Knowledge Center

How to verify the SysCore version installed on a client system
Technical Articles ID:   KB87530
Last Modified:  9/26/2019


McAfee Active Response (MAR)
McAfee Agent (MA)
McAfee Data Exchange Layer (DXL)
McAfee Data Loss Prevention Endpoint (DLP Endpoint)
McAfee Endpoint Intelligence Agent (EIA)
McAfee Endpoint Security (ENS)
McAfee Host Intrusion Prevention (Host IPS)
McAfee Threat Intelligence Exchange Server (TIE server)
McAfee VirusScan Enterprise (VSE)


You need to know the version of SysCore installed on a system for you to plan and execute upgrades and new product installation. But, the currently installed version of SysCore is not easily visible.

This article explains how to find the version of the SysCore Kernel driver installed on a client system.

The SysCore version is available only in the system32/drivers folder. You can verify the version manually or using a third-party automation tool.

Manual verification
  1. Navigate to C:\Windows\System32\drivers.
  2. Right-click any driver that begins with MFE and select Properties.
  3. Select the Details tab.

    The SysCore Kernel driver versions start with 15.x. For example, or
NOTE: You might have multiple McAfee managed products that use SysCore installed. In this scenario, you must verify the version of mfehidk.sys to identify the version of SysCore installed.

Automated verification
NOTE: This method requires the download of a third-party application called NirSoft DriverView (freeware license).
  1. Download DriverView from the following link: http://www.nirsoft.net/utils/driverview.html
  2. Open DriverView and navigate to the MFE drivers.
  3. Scroll to the right until you can see the Version column.
    The SysCore Kernel driver versions start with 15.x. For example, or

Rate this document


This article is available in the following languages:

English United States

Glossary of Technical Terms

 Highlight Glossary Terms

Please take a moment to browse our Glossary of Technical Terms.