Missing product properties in the ePO console or failure to apply policies

Technical Articles ID: KB94666
Last Modified: 2023-07-07 12:19:57 Etc/GMT

Environment

Endpoint Security (ENS) Threat Prevention 10.x

Problem

This problem can affect several products that are installed on any given endpoint. There can be several symptoms, for example:

Product properties are reported incorrectly or are missing (unknown) back to the ePolicy Orchestrator (ePO) server.
Policies might not get applied for some managed nodes.
The local ENS console might not load correctly and displays errors such as "error loading settings."
The DAT (AMCore) versions might not update and computers might remain on an outdated DAT version.

The McAfee Agent logs and the product-specific logs record some failure. Here are some examples of log snippets for the failure of McAfee Agent communicating with Data Exchange Layer and ENS:

From the macompatsvc_<system name>.log:

<time and date> macompatsvc(2888.4868) LpcConnMgr.Info: Processing health check request
<time and date> macompatsvc(2888.4340) cmasvc.Info: Application DXL_____1000 is installed.
<time and date> macompatsvc(2888.4340) cmasvc.Error: Insufficient information about the application DXL_____1000.
<time and date> macompatsvc(2888.4340) cmasvc.Error: Manageability client creation failed for the application DXL_____1000.
...
<time and date> macompatsvc(2888.4340) cmasvc.Info: Application ENDP_AM_1070 is installed.
<time and date> macompatsvc(2888.4868) LpcConnMgr.Info: Processing health check request
<time and date> macompatsvc(2888.4340) cmasvc.Error: Insufficient information about the application ENDP_AM_1070.
<time and date> macompatsvc(2888.4340) cmasvc.Error: Manageability client creation failed for the application ENDP_AM_1070.

In addition, the EndpointSecurityPlatform_Errors.log might record errors similar to this one:

<time and date> |Error |McTray |McTray 8692| 8936|McTrayUPC dllmain.cpp(555) Endpoint Security Platform is not running!
<time and date> |Error |McTray |McTray 8692| 8936|McTrayUPC dllmain.cpp(514) SubscribeToBoAvailableEvent failed: boName: COMBO, error: 80000100
<time and date> |Error |McTray |McTray 8692| 8936|McTrayUPC TechnologyTopicHandler.cpp(152) | CheckTechnologyState failed to get technology status from BO: AMSI
<time and date> |Error |McTray |McTray 8692| 8936|McTrayUPC TechnologyTopicHandler.cpp(217) | AMSI is not responding.
<time and date> |Error |McTray |McTray 8692| 8936|McTrayUPC TechnologyTopicHandler.cpp(152) | CheckTechnologyState failed to get technology status from BO: ATP

Key components of ENS can report a failure to run/start for the same reason. Time stamps recorded should correlate.

System Change

The update of root certificates has been disabled or is impeded in some other way. For example, there's no internet connectivity or due to Group Policy Object settings.

Cause

Because of the missing root certificates, the integrity of communication channels between McAfee Agent (which collects properties from managed products) and ENS can't be verified. So, these interprocess communications might fail, leading to the symptoms described in this article.

Solution

Update the root certificates on the affected systems per the guidance provided in the following articles:

KB87096 - Product install or upgrade issues due to missing root certificates
KB92937 - Secondary root certificate for TLS might need to be updated

Furthermore, you can try to remove/disable the following registry keys:

CAUTION: This article contains information about opening or modifying the registry.

The following information is intended for System Administrators. Registry modifications are irreversible and could cause system failure if done incorrectly.
Before proceeding, Technical Support strongly recommends that you back up your registry and understand the restore process. For more information, see the Microsoft Windows registry information for advanced users article.
Do not run a REG file that is not confirmed to be a genuine registry import file.

Remove/disable the following registry keys:

HKLM\SOFTWARE\Policies\Microsoft\SystemCertificates\AuthRoot\DisableRootAutoUpdate
HKLM\SOFTWARE\Policies\Microsoft\SystemCertificates\Root\ProtectedRoots
Restart the systems.
Send a wakeup call with full properties to the affected systems.

Affected Products

Languages:

This article is available in the following languages:

Knowledge Center

Missing product properties in the ePO console or failure to apply policies

Environment

Problem

System Change

Cause

Solution

Affected Products

Languages:

Title

Title

Knowledge Center

Missing product properties in the ePO console or failure to apply policies

Environment

Problem

System Change

Cause

Solution

Affected Products

Languages:

Choose your region

Title

Title