McAfee EPO Agent Deployment Logs

When McAfee EPO fails to push an agent out, the only information you get is that the task "Failed". This isn’t really useful at all of course. Thus the trick is to go on your EPO server in %ProgramFiles%\McAfee\ePolicy Orchestrator\db\Logs and open server.log. Scroll to the bottom (or monitor the file with something like tail) and find your server name and you’ll likely find something a lot more useful.

The general premise of how it seems to deploy agents is that it attempts to connect to \\TargetServer\Admin$ and drop the FramePkg file there. If this connection isn’t working for whatever reason (e.g. firewalls, credentials, etc), the agent install won’t work. A quick way to test it is to paste the path in the log into the Run box on the EPO server and see if you can browse the share (ADMIN$ is always %Windir%).

Leave a Reply

Your email address will not be published. Required fields are marked *