DLP Endpoint policies do not update after deploying or upgrading to 11.3.2.82 or later

Technical Articles ID: KB94604
Last Modified: 12/22/2021

Environment

McAfee Data Loss Prevention (DLP) Endpoint – 11.3.2.82 or later
Microsoft Windows – All supported versions

Problem

You have upgraded or deployed the DLPE agent (version 11.3.2.82 or later) to a Windows-based system. After the upgrade or install completes, DLPE policies do not update and the DLP console is not available from the McAfee Agent Manage Features menu.
The DLP Endpoint Agent under the system properties of the target system might not show as an installed product in the ePO System Tree.

The HDLP_AgentServiceWatchDog.log located in C:\ProgramData\McAfee\DLP\Temp\Logs\AgentService shows the below error messages:

[STARTUP][WinMain(352)]> Start HDLPAgentServiceWatchDog
[OERROR] [5388:5468] [MAServices.cpp:MAServicesImpl::on_logmessage] MA log [msgbus]: UV connect Failed - uv error <34> <no such file or directory>
[OERROR] [5388:5468] [MAServices.cpp:MAServicesImpl::on_logmessage] MA log [msgbus]: Connection Failed
[OWARNING] [5388:5468] [MAServices.cpp:MAServicesImpl::on_logmessage] MA log [msgbus]: Broker information is not available, rc <1>

Also, the HDLP_Agent.log located in C:\ProgramData\McAfee\DLP\Temp\Logs\<session number> shows the below error message:

[STARTUP][LogoffManager::open(68)]> LogoffManager OK!
[STARTUP][ProtectionMode::open(123)]> ProtectionMode OK!
[OWARNING] [Cpp Framework] [OMessageFileHandler::open] Error open file C:\ProgramData\McAfee\DLP\Agent\Policy\SCM.opg, error: 2
[ERROR][SystemConfigurationManager::readScmFile(670)]> Error opening SCM File: C:\ProgramData\McAfee\DLP\Agent\Policy\SCM.opg
[STARTUP][DisconnectAllAddins(1395)]> DISCONNECT_ADDIN_EVENT created
[STARTUP][SystemConfigurationManager::open(168)]> SystemConfigurationManager OK!

Lastly, the masvc.log located in C:\ProgramData\McAfee\Agent\logs shows the below error messages:

masvc(3264.4128) msgbus.Info: QueryFullProcessImageName C:\Program Files\McAfee\DLP\Agent\fcags.exe
masvc(3264.4128) msgbus.Info: verify code signature returns <-2146869243>, GetLastError <-2146869243>.
masvc(3264.4128) msgbus.Warning: Allowing <C:\Program Files\McAfee\DLP\Agent\fcags.exe(4068)> limited access onto msgbus
masvc(3264.4128) msgbus.Info: QueryFullProcessImageName C:\Program Files\McAfee\DLP\Agent\fcagswd.exe
masvc(3264.4128) msgbus.Info: verify code signature returns <-2146869243>, GetLastError <-2146869243>.
masvc(3264.4128) msgbus.Warning: Allowing <C:\Program Files\McAfee\DLP\Agent\fcagswd.exe(4868)> limited access onto msgbus

Cause

DLP Endpoint versions 11.3.2.82 and later include binaries that have been signed with a new SHA-1 and SHA-256 certificate.

The above error messages indicate an issue where McAfee Agent message bus is unable to validate the certificate used to sign the DLP Endpoint binaries. As a result, limited access to McAfee Agent message bus is provided, which results in the inability to update DLP Endpoint policies.
This issue is likely due to the root certificate store not being updated or missing the updated certificates.

Solution

For more details, see KB91697 - How to update your root certificate authorities for McAfee product installation/upgrade success.

Affected Products

Data Loss Prevention Endpoint 11.6.x
Data Loss Prevention Endpoint 11.4.x (EOL)

Languages:

This article is available in the following languages:

English United States
Spanish Spain
French
Italian
Portuguese Brasileiro

Knowledge Center

DLP Endpoint policies do not update after deploying or upgrading to 11.3.2.82 or later

Environment

Problem

Cause

Solution

Affected Products

Languages:

Title

Title

Knowledge Center

DLP Endpoint policies do not update after deploying or upgrading to 11.3.2.82 or later

Environment

Problem

Cause

Solution

Affected Products

Languages:

Choose your region

Title

Title