update session result = "FAILED".

NOTE: The Extra.DAT is the only update configured by this client task, so the whole task ends with a result of "FAILED." If there are other updates configured in an update task, the updates might be applied successfully. Only the Extra.DAT part of the update task fails.

System Change

ePO operates in an air-gapped environment where content is checked in manually. Or, the ePO repository pull task is configured to not pull v2 DAT content.

Cause

The update scripts that drive the update process for Extra.DAT files are missing or outdated.

Solution

This issue is resolved in April 2022 AMCore content.

When the AMCore content is in place, for ePO environments that are connected to the internet, configure ePO repository pull tasks individually to include or not include DAT content:

Log on to the ePO console.
Navigate to Server Tasks.
Select the pull task that needs to be changed.
Edit the pull task, and in step 2 (Actions), select DAT in addition to any other packages already selected.
Save the changes. The changes are immediately committed and take effect on the next run of the task.

Workaround 1

For air-gapped environments that still require only V2 DATs, you can update the script file manually:

Download DAT Package For Use with ePO (avvepoxxxxdat.zip) under Download V2 Virus Definition Updates (DATs), from the Security Updates page.
Check in avvepoxxxxdat.zip to the ePO Master Repository. This action updates the extraDATplatforms value in the following registry key:

HKEY_LOCAL_MACHINE\Software\Wow6432node\Network Associates\ePolicy Orchestrator\Site Manager\

"ExtraDATPlatforms"="MAC|LINUX|SCM|MLOS|WIN95|WIN98|WINME|WNTW|WNTS|W2KW|W2KS|W2KAS|W2KDC|WXPHE|WXPW|WXPS|WVST|WVSTS|WNT7W|WXPE|WIN8W|WIN8S|WINXW|WINXS"
Download an up-to-date copy of the script file extradat.mcs from the official Common Updater HTTPS repository.
Transfer the script file to the air-gapped ePO server and place it in C:\Program Files (x86)\McAfee\ePolicy Orchestrator\DB. Overwrite any existing files.
Check in the Extra.DAT to the ePO Master Repository.
Deploy the Extra.DAT as usual with a client update task.

Workaround 2

For air-gapped environments, you can update the script file manually. From the Security Updates page, under V3 Virus Definition Updates (DATs), download either the DAT Package For Use with ePO or the V3_4773dat.exe for local installation.

Affected Products

Languages:

This article is available in the following languages:

Knowledge Center