McAfee Agent upgrade fails when an Access Protection rule blocks frminst.exe

Technical Articles ID: KB94954
Last Modified: 2021-10-05 17:00:00 Etc/GMT

Environment

McAfee Agent (MA) 5.x

Problem

When you try to upgrade to a later version of MA, it fails.

Log errors show that an ENS Access Protection rule blocks the frminst.exe from being executed. You see this issue when you execute the installer from the common user folders.

The errors below are recorded in the McScript_Deploy.log file:
(C:\ProgramData\McAfee\Agent\logs)

I #7288 ScrptExe Running "C:\ProgramData\McAfee\Agent\\Evaluation\EPOAGENT3000\Install\0409\FramePkg.exe" /UseLanguage=0409 /Install=Agent /Silent /IsFromEPO

I #7288 ScrptExe Did not match searched path

I #7288 ScrptExe Executing "C:\ProgramData\McAfee\Agent\\Evaluation\EPOAGENT3000\Install\0409\FramePkg.exe" /UseLanguage=0409 /Install=Agent /Silent /IsFromEPO

I #7288 ScrptExe Using Aac exclusion path C:\ProgramData\McAfee\Agent\\Evaluation\EPOAGENT3000\Install\0409\FramePkg.exe

I #7288 ScrptExe Attempting to run OnExit section on current script

I #7288 ScrptExe Executing section: [OnExit]

I #7288 ScrptExe Executing section: [ZeroPostponesDoneCount]

I #7288 ScrptMain Run script return code: 33

I #7288 ScrptMain McAfee Update Engine is exiting with return code: 1

I #7288 MueEep Invoking events withEventId " 0" Severity " 0" Productid " EPOAGENT3000" Locale " 0409" UpdateType " N/A" UpdateError " 0" iUpdateState " 1" New Version " N/A" Date Time " N/A" Script Id" 15372" Custom Message " "

I #7288 MueEep Updating session state to 1

I #7288 MueEep Updating final session state to 1

I #7288 MueEep Invoking EndUpdateDialog withTitle " Update Finished" Message " Please check the update log for more details." CountdownMessage " " CountdownValue" 0"

I #7288 SessMgr Final session state is 1

I #7288 mue Updater session state = <1>, Update session result = "SUCCESS".

The errors below are recorded in the AccessProtection_Activity.log file:
(C:\ProgramData\McAfee\Endpoint Security\Logs)

006Z |Activity|ApBl |mfeesp | 2304| 4876|AP |XModuleEvents.cpp(851) | NT AUTHORITY\SYSTEM ran C:\ProgramData\McAfee\Agent\Evaluation\EPOAGENT3000\Install\0409\FramePkg.exe, which tried to access the file C:\Temp\mfe1748B10A-4FE1-48A5-A913-8A8588C64752.tmp\FrmInst.exe, violating the rule "Running files from common user folders", and was blocked.

Cause

The Endpoint Security (ENS) Threat Prevention component Access Protection rule blocks frminst.exe from being executed.

By default, the rule Running files from common user folders is not selected for reporting and blocking.

Solution

Disable the Access Protection rule, Running files from common user folders, and apply the updated policy:

Disable the rule Running files from common user folders:
1. Log on to the ePO console.
2. Open the Policy catalog.
3. In the left pane, select the product: Endpoint Security Threat Prevention.
4. Select Access Protection, duplicate the policy, and give it a name.
5. Edit the new policy, and click Show Advanced.
6. Under RULES, deselect the rule Running files from common user folders.
7. Save the policy.
Apply the updated policy:
1. Open the system tree.
2. Search for the problem system.
3. Click Actions, Agent, Edit policies on single system.
4. From the Product drop down list, select Endpoint Security Threat Prevention.
5. Click Category, Access protection.
6. Under Actions, click Edit assignment.
7. Click Inherit From, and select the option Break inheritance,
8. Assign the Policy.
9. Save the policy
10. To apply the policy update to client, send a wakeup call, or perform ASCI.

Knowledge Center

McAfee Agent upgrade fails when an Access Protection rule blocks frminst.exe

Environment

Problem

Cause

Solution

Related Information

Affected Products

Languages:

Title

Title

Knowledge Center

McAfee Agent upgrade fails when an Access Protection rule blocks frminst.exe

Environment

Problem

Cause

Solution

Related Information

Affected Products

Languages:

Choose your region

Title

Title