McAfee VirusScan Ent. 8.5i will not update definitions

Ouch..... That is a lot of machines to enter permissions for (100+ servers ). Ill give that a shot.

In AD create a group and include the server in the group then set the permission for the group.

sorry typo

servers

b_haynes,

Unfortunately there is not a domain. This is one very large workgroup :(

On the share you may need to explicitly give permissions for each of the servers that will connect to it. You should not have to change anything on each server.

The server is not accepting the remote server when i try and add permissions (either share or NTFS permissions). When entering either <comuptername> or user@<computername> in the "Select user or group" box. I also am unable to choose anything but the local server in the locations section. My Network Places shows all servers though.

"When you say you are pointing to a central repository" Is this
WSUS? If not maybe this is the way to go. If so you might find setting up a scheduled task on each server to update a work around.

"When you say you are pointing to a central repository" Is this
WSUS? If not maybe this is the way to go. If so you might find setting up a scheduled task on each server to update a work around"

No, McAfee has a built in auto-updater you can configure to point to a share on another server. This is how I am setup. Basically the central repository is just a folder on one of the servers that I have share permissions on for everyone.

So to quote myself from my original post:

"I have tested to make sure the share is accessible from each server and I can also run a manual update against the repository without issues from every server.

These servers are not in a domain. Security and Sharing of the repository is setup for "everyone" with read, write and execute permissions."

Let's go back to the OSI layers and step thru the connectivity path.
Double checking: Primarily Layers 1 - 4 . . .

Layer 1: Physical Layer
Layer 2: Data Link Layer 3.6.1 WAN Protocol architecture
IEEE 802 LAN architecture
Layer 3: Network Layer
Layer 4: Transport Layer
Layer 5: Session Layer
Layer 6: Presentation Layer
Layer 7: Application Layer


 

Also double check: "8/2/2009 3:58:20 PM NT AUTHORITY\SYSTEM Failed to connect to server <servername>. Check the agent log for more details.
8/2/2009 3:58:20 PM NT AUTHORITY\SYSTEM Error occurred while downloading file SiteStat.xml.
8/2/2009 3:58:20 PM NT AUTHORITY\SYSTEM Unable to find a valid repository.
Are there possible typos in the server name / path...

Communication from all servers back to the repo server is solid. As I said before I can browse the server (\\servername\sharename) and move files back and forth just fine from any of the boxes.

"Are there possible typos in the server name / path"
Good question, This is one of the first things I tried but it all is good. I actually copied the path from the config box and pasted it into Run and the repo's share pulled right up.

So the thing that gets me, is I can run the update manually aginst the repo with no problems, but I am logged in when this is going on. The auto update runs when no one is logged in. Im wondering if there is a authentication issue between the two servers. Since this is not a domain im wondering if the server is trying to use local login cradentals (server1\administrator) instead of the repos required cradentals (repo1\administrator). Since repo is not part of a domain it will not let me add security or share permissions for other computers just the local one.

What are your thoughts on this.

I think you are on track with the [server1\administrator] vs [repo1\administrator]. Is there an option to use "runas" in the scheduled task?

Here is a screen shot of each of the locations within McAfee were i can set login info for auto update and the repository that server uses.

The Schedule settings screen if for auto update in general. Filling in the username (administrator) and a password does not resolve the issue. Im not sure how I would put a workgroup in this screen along with user/pw.

The repository settings screen is for setting options for the repo that server looks to for updates. If "use logged-in account" is unchecked then a domain is required to be entered. I am also unsure of how to enter a workgroup in this screen as well.

This is were my Windows experiance has gotten weak. How would I specify a workgroup in these fields.

Thanks

Workgroup vs Domain . . . here is were I must get off the train.
I have not set up Workgroups for business production environments  which may be the source of your issue. Workgroups may not be the best strategy for you. Two options come to light. 1. Set up a Domain. 2. Post this question in other areas of EE with a reference to the narrative we have had.

yeah a domain is hopefully a long term solution but it is going to take a while. I was hoping for something I could implement for the time being.

Longer picture is a domain with McAfee ePO to centrally manage AV.

Any suggestions on zones that would be better. I thought i picked the best for this question.

I would post this in the Networking and ITPro zones. I would repost it in this zone as well (with our dialog many experts would be led to believe the issue is complex {which it is} and not realize we have not
fully resolved the issue. They may have a work around or another
take on this.

I had a similar problem with McAfee 4.x many many moons ago.  The solution back then was to make the shares where the clients pick up their dats from 'null session'.  After doing this the clients would update correctly.

Some info for doing this in Win2k can be found here: http://support.microsoft.com/kb/289655

I'm not sure if this stuff is still relevant in 2k3 or 2k8 or the security implications of doing this in the newer OS's but I'm sure there will be some arcticles kicking about somewhere.

RE "Here is a screen shot of each of the locations within McAfee were i can set login info for auto update and the repository that server uses.

The Schedule settings screen if for auto update in general. Filling in the username (administrator) and a password does not resolve the issue. Im not sure how I would put a workgroup in this screen along with user/pw.

The repository settings screen is for setting options for the repo that server looks to for updates. If "use logged-in account" is unchecked then a domain is required to be entered. I am also unsure of how to enter a workgroup in this screen as well.

This is were my Windows experiance has gotten weak. How would I specify a workgroup in these fields. "



The domain name in this case is the netbios computer name of the server that is serving the shares.  You could try putting that in the User account settings:

User: administrator
Domain: server computername
Pass: password

MPTSupport:

I gave that computer name  in the domain box a shot but still nothing. I will check out the KB.

thanks for the feedback

Sorry it took so long to get back to this, other issues have had priority.

I tried the Null session as suggested and still nothing. It looks like null sessions are still relevant in 2k3

having read through the post, it is really clear that you need to setup and manage a domain, and nominate one server as the domain controller.

however, given the task in hand, i do not believe it is a permissions issue with the folder (having the Everyone group set right helps), as you say you can manually run the update.  have you checked the SiteList.xml file, as this is where we list our master repository, and also the fall-back if the server is off-line, or if user is off-site (defaults to McAfee's own update website).  So if your update fails, they can connect to the McAfee site to get the update.

you might also want to check the McAfee Framework Service and Task Manager services and their service account permissions, as i'm certain these services control the scheduler and update routines.  you normally run 3 services on each box, Framework, McShield and Task Manager.

normally your servers would be logged in using a domain admin account, in this case you could try having the local admin account set with the same pwd, and make sure on the schedule config page from your screenshot, you put in the username line -- WORKGROUPname\Username, leave domain line blank and then add your pwd.  It might work, and then again it might not, as the software is not really designed for workgroups, but worth a try.

"So if your update fails, they can connect to the McAfee site to get the update."

this is not an option (i wish it was) due to these servers being isolated from the internet.

Looking at the services you mentioned they all use the local system account for the service. I tried changing the login account to the admin account that all servers share but the service will not let me change it. I am also unable to stop the service to edit it. Do you know how I can do this?

Thanks

when the application is installed, you normally get the option, to disable stopping of services, this is likely as to what has happened, so until you Change/Remove the software, you will not be able to do anything with the services - its a built-in defence guard.