Product Guide. McAfee Endpoint Upgrade Assistant 1.4.0

Transcription

1 Product Guide McAfee Endpoint Upgrade Assistant 1.4.0

2 COPYRIGHT Copyright 2017 McAfee, LLC TRADEMARK ATTRIBUTIONS McAfee and the McAfee logo, McAfee Active Protection, epolicy Orchestrator, McAfee epo, McAfee EMM, Foundstone, McAfee LiveSafe, McAfee QuickClean, Safe Eyes, McAfee SECURE, SecureOS, McAfee Shredder, SiteAdvisor, McAfee Stinger, True Key, TrustedSource, VirusScan are trademarks or registered trademarks of McAfee, LLC or its subsidiaries in the US and other countries. Other marks and brands may be claimed as the property of others. LICENSE INFORMATION License Agreement NOTICE TO ALL USERS: CAREFULLY READ THE APPROPRIATE LEGAL AGREEMENT CORRESPONDING TO THE LICENSE YOU PURCHASED, WHICH SETS FORTH THE GENERAL TERMS AND CONDITIONS FOR THE USE OF THE LICENSED SOFTWARE. IF YOU DO NOT KNOW WHICH TYPE OF LICENSE YOU HAVE ACQUIRED, PLEASE CONSULT THE SALES AND OTHER RELATED LICENSE GRANT OR PURCHASE ORDER DOCUMENTS THAT ACCOMPANY YOUR SOFTWARE PACKAGING OR THAT YOU HAVE RECEIVED SEPARATELY AS PART OF THE PURCHASE (AS A BOOKLET, A FILE ON THE PRODUCT CD, OR A FILE AVAILABLE ON THE WEBSITE FROM WHICH YOU DOWNLOADED THE SOFTWARE PACKAGE). IF YOU DO NOT AGREE TO ALL OF THE TERMS SET FORTH IN THE AGREEMENT, DO NOT INSTALL THE SOFTWARE. IF APPLICABLE, YOU MAY RETURN THE PRODUCT TO MCAFEE OR THE PLACE OF PURCHASE FOR A FULL REFUND. 2 McAfee Endpoint Upgrade Assistant Product Guide

3 Contents 1 Overview of the Endpoint Upgrade Assistant 5 What is the Endpoint Upgrade Assistant? How the Endpoint Upgrade Assistant works Key features Upgrading your environment 9 Before you upgrade Overview of the upgrade process Things to know about the upgrade phases Setting up your test environment Using Upgrade Automation Upgrade with Upgrade Automation Things to know about Upgrade Automation Upgrading manually Upgrade endpoints manually Things to know about upgrading manually Troubleshooting and Reference 21 Managing upgrade information Export system and product information Troubleshooting blocked endpoints Refresh the McAfee epo database Troubleshooting installation and uninstallation issues Remove files after a failed installation Troubleshooting issues with the Endpoint Upgrade Assistant Troubleshoot Upgrade Automation Reporting an issue to McAfee Support McAfee Endpoint Upgrade Assistant Product Guide 3

4 Contents 4 McAfee Endpoint Upgrade Assistant Product Guide

5 1 Overview 1 of the Endpoint Upgrade Assistant Contents What is the Endpoint Upgrade Assistant? How the Endpoint Upgrade Assistant works Key features What is the Endpoint Upgrade Assistant? The McAfee Endpoint Upgrade Assistant is a McAfee epolicy Orchestrator (McAfee epo ) extension that analyzes the endpoints in your McAfee epo environment, detects the supported McAfee products that are installed, determines the minimum requirements for upgrading to current versions of the products, and automates the upgrade process. Data analysis and organization The Endpoint Upgrade Assistant collects, analyzes, and displays the data about your environment, then provides tools to assist with preparing and upgrading. Tabs organize the information and tasks you need for upgrading your environment. Summary information for the endpoints in your environment is displayed in charts and tables and lets you drill down to new information. Tagging lets you identify endpoints that require the same product upgrade steps, so they can be upgraded using a single deployment task. Upgrade History lets you identify on a line chart the changes made to your environment. Upgrade Automation is a client package that automates the removal of legacy products and installation of McAfee Endpoint Security. Automatic and manual upgrades The Endpoint Upgrade Assistant does not alter your McAfee epo environment. It provides information so that you can upgrade endpoints efficiently throughout your environment. Automatic upgrades Use Upgrade Automation to upgrade all selected McAfee products on all endpoints. Create and schedule an Upgrade Automation deployment task directly in the Endpoint Upgrade Assistant. Manual upgrades Create deployment tasks in McAfee epo to upgrade selected endpoints with selected products. The Endpoint Upgrade Assistant displays groups of endpoints that require the same upgrade steps, so you can tag them and upgrade them in a single deployment task. Product components The Endpoint Upgrade Assistant includes these McAfee epo components: McAfee Endpoint Upgrade Assistant Product Guide 5

6 1 Overview of the Endpoint Upgrade Assistant How the Endpoint Upgrade Assistant works Extension Install on the McAfee epo server. Provides the features for analyzing, preparing, and tracking McAfee product upgrades for your environment. Make sure that your endpoints are running epolicy Orchestrator or later. Client package (called Upgrade Automation) Deploy to managed endpoints. Provides ability to remove legacy products, upgrade McAfee Agent, upgrade incompatible versions of McAfee Data Loss Prevention (McAfee DLP), and install Endpoint Security. How the Endpoint Upgrade Assistant works The Endpoint Upgrade Assistant analyzes your environment, then displays the information you need to upgrade your environment automatically with minimal impact on endpoints. Best practice: Deploy upgrades in a test environment or to a test group, then verify the results before deploying upgrades to the larger environment. Tabs walk you through all the steps required to upgrade. 1 Specify what to upgrade Select the version of McAfee Endpoint Security and the System Tree groups. 2 Analyze your environment Discover endpoints that require upgrades and endpoints that can't be analyzed. 3 Check in and install the required software to the McAfee epo server This makes it available for deployment tasks using Software Manager. 4 View the steps required for upgrading your environment Identify which endpoints can use Upgrade Automation and which require manual upgrades. Re-analyze your environment after completing manual upgrades to identify additional endpoints for Upgrade Automation. 5 Tag endpoints to upgrade Create one tag for all the endpoints that are eligible for Upgrade Automation. The Endpoint Upgrade Assistant creates a single package file containing all the required software. You can also tag endpoints that require manual upgrades. 6 Create and run a deployment task in McAfee epo Select a tag you created from the Endpoint Upgrade Assistant. If using Upgrade Automation, select the Upgrade Automation package file to deploy. If not using Upgrade Automation, select the required client package files individually. See also Setting up your test environment on page 13 Key features The Endpoint Upgrade Assistant is designed to simplify and automate the tasks required to upgrade McAfee products in McAfee epo environments. Its features minimize the number of upgrade tasks and ensure product interoperability. Upgrade Automation Upgrade Automation is a McAfee epo client package that works with the Endpoint Upgrade Assistant to upgrade multiple products on multiple endpoints to McAfee Endpoint Security, using a single McAfee epo product deployment task. Upgrade Automation removes these legacy products: 6 McAfee Endpoint Upgrade Assistant Product Guide

7 Overview of the Endpoint Upgrade Assistant Key features 1 McAfee VirusScan Enterprise McAfee Host Intrusion Prevention (McAfee Host IPS) McAfee SiteAdvisor Enterprise Upgrade Automation upgrades incompatible versions of these products to these versions: McAfee Agent or later McAfee Data Loss Prevention version 9.3 Patch 5 or later When using Upgrade Automation to upgrade to Endpoint Security: This product (if installed) Is replaced with VirusScan Enterprise SiteAdvisor Enterprise Endpoint Security Threat Prevention Endpoint Security Web Control Notes Host Intrusion Prevention Endpoint Security Firewall You can choose to keep Host Intrusion Prevention instead of installing Firewall. During an upgrade, Upgrade Automation performs these tasks on endpoints. 1 Downloads McAfee Endpoint Security, McAfee Agent version 5.0.5, and McAfee Data Loss Prevention (depending on options selected when creating the deployment task) from McAfee epo. 2 Copies legacy product policies locally on the endpoint. 3 Removes legacy products, verifies the removal, and performs cleanup, if required. 4 Upgrades the McAfee Agent (if selected) and installs Endpoint Security, which then applies the local policies. 5 Endpoint Security contacts McAfee epo to check for new policies. 6 Upgrades McAfee Data Loss Prevention (if it is incompatible with Endpoint Security). Best practice: Restart endpoints after installing Endpoint Security. Upgrade Automation doesn't restart endpoints after deployment. You need to restart them manually, taking care to consider the effects of restarts in server environments. Manual upgrade steps The Endpoint Upgrade Assistant analyzes your environment to determine which endpoints and products require upgrading. It then displays the upgrade steps that need to be performed on the endpoints for each product. Endpoints with the same upgrade steps are grouped together in the Endpoint Upgrade Assistant. You can tag the endpoints to upgrade them all at the same time. Tagging The Endpoint Upgrade Assistant uses McAfee epo tags to identify servers and workstations that require specific product upgrades. View these tags in the Tag Catalog under a group called Endpoint Upgrade Assistant Tags. You can create a single tag for all the endpoints eligible for Upgrade Automation. You can also create a tag for all endpoints that share the same upgrade steps. When you create a deployment task in McAfee epo, select one of the tags you've created with the Endpoint Upgrade Assistant. All the tagged endpoints are upgraded when the deployment task runs. McAfee Endpoint Upgrade Assistant Product Guide 7

8 1 Overview of the Endpoint Upgrade Assistant Key features Deployment features The Endpoint Upgrade Assistant works with standard McAfee epo deployment tasks to upgrade endpoints. When creating a deployment task, specify the endpoints to upgrade by selecting the tags you created with the Endpoint Upgrade Assistant. You can use Upgrade Automation to automate the process of upgrading endpoints to Endpoint Security. Do this by creating a deployment task with Endpoint Upgrade Assistant selected as the package to deploy. Otherwise, deploy products required for manual tasks by using the standard McAfee epo process. See the McAfee epolicy Orchestrator Product Guide for more information. The Endpoint Upgrade Assistant does not support third-party provisioning. 8 McAfee Endpoint Upgrade Assistant Product Guide

9 2 Upgrading 2 your environment Contents Before you upgrade Overview of the upgrade process Things to know about the upgrade phases Setting up your test environment Using Upgrade Automation Upgrading manually Before you upgrade To streamline the upgrade process, follow these best practices before upgrading. Set up a test environment Select a subset of your System Tree to upgrade as a test. Upgrading in a test environment allows you to verify that endpoints upgrade as expected, and make changes as needed, before deploying upgrades to all endpoints. Disable features that detect and reinstall uninstalled products If you have set up applications or processes to detect when programs are uninstalled and then reinstall them automatically, be sure to disable this functionality. Upgrade Automation can uninstall legacy products during the upgrade process. Make sure your endpoint doesn't reinstall them before Upgrade Automation installs upgraded products. Install the Endpoint Upgrade Assistant The Endpoint Upgrade Assistant is a self-contained McAfee epo extension that you need to install on the McAfee epo server. The Endpoint Upgrade Assistant also checks in the Endpoint Upgrade Automation client package to all branches of McAfee epo. This lets you deploy using Upgrade Automation from any branch. Deploy the Endpoint Upgrade Automation client package Deploy to endpoints in your environment to enable Upgrade Automation features. Check that endpoints meet requirements for analysis The Endpoint Upgrade Assistant analyzes endpoints managed with McAfee Agent. If your environment includes endpoints that don't meet the requirements, such as management by McAfee Agent, the Endpoint Upgrade Assistant can't analyze them and reports them as Blocked from Upgrades. Prepare for migration if you want to preserve settings for legacy products To preserve custom settings for legacy products, you need to migrate those settings on the McAfee epo server during the upgrade process. To prepare for migration: Review your custom policy settings and client tasks, consolidating them where possible. Remove duplicate and unused policies and tasks. Install the Endpoint Migration Assistant extension. McAfee Endpoint Upgrade Assistant Product Guide 9

10 2 Upgrading your environment Overview of the upgrade process See the McAfee Endpoint Security Migration Guide for more information. See also Troubleshooting blocked endpoints on page 22 Setting up your test environment on page 13 Overview of the upgrade process Here is a high-level overview of the prerequisites and tasks required to upgrade. See the McAfee Endpoint Security Installation Guide and McAfee epolicy Orchestrator Product Guide for more information about these tasks. 1 Make sure that McAfee epo or later is installed. 2 Prepare policies as needed. If you are migrating legacy policies Review and revise your settings to eliminate unused, outdated, and duplicate settings. If you are preconfiguring policies Create a custom package. See the McAfee Endpoint Security Installation Guide for instructions. 3 Use the Prepare tab to verify that all required software is installed and checked in to McAfee epo. 4 Manually update your McAfee epo server with the latest AMCore and Exploit Prevention content files required for Endpoint Security. See the McAfee Endpoint Security Installation Guide for instructions. See the Endpoint Security Common Product Guide for more information about content files. 5 Migrate policies, client tasks, and other settings from supported legacy products on the McAfee epo server. You need to install the Migration Assistant extension before migrating. See the McAfee Endpoint Security Migration Guide for more information. 6 Configure policies as needed. 7 Analyze your environment. Use the Upgrade tab to view all products that require upgrades. 8 Deploy the client software with default or custom settings to endpoints. To do this, create a McAfee epo deployment task in one of these ways: When using Upgrade Automation In the Endpoint Upgrade Assistant, click Create Deployment Task to create a McAfee epo deployment task with the Endpoint Upgrade Automation package. The Endpoint Upgrade Assistant creates a tag for the selected endpoints automatically. When not using Upgrade Automation In the Endpoint Upgrade Assistant, create a tag manually. Then create a new deployment task in McAfee epo that uses this tag. See the McAfee epo Product Guide for more information. Best practice: Restart the endpoints after Endpoint Upgrade Automation runs. Upgrade Automation doesn't restart endpoints after deployment. You need to restart them manually, taking care to consider the effects of restarts in server environments. 9 Verify that the deployment task completed successfully. In the Endpoint Upgrade Assistant Check the Track tab for the status of the task and endpoints. In McAfee epo Check that the client software is installed and up to date on all endpoints. 10 McAfee Endpoint Upgrade Assistant Product Guide

11 Upgrading your environment Things to know about the upgrade phases 2 Things to know about the upgrade phases Upgrade tasks are grouped together on tabs that display the information you need to analyze, prepare, upgrade, and track deployments to your endpoints. Specifying what to upgrade On the landing page, select these options: Version of McAfee Endpoint Security to upgrade to. Which endpoints to analyze Analyze the entire System Tree or a single group and its subgroups. You can use the System Tree to select subsets of your environment for analysis, which might reduce the time required to perform the analysis and provides flexibility when planning upgrades. The time required to analyze your selection depends on the size of the McAfee epo database and the number of endpoints selected. This option lets you select a subset of your environment for a test environment, so that you can deploy and verify upgrades to non-critical endpoints before upgrading your entire environment. Best practice: Upgrading your operating system? Use the link at the bottom of the Getting Started pane to check McAfee product compatibility with your new operating system. Getting an overview of your environment Use the Overview tab to identify the McAfee products in your environment that require upgrades. The Endpoint Upgrade Assistant analyzes the McAfee epo database to determine what endpoint software is in your environment and how that compares to the product versions recommended by McAfee. After analysis is complete, use the information on this page to identify: Products and number of endpoints that require upgrades. The minimum product versions required for upgrades. KnowledgeBase articles with additional information about the products to be upgraded. Current versions of products in your environment and number of endpoints where they are installed. Endpoints with issues that prevent the Endpoint Upgrade Assistant from upgrading or determining what products are installed. When the McAfee Agent or McAfee Host Intrusion Prevention are installed on endpoints that you plan to upgrade, these deployment options are available: Keep versions of McAfee Agent that are compatible with Endpoint Security. Keep McAfee Host Intrusion Prevention (do not remove it). Preparing to upgrade Use the Prepare tab to make sure the required software is available to use Upgrade Automation. The Endpoint Upgrade Assistant lists the software packages that you need to check in to Software Manager. It shows what is currently checked in and what needs to be upgraded to meet the product versions recommended by McAfee. Check in all packages to the same branch. When you installed the Endpoint Upgrade Assistant extension, the Upgrade Automation client package was checked in to all McAfee epo branches. This lets you deploy Upgrade Automation from any branch. After checking in the required software packages, click Reload Client Package Branch to confirm that your server is up to date. McAfee Endpoint Upgrade Assistant Product Guide 11

12 2 Upgrading your environment Things to know about the upgrade phases Use the information on this tab to identify: Product client packages required for upgrades. Product client packages currently checked in You can view the Current, Evaluation, or Previous branch. You must check in all packages to the same branch to use Upgrade Automation. Product extensions required If the products you're upgrading require a product extension, install those on the McAfee epo server manually. The Endpoint Upgrade Assistant checks for minimum requirement versions for all products except Endpoint Security and McAfee DLP. It looks for specific versions of those products. You can select a checkbox to keep versions of McAfee Agent and McAfee Host IPS that are compatible with Endpoint Security during deployment. Planning your upgrade strategy Use the Upgrade tab to view the steps required to upgrade the McAfee products in your environment and plan the best way to upgrade them. Use the information on this tab to identify: Endpoints eligible for Upgrade Automation Endpoints and products that can be upgraded using a single deployment task. You can create an Upgrade Automation deployment task in McAfee epo for upgrading these endpoints. Endpoints not eligible for Upgrade Automation Endpoints that require manual upgrades before they can use Upgrade Automation. By completing these upgrades and then re-analyzing your environment, more endpoints become eligible for Upgrade Automation. Endpoints that require the same upgrade steps Endpoints that need the same upgrade steps are grouped, so that you can upgrade them at the same time. You can tag these groups for upgrades, then select one of the tags when you create a deployment task. The deployment task upgrades all endpoints that have the selected tag. To display all the manual upgrade steps required, click View manual upgrade instructions at the top of the Upgrade tab. Tracking your deployments Use the Track tab to identify the status of scheduled deployment tasks. For deployment tasks that are running or completed, you can view the status of the upgrade on each endpoint (Install Successful, Failed, or Pending) 12 McAfee Endpoint Upgrade Assistant Product Guide

13 Upgrading your environment Setting up your test environment 2 Setting up your test environment Use a test environment to upgrade a subset of endpoints in preparation for performing a controlled rollout of the Endpoint Upgrade Automation package across your environment. General guidelines Review these best practices before setting up your test environment. Do not include endpoints that are essential to your daily operations in your test environment. Select endpoints that reflect the diversity of your environment. For example, include one endpoint from each upgrade step. Use the Overview tab to identify suitable endpoints by reviewing the software running on them. Use the Upgrade tab to identify upgrade steps. The tab groups the endpoints by product upgrade steps. Use the Track tab to identify the deployments performed to endpoints eligible for Upgrade Automation using the Endpoint Upgrade Assistant. When selecting a test environment, make sure that you consider the following information to identify representative endpoints: McAfee product combinations and versions Operating systems Servers and workstations Validate the upgrade on servers and workstations. For more information, see the Troubleshooting and Reference chapter. Considerations for Upgrade Automation Upgrade Automation features ensure that endpoints do not end up in an unsuitable state. However, upgrades for multiple products, groups, and endpoint types involve many components, and you might not always anticipate all the results correctly. It's important to test upgrades in test environments or small groups before upgrading your entire environment. Best practice: Test on a subset of servers before upgrading your entire server environment. Some endpoints might require a restart. You need to restart them manually; the Upgrade Automation deployment task doesn't initiate a restart after all upgrades are complete. McAfee Endpoint Upgrade Assistant Product Guide 13

14 2 Upgrading your environment Using Upgrade Automation Using Upgrade Automation This illustration shows the high-level steps in the Upgrade Automation process. Figure 2-1 Overview of Upgrade Automation 14 McAfee Endpoint Upgrade Assistant Product Guide

15 Upgrading your environment Using Upgrade Automation 2 Upgrade with Upgrade Automation When using Upgrade Automation, follow these steps to upgrade products in your McAfee epo environment. Before you begin Check that the environment and managed endpoints where you plan to install Endpoint Security meet the requirements provided in the McAfee Endpoint Security Installation Guide. Best practice: Deploy upgrades in a test environment or to a test group, then verify the results before deploying upgrades to the larger environment. Task 1 In McAfee epo, check in the required client packages to the same branch. Install any corresponding McAfee epo server extensions for software packages that will be deployed. a From the Prepare tab, confirm that the correct product versions and components are checked in. b Migrate settings for legacy products on the McAfee epo server. (Required only if you want to retain custom policy settings and client tasks for legacy products that are installed.) Use the Endpoint Migration Assistant to migrate settings from supported legacy products. See the McAfee Endpoint Security Migration Guide for more information. 2 From the Upgrade tab, identify products you need to upgrade before you can use Upgrade Automation to install Endpoint Security on the endpoints. Upgrading these products first enables more endpoints to use Upgrade Automation. 3 From the Upgrade tab, perform these upgrade steps for each product. a Tag endpoints Tag endpoints where you want to deploy the upgrade. b c Deploy product upgrades Use your preferred method to deploy these products individually in your environment. Re-analyze environment Refresh the number of endpoints that can use Upgrade Automation. 4 From the Upgrade tab, click Create Deployment Task to deploy products using Upgrade Automation. a When prompted, enter additional information about the deployment task, such as the name of the task. b c d e f Specify whether to upgrade McAfee Agent if the existing version is compatible with Endpoint Security. Specify whether to keep McAfee Host IPS, if it is installed on any endpoints. Specify that you have either migrated your legacy settings or acknowledge that McAfee Default settings will be enforced. Click Save. A notification summarizes when the deployment task will run and how many endpoints will be upgraded. Click OK to create an Upgrade Automation deployment package task for the selected endpoints. If the Endpoint Upgrade Assistant can't create the task, the Create Deployment Task page is displayed again. 5 From the Track tab, review the status of each product deployment task you have created. You can view each deployment task and check when it is scheduled to start, the number of endpoints to be upgraded, and the status of the task and the endpoints. See also Setting up your test environment on page 13 McAfee Endpoint Upgrade Assistant Product Guide 15

16 2 Upgrading your environment Using Upgrade Automation Things to know about Upgrade Automation Endpoint Upgrade Automation is the McAfee epo client package that is deployed to the endpoint and completes the product upgrades. It downloads product software, copies local product policies, removes legacy products, and installs new products. Supported products Endpoint Upgrade Automation can upgrade endpoints to Endpoint Security if they have any combination of the following products: VirusScan Enterprise, version 8.8 (all patches) McAfee Host IPS, version 8 (all patches) SiteAdvisor Enterprise, version 3.5 and later McAfee Agent, version 4.6.x and later McAfee Threat Intelligence Exchange (TIE) for VirusScan Enterprise, version 1.x and later McAfee DLP, versions and earlier Upgrade Automation can coexist on the endpoint with these products, but does not alter them: McAfee Access and Change Control, version , , or and later McAfee Data Exchange Layer (DXL), version and later McAfee DLP, version and later McAfee Drive Encryption, version and later McAfee File and Removable Media Protection (FRP), version and later McAfee Native Encryption Deployment When you install the Endpoint Upgrade Assistant extension, the package is checked in to all McAfee epo branches: Current, Evaluation, and Previous branch. This provides the flexibility to deploy Upgrade Automation from any branch. For the Endpoint Upgrade Assistant to run successfully, you must check in the client software for these products to the same McAfee epo branch where you plan to deploy the Endpoint Upgrade Assistant: McAfee Agent, version or later Endpoint Security, version , , or Upgrade Automation can also upgrade incompatible versions of McAfee DLP to version 9.3 patch 5, which is compatible with Endpoint Security versions 10.x. To upgrade McAfee DLP, you must check its client software in to the same McAfee epo branch where you plan to deploy the Endpoint Upgrade Assistant. Endpoint Security has four main product modules: Common (also called the Endpoint Security Platform) Installs automatically with Threat Prevention; you do not need to select it. Threat Prevention Required. Firewall Web Control 16 McAfee Endpoint Upgrade Assistant Product Guide

17 Upgrading your environment Using Upgrade Automation 2 The Endpoint Upgrade Assistant installs the products that you have checked in to McAfee epo. You can choose to install all or some of these modules, but Common and Threat Prevention are required. If you do not select these modules to install or check them in to McAfee epo, the Upgrade Automation deployment task fails. When the Endpoint Upgrade Assistant package is deployed to an endpoint, it: 1 Downloads the client software for McAfee Agent, Endpoint Security, and McAfee DLP, if required. 2 Removes legacy products, such as VirusScan Enterprise and McAfee Host IPS. 3 Upgrades McAfee Agent, if required. 4 Installs Endpoint Security. 5 Upgrades McAfee DLP, if required. Keeping Host Intrusion Prevention By default, Endpoint Upgrade Assistant removes McAfee Host IPS version 8.x, when it is installed on an endpoint you are upgrading, and replaces it with Endpoint Security. However, you can choose not to upgrade this product when you create the Upgrade Automation deployment task. These versions of McAfee Host IPS can co-exist with Endpoint Security on the same endpoint: Version 8 Patch 5-7 with Hotfix Version 8 Patch 8 When they co-exist, you can enable the Host Intrusion Prevention and Firewall functionality in either Endpoint Security or McAfee Host IPS. When these functions are enabled in McAfee Host IPS, they are disabled in Endpoint Security, even when enabled by policy. If you want to keep McAfee Host IPS installed on upgraded endpoints, use one of these methods when creating the deployment task: In the Endpoint Upgrade Assistant On the Create Deployment Task page, select Keep McAfee Host Intrusion Prevention (do not use Endpoint Security Firewall). In McAfee epo On the Edit Deployment page, for Command Line, enter this option: --keephips When you specify this option and a compatible version of McAfee Host IPS is present on the endpoint, the McAfee Host IPS install package isn't downloaded and McAfee Host IPS isn't upgraded. Keeping compatible versions of McAfee Agent When McAfee Agent version or later is installed on an endpoint where you plan to upgrade Endpoint Security, upgrading McAfee Agent is optional. You can choose not to upgrade McAfee Agent when you create the Upgrade Automation deployment task. To keep a compatible version of McAfee Agent installed, use one of these methods when creating the deployment task: In the Endpoint Upgrade Assistant On the Create Deployment Task page, select Keep versions of McAfee Agent that are compatible with McAfee Endpoint Security. In McAfee epo On the Edit Deployment page, for Command Line, enter this option: --keepma When you specify this option and a compatible version of McAfee Agent is present on the endpoint, the McAfee Agent install package isn't downloaded and the McAfee Agent isn't upgraded. McAfee Endpoint Upgrade Assistant Product Guide 17

18 2 Upgrading your environment Upgrading manually If all the endpoints you plan to upgrade have versions of McAfee Agent that are compatible with Endpoint Security, it is not necessary to check in McAfee Agent version to the McAfee epo branch. However, if an incompatible version of McAfee Agent is installed on any endpoint, the deployment task attempts to download the version of McAfee Agent that is checked in. In these cases: If version is checked in, Upgrade Automation upgrades McAfee Agent and installs Endpoint Security. If version is not checked in, Upgrade Automation fails on the endpoints that have an incompatible version of McAfee Agent. Upgrading manually This illustration shows the high-level steps in the manual upgrade process. Figure 2-2 Overview of manual upgrade 18 McAfee Endpoint Upgrade Assistant Product Guide

19 Upgrading your environment Upgrading manually 2 Upgrade endpoints manually Follow these steps to manually upgrade endpoints in your environment with required McAfee products. Before you begin Check that the environment and managed endpoints where you plan to install Endpoint Security meet the requirements provided in the McAfee Endpoint Security Installation Guide. Best practice: Deploy upgrades in a test environment or to a test group, then verify the results before deploying upgrades to the larger environment. Task 1 In McAfee epo, check in the required client packages to the same branch. Install any corresponding McAfee epo server extensions for software packages that will be deployed. a From the Upgrade tab, confirm that the correct product versions and components are checked in. b Migrate settings for legacy products on the McAfee epo server. (Required only if you want to retain custom policy settings and client tasks for legacy products that are installed.) Use the Endpoint Migration Assistant to migrate settings from supported legacy products. See the McAfee Endpoint Security Migration Guide for more information. 2 From the Upgrade tab, tag the endpoints where you want to deploy upgraded products. The Upgrade tab groups endpoints by upgrade steps. Tag endpoints with the same upgrade steps to upgrade them all at the same time. 3 In McAfee epo, create and run deployment tasks, selecting the tag created by the Endpoint Upgrade Assistant and the product package. If a restart is required during the upgrade, you must deploy subsequent product upgrades using a separate product deployment task. See the McAfee epolicy Orchestrator Product Guide for more information. 4 In McAfee epo, review the status of the product deployment tasks. If the deployment task was not successful Repeat tasks 2-4. If the deployment task was successful Deploy upgrades to all tagged endpoints in your environment. See also Setting up your test environment on page 13 Things to know about upgrading manually Create deployment tasks in McAfee epo to manually upgrade endpoints. Selecting software packages to deploy Select the individual product packages required for upgrading when creating a product deployment task. The Endpoint Upgrade Assistant doesn't create a master software package for manual upgrades. Selecting endpoints to upgrade Select one or more tags that you created in the Endpoint Upgrade Assistant. The tags appear in the Tag Catalog in the Endpoint Upgrade Assistant Tags group. McAfee Endpoint Upgrade Assistant Product Guide 19

20 2 Upgrading your environment Upgrading manually Deploying upgrades that require restarts If a product upgrade requires endpoints to be restarted, the deployment task does not initiate a restart. You can force a restart by configuring a setting in the McAfee Agent policies in McAfee epo for Reboot options after product deployment. Best practice: Restart all upgraded endpoints after installing Endpoint Security. 20 McAfee Endpoint Upgrade Assistant Product Guide

21 3 Troubleshooting 3 and Reference Contents Managing upgrade information Troubleshooting blocked endpoints Troubleshooting installation and uninstallation issues Troubleshooting issues with the Endpoint Upgrade Assistant Troubleshoot Upgrade Automation Reporting an issue to McAfee Support Managing upgrade information The Endpoint Upgrade Assistant uses several McAfee epo features to assist you with planning and implementing your upgrade strategy. Using queries and reports Each time it analyzes an environment, the Endpoint Upgrade Assistant creates a query that you can view in McAfee epo under Queries & Reporting. Use these queries to create reports containing the information you need to plan and track your upgrades, then save them in PDF format. Endpoint Upgrade Assistant queries display results from the last System Tree or group you analyzed. Data from previous analyses is overwritten. Exporting system details System administrators can search, sort, filter, and validate the Endpoint Upgrade Assistant results by downloading the information for a selected category in comma-separated values (CSV) format. Use this information for purposes such as debugging, identifying the endpoints required for upgrades, and resolving differences between the reported and expected status of endpoints. Export Systems Creates a list of endpoints with their name, path, and type (server or workstation). Export System and Product Details Adds the products and versions running on endpoints. This lets you sort by product to create a listing of all endpoints running each version of each product (for example, outdated versions of McAfee Agent). View Systems Displays a page listing the corresponding systems that you can export. Tag management The Endpoint Upgrade Assistant creates McAfee epo tags to label endpoints in the McAfee epo database. Use them to tag endpoints that require the same upgrade steps, even if the endpoints are in different System Tree groups. McAfee Endpoint Upgrade Assistant Product Guide 21

22 3 Troubleshooting and Reference Troubleshooting blocked endpoints When you tag a group of endpoints in the Endpoint Upgrade Assistant, the tag appears in the Tag Catalog in the Endpoint Upgrade Assistant Tags group. This lets you create deployment tasks that deploy upgrades to these tagged endpoints. To deploy to a subset of tagged endpoints, use one of these methods: In the Endpoint Upgrade Assistant From the landing page, select a System Tree group to analyze. The Endpoint Upgrade Assistant analyzes only endpoints in that group. When you create a tag, it includes only endpoints located in the selected group. In McAfee epo Create a new tag, then copy endpoints with Endpoint Upgrade Assistant tags into the new tag. See the McAfee epolicy Orchestrator Product Guide for more information. Export system and product information Search, sort, filter, and validate the Endpoint Upgrade Assistant results by downloading the information for a selected category in comma-separated values (CSV) format. Send this information to McAfee support when reporting an issue with the Endpoint Upgrade Assistant, or use it to troubleshoot issues, identify the endpoints required for upgrades, and resolve differences between the reported and expected status of endpoints. Task 1 From the Overview tab, in the Environment Overview table, click Export System and Product Details. 2 Import this data into Microsoft Excel, then sort and filter as needed to identify the endpoints outside your expected groupings. Troubleshooting blocked endpoints Endpoints that the Endpoint Upgrade Assistant can't analyze are listed on the Overview tab in a table called Blocked from Upgrading. Blocked endpoints do not appear on the Upgrade tab. Incompatible systems These endpoints cannot be upgraded due to hardware, memory, or operating system limitations. Endpoints might fall into more than one category. For more information see KB Currently excluded systems These endpoints have McAfee products installed that are not yet supported by the Endpoint Upgrade Assistant. Note that the list of supported products is updated with new products regularly. Unmanaged systems These endpoints can't be detected due to problems with McAfee Agent. McAfee epo locates endpoints by querying Active Directory. It uses McAfee Agent to detect the McAfee products installed. It can't detect what is installed when: McAfee Agent is not installed. An unsupported version of McAfee Agent is installed. McAfee Agent is not set to Managed mode. To correct the problem, install a supported version of McAfee Agent or make sure that Managed mode is enabled, then click Re-analyze Environment for an updated listing of the products installed in your environment. Refresh the McAfee epo database You can often resolve a blocked status by sending endpoints an agent wake-up call that asks for full properties. To analyze the products installed on endpoints, the Endpoint Upgrade Assistant queries the McAfee epo database. When the version information for McAfee products on one or more endpoints is not correctly captured in the database, those endpoints are blocked from upgrades. In some cases, endpoints might report blank or incorrectly formatted version information. 22 McAfee Endpoint Upgrade Assistant Product Guide

23 Troubleshooting and Reference Troubleshooting installation and uninstallation issues 3 You can refresh the database to ensure that all products installed on the endpoints in your environment are reported correctly in the McAfee epo database. Task 1 From the Overview tab, select Export System and Product Details to export details about these endpoints in CSV format. Use this information to identify and resolve issues with each endpoint. 2 Create a McAfee epo task to update the client properties for these specific endpoints. This refreshes the information in the McAfee epo database. See the McAfee epolicy Orchestrator Product Guide for more information. Troubleshooting installation and uninstallation issues Use this information to resolve issues that occur when attempting to install the Endpoint Upgrade Assistant or to uninstall McAfee products during an upgrade. VirusScan Enterprise fails to uninstall correctly In some cases, uninstalling VirusScan Enterprise product fails and leaves behind files and drivers. When this happens, Upgrade Automation completely removes the product from the endpoint, then installs Endpoint Security. In some instances, Upgrade Automation needs to uninstall drivers, which might require an endpoint restart. If that is the case, Upgrade Automation restarts the endpoint automatically. Best practice: Consider the effect of restarts before upgrading servers. Test on a subset of servers before upgrading your entire server environment. Installation fails because Software Manager is busy In rare circumstances, installation fails if the Software Manager is actively checking in the required software packages when installation begins. If this happens, wait until the packages are checked in, then begin installation again. Alternatively, you can stop the task that is updating the Software Manager. The Endpoint Upgrade Assistant fails to install because files were left behind by a partial installation If you tried and failed to install the Endpoint Upgrade Assistant, some files might have been left behind that prevent you from installing the product again. Remove these files before attempting to install again. Remove files after a failed installation If the Endpoint Upgrade Assistant fails to completely install, you need to manually remove any parts of the extension that were installed before attempting to install again. Before you begin Examine the Orion logs to determine why the installation failed. If McAfee epo is installed in the default location, the logs are located under C:\Program Files (x86)\mcafee\epolicy Orchestrator\Server\Logs. Task 1 Remove the extension xml from C:\Program Files (x86)\mcafee\epolicy Orchestrator\Server \conf\catalina\localhost\upgradeassistant.xml. 2 Remove the extension directory from C:\Program Files (x86)\mcafee\epolicy Orchestrator \Server\extensions\installed\EndpointUpgradeAssistant. McAfee Endpoint Upgrade Assistant Product Guide 23

24 3 Troubleshooting and Reference Troubleshooting issues with the Endpoint Upgrade Assistant 3 Remove the OrionExtensions entry from the McAfee epo database table. Run the following SQL query: DELETE FROM dbo.orionextensions WHERE Name = 'EndpointUpgradeAssistant' 4 (Optional) Restart the server only if you can't execute the first two steps (for example, if the files are locked). Troubleshooting issues with the Endpoint Upgrade Assistant Use this information to resolve issues related to analyzing and reporting data and performance. Analysis inconsistencies Inconsistent version numbers that appear in the tables are not a reporting error; they refer to data entries in the database. You might need to refresh the McAfee epo database. Mismatched queries Upgrade Automation might categorize endpoints differently from the manual upgrade process. Upgrade Automation follows specific query criteria, and the sets of categories can be exported. When the number of endpoints reported by the Endpoint Upgrade Assistant doesn't match the number you expect (for example, the number of workstations, servers, or upgrade steps), use the export function to download a list of endpoints and their details in CSV format. Missing packages The Prepare tab highlights missing software packages that are required for upgrading. After missing packages are checked in, click Re-Analyze Environment to refresh the page so you can see the updates. Performance issues The time required to analyze your environment depends on the size of the McAfee epo database, which depends on the size of your managed environment. Larger environments take longer to analyze. You can use the drop-down list to select a System Tree group (a subset of endpoints) to reduce the number of endpoints to analyze. Outdated queries and reports If outdated information appears in reports, click Re-analyze Environment to refresh the queries and regenerate the report. See also Troubleshooting blocked endpoints on page 22 Refresh the McAfee epo database on page 22 Export system and product information on page 22 Troubleshoot Upgrade Automation Use these steps to prevent or troubleshoot Upgrade Automation issues. Best practice: Examine the Upgrade Automation logs to help determine the problem area. Upgrade Automation updates its logs for each step of the troubleshooting process. Logs are saved at the location %windir%\temp \McAfeeLogs\EndpointUpgradeAutomation.log. You can use these steps: 24 McAfee Endpoint Upgrade Assistant Product Guide

25 Troubleshooting and Reference Troubleshoot Upgrade Automation 3 In a test environment to ensure Upgrade Automation works correctly. When an Upgrade Automation task fails in your production environment. Task 1 Verify that the Endpoint Upgrade Assistant package downloaded McAfee Agent and Endpoint Security. See the table below for more information. If McAfee Agent 4.x was installed on the endpoint before upgrading, then FOLDER PATH is C:\ProgramData \McAfee\Common Framework\[Current Previous Evaluation] If McAfee Agent 5.x was installed on the endpoint before upgrading, then FOLDER PATH is C:\ProgramData \McAfee\Agent\[Current Previous Evaluation] These folders indicate that the download was successful Product <FOLDER PATH>\ENDP_AM_1020 Endpoint Security 10.2 or 10.5 <FOLDER PATH>\ENDP_AM_1050 <FOLDER PATH>\ENDP_FW_1020 <FOLDER PATH>\ENDP_FW_1050 <FOLDER PATH>\ENDP_GS_1020 <FOLDER PATH>\ENDP_GS_1050 <FOLDER PATH>\ENDP_WP_1020 <FOLDER PATH>\ENDP_WP_1050 <FOLDER PATH>\EPOAGENT3000 McAfee Agent <FOLDER PATH>\EUA_AUTO1000 Endpoint Upgrade Automation package (contains three.exe and two script files) Potential remediation step: Make sure the correct versions of McAfee Agent (5.0.5) and Endpoint Security (version 10.2.x or 10.5.x) are checked in to the same branch in McAfee epo that the Endpoint Upgrade Automation package was deployed from (for example, Current, Previous, or Evaluation). McAfee Endpoint Upgrade Assistant Product Guide 25

26 3 Troubleshooting and Reference Troubleshoot Upgrade Automation 2 Verify that there aren't any conflicting products on the endpoint that could stop the Endpoint Upgrade Automation package from running. Check the logs for this information: Log entry Step check_conflicts completed successfully for product: ENS Step check_conflicts failed for product: ENS Indicates Success Failure Potential remediation step: Remove conflicting products and redeploy the Endpoint Upgrade Automation package to the endpoint. 3 Verify that VirusScan Enterprise and Host Intrusion Prevention policies were copied successfully on the endpoint. Log entry Step preserve_policy completed successfully for product: VSE 8.8 Step preserve_policy failed for product: VSE 8.8 Indicates Success Failure Step preserve_policy completed successfully for product: HIPS 8.0 Success Step preserve_policy failed for product: HIPS 8.0 Failure Potential remediation step: If an error occurs while copying policies, it does not stop the installation. After Endpoint Security is installed on the endpoint, it pulls the latest policies from McAfee epo. 4 Verify that McAfee Agent upgraded successfully. Log entry RunCommand C:\programdata\McAfee\Common Framework\<Current\Previous\Evalutation>\ Indicates Success EPOAGENT3000\Install\0409\FramePkg.exe -- SUCCESS RunCommand C:\programdata\McAfee\Common Framework\<Current\Previous\Evalutation>\ Failure EPOAGENT3000\Install\0409\FramePkg.exe -- FAIL Potential remediation step: Contact McAfee Support if the upgrade stops. 26 McAfee Endpoint Upgrade Assistant Product Guide

27 Troubleshooting and Reference Reporting an issue to McAfee Support 3 5 Verify that Endpoint Security installed successfully. Log entry RunCommand C:\programdata\McAfee\Common Framework\<Current Indicates Success \Previous\Evalutation>\ENDP_GS_1020\Install\0000\setupCC.exe --SUCCESS RunCommand C:\programdata\McAfee\Common Framework\<Current Failure \Previous\Evalutation>\ENDP_GS_1020\Install\0000\setupCC.exe --FAIL Potential remediation step: Contact McAfee Support if the installation stops. Reporting an issue to McAfee Support To expedite assistance, include all the required information when reporting an issue to McAfee Support. Endpoint Upgrade Assistant issues Provide this information when reporting an issue: Brief description of the issue If possible, provide the steps required to reproduce the issue. Screenshots Logs from the time when the issue occurred McAfee epo server logs, also called Orion logs, can be found in the log directory (for example, McAfee \epolicy Orchestrator\Server\Logs). If McAfee epo is installed in the default location, the logs are located under C:\Program Files (x86)\mcafee\epolicy Orchestrator\Server\Logs. Version numbers for these components: McAfee epo Endpoint Upgrade Assistant extension Approximate number of endpoints running in your environment. If relevant, include an export of the endpoint details. Upgrade Automation issues Provide this information when reporting an issue: 1 MER data Before submitting an issue, open the Minimum Escalation Requirements (MER) tool and follow the instructions provided in KB59385 to collect product data for analysis. 2 Brief description of the issue 3 Screenshots See also Export system and product information on page 22 McAfee Endpoint Upgrade Assistant Product Guide 27