Endpoint Security for Mac deployment fails with Trellix Agent
Last Modified: 2023-03-23 13:26:09 Etc/GMT
Affected Products
Languages:
This article is available in the following languages:
Trellix CEO, Bryan Palma, explains the critical need for security that’s always learning.
As per Gartner, "XDR is an emerging technology that can offer improved threat prevention, detection and response."
Trellix announced the establishment of the Trellix Advanced Research Center to advance global threat intelligence.
Trellix Advanced Research Center analyzes threat data on ransomware, nation-states, sectors, vectors, LotL, MITRE ATT&CK techniques, and emails.
As of May 14, 2024, Knowledge Base (KB) articles will only be published and updated in our new Trellix Thrive Knowledge space.
Log in to the Thrive Portal using your OKTA credentials and start searching the new space. Legacy KB IDs are indexed and you will be able to find them easily just by typing the legacy KB ID.
Endpoint Security for Mac deployment fails with Trellix Agent
Technical Articles ID:
KB94991
Last Modified: 2023-03-23 13:26:09 Etc/GMT Environment
Endpoint Security for Mac (ENSM) Threat Prevention 10.x Trellix Agent (TA) 5.x Problem
An ENSM deployment fails on macOS with Trellix Agent. The 2021-10-14 16:33:23 [3753] (140735487050624) [pm_service] [I] getting installed software list from system 2021-10-14 16:33:23 [3753] (140735487050624) [pm_service] [I] installed software id: DXL_____1000, version: 6.0.3.441 2021-10-14 16:33:23 [3753] (140735487050624) [pm_service] [I] installed software id: EPOAGENT3000, version: 5.7.4.418 2021-10-14 16:33:23 [3753] (140735487050624) [pm_service] [I] checking install order compatibility 2021-10-14 16:33:23 [3753] (140735487050624) [pm_service] [I] [2] checking install order compatibility for <ENDP_AM_1070MACX> 2021-10-14 16:33:23 [3753] (140735487050624) [pm_service] [I] getting spec entry for <ENDP_AM_1070MACX> 2021-10-14 16:33:23 [3753] (140735487050624) [pm_service] [I] Entry found in spec file with id:<MC_ENDPAM>, epoids:<ENDP_AM_.*>, name:<ENSM TP> 2021-10-14 16:33:23 [3753] (140735487050624) [pm_service] [I] step a). checking resolve obsoletes for <ENDP_AM_1070MACX>, version: 10.7.8.128 2021-10-14 16:33:23 [3753] (140735487050624) [pm_service] [I] step b). checking resolve uninstalls for <ENDP_AM_1070MACX> 2021-10-14 16:33:23 [3753] (140735487050624) [pm_service] [I] step c). checking dependency for <ENDP_AM_1070MACX> 2021-10-14 16:33:23 [3753] (140735487050624) [pm_service] [I] dependency check success for <ENDP_AM_1070MACX>, now checking compatibility. 2021-10-14 16:33:23 [3753] (140735487050624) [pm_service] [I] step d). checking compatibility for <ENDP_AM_1070MACX> 2021-10-14 16:33:23 [3753] (140735487050624) [pm_service] [I] compatibility success for <ENDP_AM_1070MACX> 2021-10-14 16:33:23 [3753] (140735487050624) [pm_service] [I] NOTE: The above compatibility check is whether the installed Trellix Agent version is compatible to deploy the managed product version. The check shows compatibility success. 2021-10-14 16:34:51 [3753] (140735487050624) [ScrptExe] [E] [Line 2056: RunScript dwRet = /var/McAfee/agent/update/Current/ENDP_AM_1070MACX/Install/0000/PkgInstallation.McS, ScriptMain]-> 2021-10-14 16:34:51 [3753] (140735487050624) [ScrptExe] [E] [Executing section ScriptMain]-> 2021-10-14 16:34:51 [3753] (140735487050624) [ScrptExe] [E] [Call]-> 2021-10-14 16:34:51 [3753] (140735487050624) [ScrptExe] [E] [Executing section RunCommand]-> 2021-10-14 16:34:51 [3753] (140735487050624) [ScrptExe] [E] [SetWorkDir]-> 2021-10-14 16:34:51 [3753] (140735487050624) [ScrptMgr] [E] Failed to set the working dir as /var/McAfee/agent/update\Current\ENDP_AM_1070MACX\Install 2021-10-14 16:34:51 [3753] (140735487050624) [ScrptExe] [I] Executing section: [SendUnsupportedMAError] 2021-10-14 16:34:51 [3753] (140735487050624) [MueEep] [I] Invoking events withEventId " 0" Severity " 4" Productid " McAfee-Threat-Prevention-for-Mac" Locale " 0409" UpdateType " Install" UpdateError " 40100" iUpdateState " 9" New Version " 10.7.8" Date Time " " Script Id" 1837811738" Custom Message " " 2021-10-14 16:34:51 [3753] (140735487050624) [MueEep] [I] Updating session state to 9 2021-10-14 16:34:51 [3753] (140735487050624) [ScrptExe] [I] Script executed. Setting dwRet to 1 2021-10-14 16:34:51 [3753] (140735487050624) [ScrptMgr] [I] Setting the working dir as /var/McAfee/agent/update 2021-10-14 16:34:51 [3753] (140735487050624) [ScrptExe] [I] Executing section: [RebootNeeded] 2021-10-14 16:34:51 [3753] (140735487050624) [ScrptExe] [I] Executing section: [CheckRebootNeededDuringInstall] 2021-10-14 16:34:51 [3753] (140735487050624) [ScrptExe] [I] Executing section: [SendFailEvent] 2021-10-14 16:34:51 [3753] (140735487050624) [ScrptMgr] [I] Error occurred while installing ENDP_AM_1070MACX. 2021-10-14 16:34:51 [3753] (140735487050624) [MueEep] [I] Invoking events withEventId " 0" Severity " 4" Productid " ENDP_AM_1070MACX" Locale " 0000" UpdateType " Install" UpdateError " -1" iUpdateState " 9" New Version " 10.7.8.128" Date Time " " Script Id" 1837811738" Custom Message " " 2021-10-14 16:34:51 [3753] (140735487050624) [MueEep] [I] Updating session state to 9 2021-10-14 16:34:51 [3753] (140735487050624) [ScrptExe] [I] Executing section: [InstallProduct] 2021-10-14 16:34:51 [3753] (140735487050624) [ScrptMgr] [I] Update Finished NOTE: The number 9 for updating indicates failure. Cause
The ENSM version that you’re trying to deploy isn't compatible with the macOS version running on the system. This issue is indicated with the error Solution
Check whether the ENSM version supports the macOS version. See KB84934 - Supported platforms for Endpoint Security for Mac. Example scenario: macOS: High Sierra 10.13.6 ENSM: 10.7.8.128 McAfee Agent: 5.7.4.418 The supported platforms article states that macOS High Sierra 10.13.x is supported with ENSM 10.5.0 to 10.6.4. If you try to deploy ENSM 10.7.x with this macOS version, it fails with the error Affected ProductsLanguages:This article is available in the following languages: |
|