Service RequestsClean Install
McAfee defines a clean installation as a deployment where there are no elements of McAfee software pre-existing on the endpoint. See “Upgrades” if there is pre-existing software.
Review the Supported Environments documentation to ensure that the environment is compatible before deploying McAfee Endpoint Security:
- Supported platforms, environments, and operating systems for Endpoint Security for Windows
- Supported platforms, environments, and operating systems for Endpoint Security for Linux Threat Prevention
- Supported platforms, environments, and operating systems for Endpoint Security for Mac
Review Reference Configurations, which are deployment scenarios that have undergone extensive testing to ensure proper sequencing and improve ease of execution. Each Reference Configuration document contains a product mix that has been validated to work together properly for a specific type of customer profile. Review the following article to learn more and find the applicable Reference Configuration:
Review the guides below for information about how to install McAfee Endpoint Security and for additional details regarding system requirements.
Note: All McAfee Endpoint Security module features are enabled by default.
- McAfee Endpoint Security for Windows 10.7 - Installation Guide
- McAfee Endpoint Security for Linux 10.6.6 - Installation Guide
- McAfee Endpoint Security for Mac 10.6.5 - Installation Guide
In the event an issue is encountered during installation, see the following documentation:
- How to troubleshoot an Endpoint Security installation failure
- Third-party DLL injectors, code detours, and hooking
- Data collection steps for troubleshooting Endpoint Security issues
Upgrade
McAfee defines an upgrade as a deployment where a version of McAfee Endpoint Security already exists on the endpoint. See “Migration” if legacy McAfee software (McAfee VirusScan Enterprise, McAfee Host Intrusion Prevention, and McAfee SiteAdvisor Enterprise) already exists on the endpoint.
Review the Supported Environments documentation to ensure that the environment is compatible before deploying McAfee Endpoint Security:
- Supported platforms, environments, and operating systems for Endpoint Security for Windows
- Supported platforms, environments, and operating systems for Endpoint Security for Linux Threat Prevention
- Supported platforms, environments, and operating systems for Endpoint Security for Mac
Use the McAfee Endpoint Upgrade Assistant (EUA) to automate the upgrade process. The EUA analyzes the endpoints in your McAfee ePO environment, detects the supported McAfee products that are installed, and determines the minimum security requirements for upgrading to the current product versions. These steps ensure a successful upgrade.
- Introduction to Endpoint Upgrade Assistant
- Endpoint Upgrade Assistant Product Guide
- Endpoint Upgrade Assistant Demonstration
In the event an issue is encountered during upgrades, see the following documentation:
Migrate
McAfee defines migration as a deployment where one or more legacy McAfee products (McAfee VirusScan Enterprise, McAfee Host Intrusion Prevention, and McAfee SiteAdvisor Enterprise) already exist on the endpoint where McAfee Endpoint Security will be deployed.
Review the Supported Environments documentation to ensure that the environment is compatible before deploying McAfee Endpoint Security:
- Supported platforms, environments, and operating systems for Endpoint Security for Windows
- Supported platforms, environments, and operating systems for Endpoint Security for Linux Threat Prevention
- Supported platforms, environments, and operating systems for Endpoint Security for Mac
You can also use the Endpoint Upgrade Assistant (EUA) to migrate from legacy McAfee products. The EUA analyzes the endpoints in your McAfee ePO environment, detects the supported McAfee products that are installed, and determines the minimum security requirements for upgrading to the current product versions. These steps ensure a successful migration.
- Introduction to Endpoint Upgrade Assistant
- Endpoint Upgrade Assistant 2.4.0 Product Guide
- Endpoint Upgrade Assistant Demonstration
- Endpoint Security Upgrade Project Planning Guide
- Endpoint Security 10.7.0 Installation Guide (ePO managed)
The Endpoint Security Trust Model is a new security model that differs from legacy McAfee products. As a result, migrated legacy policies might not align with McAfee Endpoint Security best practices (see “Configuration & Best Practices”). McAfee strongly recommends that migration is used as an opportunity to review current policies and configuration.
Note: All McAfee Endpoint Security module features are enabled by default.
See the following documentation for information about configuration and best practices for policies with McAfee Endpoint Security:
- How to improve performance with Endpoint Security
- Consolidated list of Endpoint Security exclusion articles
- How to use wildcards when creating exclusions in Endpoint Security Threat Prevention
In the event an issue is encountered during migration, see the following documentation:
Configuration & Best Practices Updated
The default settings for McAfee Endpoint Security typically require additional configuration and tuning for most environments.
Note: All McAfee Endpoint Security module features are enabled by default.
To get acquainted with the software, review the documentation below:
Product guides:
- McAfee Endpoint Security for Windows 10.7.x - Product Guide
- McAfee Endpoint Security for Linux 10.7.x - Threat Prevention Product Guide
- McAfee Endpoint Security for Linux 10.7.x - Firewall Product Guide
- McAfee Endpoint Security for Mac 10.6.5 - Threat Prevention Product Guide
- McAfee Endpoint Security for Mac 10.6.5 - Firewall Product Guide
The McAfee Endpoint Security Trust Model is a new security model that differs from legacy McAfee products. As a result, migrated legacy policies might not align with McAfee Endpoint Security best practices. McAfee strongly recommends that adopting McAfee Endpoint Security is used as an opportunity to review current policies and configuration.
- Best practices for on-demand scans in Endpoint Security
- List of and best practices for Endpoint Security Dynamic Application Containment rules
See the following documentation about policy optimization:
- How to improve performance with Endpoint Security
- Consolidated list of Endpoint Security exclusion articles
- How to use wildcards when creating exclusions in Endpoint Security Threat Prevention
- Endpoint Security Web Control browser extensions must be enabled by the end user
- How to verify that Real Protect is installed correctly and that endpoints can communicate with the McAfee cloud for detections
Supplemental Documentation
Latest known issues:
- Endpoint Security for Windows 10.x
- Endpoint Security Adaptive Threat Protection for Windows 10.x
- Endpoint Security for Linux Threat Prevention 10.x
- Endpoint Security for Mac 10.x
- Endpoint Security for Mac Adaptive Threat Protection 10.x
Frequently used troubleshooting articles:
- How to troubleshoot an Endpoint Security installation failure
- How to improve performance with Endpoint Security
- How to troubleshoot high CPU usage by the McAfee real-time anti-malware scanner for Endpoint Security
- Data collection steps for troubleshooting Endpoint Security issues
- How to troubleshoot when Endpoint Security blocks third-party applications
- Third-party DLL injectors, code detours, and hooking
- Endpoint Security Natural Language String event messaging index
Root Certificate Expiration
The McAfee product line uses TLS for secure communication. Two certificates validate McAfee TLS chains, including a primary expiring in 2038 and a secondary expiring on May 30, 2020. If either certificate, or both, are present in your environment, TLS will function correctly prior to May 30, 2020. After May 30, 2020, only the primary certificate will be valid. Out of an abundance of caution McAfee is informing customers of this impending event.
Generally, certificates are auto-updated through operation systems and customers will not be impacted. However, in environments where automatic management of root certificates is disabled and the primary certificate has not been manually deployed, customers will potentially be impacted. KB92937 provides information on how to verify and install the primary certificate.
Failure to have a valid certificate will cause product issues including reduced detection efficacy.
The primary certificate that needs to be validated is in a customer's environment as below:
Subject : CN=USERTrust RSA Certification Authority, O=The USERTRUST Network, L=Jersey City, S=New Jersey, C=US
Thumbprint : 2B8F1B57330DBBA2D07A6C51F70EE90DDAB9AD8E
Expiration : 2038-01-18
Subscribe to KB92937 to receive updates.