Release Notes McAfee 1.5.0 For use with epolicy Ochestrator Contents About this release What s new Resolved issues Installation information Known issues Additional information Getting product information by email Where to find product documentation About this release is an epo extension tool that is designed to help with analyzing and planning the upgrades of any McAfee product. Note: Before upgrading, ensure you have completed migration of any legacy custom policies and client tasks that you intend to use. Migrated policies and tasks must be assigned to applicable groups and systems being upgraded (as viewed from the epo System Tree). Otherwise, McAfee Default policy settings will be enforced. 1
The current release, which is compatible with epo 5.1.2 and higher, focuses on ascertaining what is involved for customers to upgrade to: Endpoint Security 10.2.1 (ENS) Endpoint Security 10.5.1 (ENS) Endpoint Security 10.5.2 (ENS) Endpoint Security 10.5.3 (ENS) Windows Server 2016 Windows 10 Anniversary Update Windows 10 Creators Update Windows 10 Fall Creators Update General Functionality is an epo package that removes VSE and legacy products from managed endpoints, validates that they have been successfully removed and if necessary cleans up any remaining files. It downloads MA and ENS from the epo server so it can upgrade MA and install ENS. It also migrates any local VSE and HIPS product policies so ENS can utilize them after it has been installed. can migrate endpoints to ENS if they have any combination of the following products: VSE 8.8 (all patches) HIPS 8.x SAE 3.5 and higher MA 4.8.x and higher TIE for VSE 1.x and higher DLP 9.2 or higher McAfee Drive Encryption (EEPC / MDE) 7.1.1 and higher MNEWIN all versions McAfee Access and Change Control, version 6.1.2.440-6.1.3.0, 6.1.3.440-6.1.4.0, or 6.2.0.504 and later McAfee Data Exchange Layer (DXL), version 2.0.1.162 and later File and Removable Media Protection (FRP), version 4.3.1.153 and later McAfee Drive Encryption, version 7.1.1 and later McAfee Data Exchange Layer (DXL), version 2.0.1.162 and later If any other products, which conflict with ENS are installed, EUA will not execute. Deployment The EUA package is checked into all epo branches (i.e. evaluation, previous and current) when you install the EUA epo extension. 2
For the EUA package to execute successfully, it needs the following to be checked into the same epo branch that it will be deployed from: 1. MA v5.0.5 + 2. ENS v10.2.1, v10.5.1, v10.5.2 or v10.5.3 Caution ENS is made up of four main components i.e. Platform, Threat Prevention, Firewall and Web Control and which component gets installed depends on what you have checked into epo but the presence of Platform and Threat Prevention are a minimum requirement. For example, if you have checked in all four components all will get installed on the endpoint but if you have only checked in Platform and Threat Prevention, then they will be the only components that will be installed. When the EUA package is deployed to an endpoint, it will download MA and ENS and start the process of automated migration to ENS by first removing legacy products e.g. VSE and HIPS, upgrading MA if required and installing ENS. What s new The current release of the product includes these enhancements and changes. New features The ENS reference configuration now supports ENS 10.2.1, 10.5.1, 10.5.2 & 10.5.3. The ENS reference configuration now supports Windows Fall Creators Update (RS3). has extended automated support for migration to ENS. --tag=<1-4> command line parameter provides information to the admin about the status of the endpoint that they may act upon. Please refer to the EUA 1.5.0 Product Guide for further information about this new parameter. EUA Package Creator The EUA package creator is a tool designed for system admins to use to generate a EUA upgrade package suitable for deployment via 3 rd party deployment mechanisms & epo deployment. Allows admin to select which optional components of ENS they wish to install. Allows admin to supply DLP 9.3 patch 6 to upgrade non-compatible versions of DLP to an ENS compatible version. Enables the migration of endpoints to a new epo during the ENS migration process by including a McAfee Agent installer from the target epo. Endpoint Product Removal Tool The Endpoint product removal tool is a UI tool for removing problem or broken installs of McAfee products from an endpoint. 3
This is not a migration tool and this tool does not install ENS. This tool allows an admin to remove supported McAfee products from an endpoint to allow the attempted re-install of problem/broken McAfee products. Enhancements includes several enhancements to improve the user experience of the tool. ENS Supported versions EUA now supports ENS version 10.5.2. EUA now supports ENS version 10.5.3. Windows Supported Versions Windows 10 Fall Creators Update. UI Welcome page video is now embedded in EUA Overview tab now only shows 3 tables, which can be expanded for additional information: Ready for upgrade automation Requires Product Upgrades Blocked from Upgrading Product options can only be changed on the Overview tab. Package branch can only be changed on the Prepare tab. Navigation to the Deploy & Track tab is blocked until the Prepare tab is completed. Upgrade and Track tabs have been merged into a single tab; Deploy & Track, which only contains details regarding Upgrade Automation. includes enhancements to improve the user supportability of the tool. Extended Product Support Upgrade automation now supports SIA being present on the client system. Upgrade automation will not attempt to remove SIA products as part of migration. Endpoint Automation was extended to operate in the presence of the following McAfee products: McAfee epo. MAR v1.1. 4
Resolved issues The following issue have been resolved in EUA version 1.5.0: Reference Issue Description 1210735 Unexpected error occurred on Analyze page when min_version and recommended_version not set for product in xml 1209668 "" is marking Win-7 machines with 2GB RAM are in-compatible to upgrade Reference Issue Description 1207322 EUA fails to upgrade from VSE to ENS on the epo server Installation information For information about installing or upgrading software, see the McAfee Endpoint Security Installation Guide. Known issues There are no known issues at time of publication. The following defects are known: 5
Issue Number Description 1183473 VSE shortcuts not cleaned up during EUA migration of German locale machine Additional information The following are the product s known limitations: 1. McAfee Agent (MA) needs to be installed on endpoints for them to be included in the analysis phase. Technically, the epo database is used to perform the analysis and details about the endpoint won t be captured here without McAfee Agent being installed. 2. EUA works on the details recorded in the epo database and the tool may show up some discrepancies between this and the actual managed environment. In this case, you may need to refresh the details about these endpoints in epo. 3. EUA currently supports systems within a predefined set of McAfee products, known as the Reference Configuration, and a number of endpoints in your environment may be excluded on this basis. (Users are encouraged to report this group of endpoints as it will contribute to the roadmap of products to be included in the Reference Configuration.) 1. Upgrade Automation currently only supports endpoints with VSE 8.8 (all patches), HIPS v8.x, MA 4.8.x and higher, DLP 9.2 and higher. If any other ENS incompatible McAfee products are installed Upgrade Automation will not execute. 2. EUA does not verify that all certificate and KB requirements for MA upgrade and ENS install are met. 3. MS KB3072630 and KB3139923: MA 5.0.x will fail to install if only one of these updates is installed if neither or both are installed it should work. 4. For HIPS 8 to remain on the endpoint, it must be compatible with ENS. Only the following versions of HIPS, which also have a minimum content version of 8.0.0.7364, are compatible with ENS: HIPS 8, Patch 5 with hotfix 1153407 HIPS 8, Patch 6 with hotfix 1153407 HIPS 8, Patch 7 with hotfix 1153407 HIPS 8, Patch 8 + 5. VSE policy migration not supported for VSE 8.8 patches 0-3 Getting product information by email The Support Notification Service (SNS) delivers valuable product news, alerts, and best practices to help you increase the functionality and protection capabilities of your McAfee products. To receive SNS email notices, go to the SNS Subscription Center at https://sns.secure.mcafee.com/signup_login to register and select your product information options. 6
Where to find product documentation On the ServicePortal, you can find information about a released product, including product documentation, technical articles, and more. Task 1 Go to the ServicePortal at http://support.mcafee.com and click the Knowledge Center tab. In the Knowledge Base pane under Content Source, click Product Documentation. Select a product and version, then click Search to display a list of documents. Copyright 2017 McAfee, LLC McAfee and the McAfee logo are trademarks or registered trademarks of McAfee, LLC or its subsidiaries in the US and other countries. Other marks and brands may be claimed as the property of others. 7