DLP policies are not applied and the installed DLP do not show under the McTray on the client system.
The McAfee Agent is installed through the string in the following folder:
FramePkg.exe /INSTALL=AGENT /INSTDIR="C:\RGC\Common Framework" /DATADIR="C:\RGC"
The logs contain the following errors:
HDLP_AgentServiceWatchDog.log
LineNum. Column 1 LineNum. Column 1 1 2020-04-22 18:24:18.255 [14424] [STARTUP][WinMain(339)]> Start HDLPAgentServiceWatchDog
LineNum. Column 1
1 2020-04-22 18:24:29.693 [14748] [STARTUP][LogoffManager::open(68)]> LogoffManager OK!
2 2020-04-22 18:24:29.693 [14748] [STARTUP][ProtectionMode::open(123)]> ProtectionMode OK!
3 2020-04-22 18:24:29.708 [14748] [OWARNING] [Cpp Framework] [OMessageFileHandler::open] Error open file C:\ProgramData\McAfee\DLP\Agent\Policy\SCM.opg, error: 2
4 2020-04-22 18:24:29.708 [14748] [ERROR][SystemConfigurationManager::readScmFile(664)]> Error opening SCM File: C:\ProgramData\McAfee\DLP\Agent\Policy\SCM.opg
5 2020-04-22 18:24:29.708 [14184] [STARTUP][DisconnectAllAddins(1389)]> DISCONNECT_ADDIN_EVENT created
6 2020-04-22 18:24:29.708 [14748] [STARTUP][SystemConfigurationManager::open(164)]> SystemConfigurationManager OK!
HDLP_AgentServiceWatchDog.log:
LineNum. Column 1 LineNum. Column 1 1 2020-04-22 18:24:18.255 [14424] [STARTUP][WinMain(339)]> Start HDLPAgentServiceWatchDog
HDLP_Service.log:
LineNum. Column 1
1 2020-04-22 18:24:18.177 [9604] [STARTUP][AgentService::svc(1087)]> COM succsesfully initialized
2 2020-04-22 18:24:18.177 [9604] [STARTUP][AgentService::svc(1108)]> Can't open DISCONNECT_ADDIN_EVENT
3 2020-04-22 18:24:18.177 [9604] [STARTUP][AgentService::svc(1220)]> Running under configuration of : Windows 10 64 bit
4 2020-04-22 18:24:18.177 [9604] [STARTUP][AgentService::checkDriversFiles(2270)]> Check Drivers Files
5 2020-04-22 18:24:18.177 [9604] [STARTUP][AgentService::checkSafeModeServiceConfig(2246)]> Check SafeMode Service Config
6 2020-04-22 18:24:18.177 [9604] [STARTUP][AgentService::checkSoftwareDriver(1034)]> hdlpevnt driver is running
7 2020-04-22 18:24:18.177 [9604] [STARTUP][AgentService::checkSoftwareDriver(1034)]> hdlpctrl driver is running
8 2020-04-22 18:24:18.177 [9604] [STARTUP][AgentService::checkSoftwareDriver(1038)]> hdlpnetmonitor driver doesn't running, check if installed
9 2020-04-22 18:24:18.177 [9604] [STARTUP][AgentService::checkSoftwareDriver(1067)]> hdlpnetmonitor driver installed
10 2020-04-22 18:24:18.177 [9604] [STARTUP][AgentService::runSelfRemediation(918)]> hdlpflt driver is running
11 2020-04-22 18:24:18.177 [9604] [STARTUP][AgentService::checkDeviceClassDriver(989)]> hdlpdbk driver is installed
12 2020-04-22 18:24:18.177 [9604] [STARTUP][AgentService::svc(1283)]> The SelfRemediation succeeded.
13 2020-04-22 18:24:18.177 [9604] [STARTUP][AgentService::svc(1302)]> Madshi driver installed.
14 2020-04-22 18:24:18.193 [OERROR] [12388:9604] [*MAServices.cpp:MAServicesImpl::on_logmessage] MA log [ma_client]: falied to start ma client.*
15 2020-04-22 18:24:18.193 [OERROR] [12388:9604] [MAServices.cpp:MAServicesImpl::client_start] Failed to start MAServices due to 705.
16 2020-04-22 18:24:18.193 [OERROR] [12388:9604] [MAServices.cpp:MAServicesImpl::on_notification] Caught exception while receiving client notification: 705.
MASVC_SystemName.log
Signature verification is completed for the DLP processes without any errors as below.
masvc(13700.16092) msgbus.Info: Allowing <2852> onto msgbus
masvc(13700.16092) msgbus.Info: Updating the <2852> auth info reference
masvc(13700.16092) msgbus.Info: QueryFullProcessImageName C:\Program Files\McAfee\DLP\Agent\fcagswd.exe
masvc(13700.16092) msgbus.Info: verify code signature returns <0>, GetLastError <0>.
masvc(13700.16092) msgbus.Info: Adding <C:\Program Files\McAfee\DLP\Agent\fcagswd.exe>:<8824> auth info reference
masvc(13700.16092) msgbus.Info: executable <C:\Program Files\McAfee\DLP\Agent\fcagswd.exe> is trusted via authenticode. Signer: <McAfee, Inc.> Issuer: <GlobalSign CodeSigning CA - G3>
masvc(13700.16092) msgbus.Info: Allowing <8824> onto msgbus
