McAfee as publish a new version of McAfee Data loss prevention(DLP) / HDLP / Device Control number 9.4,

- This version is not supported any convert / migration policies from older version - If you have a complex set of rule wait for the next version 9.4.1, it will have a migration procedure.
if you still want to upgrade to the 9.4 version, all policies will need to be configure manually.


- This version is not supported for Windows XP - So if you still using WinXP you will need to use both version(9.3.x & 9.4) on the same ePO(supported).

McAfee DLP 9.4.1 will include a migration procedure to policies.

​

McAfee Drive Encryption (MDE) 7.1.x
McAfee Endpoint Encryption for PC (EEPC) 7.0.x

Problem:

- Failed to export key from ePO
- Failed to login to encrypted system
- Invalid user - 0xEE17000d
- User is Disabled
- Forgot the password
- Forgot the user
- failed to find key in ePO

Your wish is to boot to the operation system or to decrypte the system

Solution:

-Boot the system from McAfee recovery disk

- Click on authorize and write the daily code
- The click on Disk Information

- Copy the Key Check

- Now go to the ePO server
- Go to system tree and choose the locked system
​- Click Action

- Click Drive Encryption - > ​Export Recovery Information based on Disk Kecheck

- Write the Keycheck you copy from the system
- Check the box "Search old keys also"
​- Click OK
​- Download the xml file to a CD/DVD/DiskOnKey
- Go to the locked system
- Enable USB if necessary
- Click File and choose the xml you downloaded from ePO Server

If you want just to boot into Windows - Click Emergency BOOT

If you want to decrypt and remove the encryption - Click Remove DE

​GOOD LUCK!!! 

When collecting logs for McAfee support with the MER tool in some cases you don't want to reveal you IP address, system name, domain, etc.

There is away to hide this information.

Open the MER tool

Choose the language
Choose I Accept...
Hold the keys "Ctrl" and "Z" together(Ctrl+Z), while holding click on Next

On the bottom screen you can choose the option "Remove IP addresses, MAC addresses, Doamin names and computer names from WebMER result file."

also you can use the "Configure button" for more option

​Tick the checkbox to Remove IP addresses, MAC addresses, Domain names etc, you will see a button right next to this named "configure".
Click on this button and enter the actual IP, Domain name or Computer name you wish to mask as:

192.168.1.16 and select "Match all or part" from the drop down menu.

In the MER analyse this IP will be masked as %%%%%%.

Some of McAfee End point products has a built-in self-protect defend against remove/uninstall.

I believe that the most important product McAfee Agent has not enough protection.

This Post will explain how to hide McAfee Agent product from windows uninstall list (add/remove programs) so endpoint user can't see it and uninstall it manually, I will also explain which command can uninstall it manually without ePO.

Hide McAfee Agent 5.x from uninstall list

64bit and 32bit versions: Windows 7, windows 8.1, windows 2003, windows 2008/r2 and windows 2012

Open the registry – click start -> regedit

Go to: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{8959B1FD-DB2B-438D-93EE-1BAAC7145F69}

1. Right click on some blank space in the right column.

2. Select New from the context menu,

3. Select DWORD value.

4. Name it SystemComponent.

5. Right-click and select Modify.

6. Change the value data to 1, and click OK.

7. the change will be activate after a reboot

Your program will now be hidden in the Add or Remove Programs list. If you ever want this program to reappear, just delete the SystemComponent DWORD.

Uninstall Manually:

If there is no other McAfee product except McAfee Agent, from command line or run windows:

MsiExec.exe /X{8959B1FD-DB2B-438D-93EE-1BAAC7145F69}

To force uninstall no matter which product of McAfee endpoint install, from command line or run windows:

"%programfiles%\McAfee\Agent\x86\FrmInst.exe" /forceuninstall

Hide McAfee Agent 4.8 Patch 2(4.8.0.1500) from uninstall list

64bit versions like: Windows 7, windows 8.1, windows 2003, windows 2008/r2 and windows 2012

Open the registry – click start -> regedit

Go to: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{EBF3D65F-011E-44D2-8F4F-C74B52682EDD}

For 32bit Version, go to:  

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{EBF3D65F-011E-44D2-8F4F-C74B52682EDD}

Note: each McAfee Agent Version has different GUID Key see List at the end

1. Right click on some blank space in the right column.

2. Select New from the context menu,

3. Select DWORD value.

4. Name it SystemComponent.

5. Right-click and select Modify.

6. Change the value data to 1, and click OK.

7. the change will be activate after a reboot

Your program will now be hidden in the Add or Remove Programs list. If you ever want this program to reappear, just delete the SystemComponent DWORD.

Uninstall Manually:

If there is no other McAfee product except McAfee Agent, from command line or run windows:

MsiExec.exe /X{EBF3D65F-011E-44D2-8F4F-C74B52682EDD}

To force uninstall no matter which product of McAfee endpoint install, from command line or run windows:

"%programfiles%\McAfee\Common Framework\FrmInst.exe" /forceuninstall

List of McAfee Agent Version and Key:

MA 4.8 Patch 2

4.8.0.1500

{EBF3D65F-011E-44D2-8F4F-C74B52682EDD}

MA 4.8 Patch 1

4.8.0.887

{1FDB8EC6-BAF1-42F9-8E09-4D9AB369F1B5}

MA 4.8

4.8.0.641

{11FEE8E5-D9BD-4AC1-8074-5169069DF812}

MA 4.6 Patch 3

4.6.0.3122

{4AEFF024-F0D0-4AD6-8231-FF51949E91E0}

MA 4.6 Patch 2

4.6.0.2935

{1995804A-B1A2-4826-99DD-CEA1352D090B}

MA 4.6 Patch 1

4.6.0.2292

{DE91C193-2611-4BD3-A9F9-DF589C572565}

MA 4.6

4.6.0.1694

{5DBE95F6-823A-4547-9921-CEDFADA1D2D8}

MA 4.5 Patch 3

4.5.0.1852

{397F4DE2-3C5A-415C-9A36-1D8C2B30B92D}

MA 4.5 Patch 2

4.5.0.1810

{2AAB21C2-4CDA-4189-A0EC-5ED666113F84}

MA 4.5 HF620018

4.5.0.1719

{B4496BE1-295F-4A17-9856-FEA2C9AA1A47}

MA 4.5 Patch 1

4.5.0.1499

{5C1FBBAF-14C8-4A23-A4A7-BCF19A979890}

MA 4.5 HF542703

4.5.0.1429

{362678B4-6ED5-46E9-A6B2-53EF22159151}

MA 4.5

4.5.0.1270

{B639A4DE-A375-47D3-89C3-DDCF98D992F7}

Hide McAfee Virus Scan for Enterprise 8.8.4 from uninstall list

64bit versions like: Windows 7, windows 8.1, windows 2003, windows 2008/r2 and windows 2012

Open the registry – click start -> regedit

Go to: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{CE15D1B6-19B6-4D4D-8F43-CF5D2C3356FF}

For 32bit Version, go to:  

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{CE15D1B6-19B6-4D4D-8F43-CF5D2C3356FF}

1. Right click on some blank space in the right column.

2. Select New from the context menu,

3. Select DWORD value.

4. Name it SystemComponent.

5. Right-click and select Modify.

6. Change the value data to 1, and click OK.

7. the change will be activate after a reboot

Your program will now be hidden in the Add or Remove Programs list. If you ever want this program to reappear, just delete the SystemComponent DWORD.

Uninstall manually, from command line or run windows:

MsiExec.exe /X{CE15D1B6-19B6-4D4D-8F43-CF5D2C3356FF}

Use the Tag option to do a test a new product or a new version.

Creat a new tag name for example "HIPS" with no criteria.
Apply the Tag HIPS on 4-5 systems around your organiztion.
Create a deployment task who will apply only on system with HIPS tag.
Run the task and check the product on your environment.

The testing is over?

Just remove from the task the tag and the deployment will run on all your systems.

Don't forget to delete the Tag.