Unexpected increase in Event ID 2427 after upgrading to File and Removable Media Protection 5.2.x

Technical Articles ID: KB92943
Last Modified: 3/24/2021

Environment

McAfee File and Removable Media Protection (FRP) 5.2.0 and later
McAfee Agent (MA) 5.6.3 and later

Problem

When you view or report on client events in the ePolicy Orchestrator interface, you see instances of Event ID 2427.

The event indicates the following problem when File and Removable Media is sent to the server:

Unknown failure occurred on property collection

The McAfee Agent compatibility service logs contain errors similar to the following:

lpc.Error: Check software exist failed for software EEFF____5000, lpc error = Point product process is not running

System Change

Upgraded to FRP 5.2.0 or later, or installed FRP 5.2.0 or later, while using McAfee Agent 5.6.3 or later.

Cause

FRP 5.2.0 and later no longer use LPC communication if McAfee Agent 5.6.3 or later is installed.

In FRP 5.2.0 and later, the communication methods used to work with the McAfee Agent have changed. If you have MA 5.6.3 or later installed with FRP 5.2.0 or later, FRP uses MessageBus communication with the McAfee Agent. So, there is no LPC connection.

For McAfee Agent 5.6.3 and earlier, FRP uses LPC communication.

Solution

The impact only involves how the system logs events. This issue is resolved in FRP 5.3.0 and later.

NOTE: FRP still functions as expected in this situation, and the applicable properties for FRP are shown in ePO as expected.

Workaround

CAUTION: This article contains information about opening or modifying the registry.

The following information is intended for System Administrators. Registry modifications are irreversible and could cause system failure if done incorrectly.
Before proceeding, Technical Support strongly recommends that you back up your registry and understand the restore process. For more information, see the Microsoft Windows registry information for advanced users article.
Do not run a REG file that is not confirmed to be a genuine registry import file.

To stop the generation of Events 2427:

Confirm the versions of FRP and MA and the supported communication method as explained in this article.
Validate that FRP is functioning.
Open the registry and navigate to one of the following locations:

64-bit systems
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Network Associates\ePolicy Orchestrator\Application Plugins\EEFF____5000

32-bit systems
HKEY_LOCAL_MACHINE\SOFTWARE\Network Associates\ePolicy Orchestrator\Application Plugins\EEFF____5000
Locate the DWORD Use lpc, within the above registry location.
Change the value from 1 to 0.
Restart the system.

Affected Products

File and Removable Media Protection 5.2.x
Install/Uninstall
Known Issue/Product Defect
Upgrade/Migrate

Languages:

This article is available in the following languages:

English United States
Spanish Spain
French
Italian
Portuguese Brasileiro

Knowledge Center

Unexpected increase in Event ID 2427 after upgrading to File and Removable Media Protection 5.2.x

Environment

Problem

System Change

Cause

Solution

Workaround

Affected Products

Languages:

Title

Title

Knowledge Center

Unexpected increase in Event ID 2427 after upgrading to File and Removable Media Protection 5.2.x

Environment

Problem

System Change

Cause

Solution

Workaround

Affected Products

Languages:

Choose your region

Title

Title