Hi,

I've added McAfee antivirus sensors for all our desktops. The status of all sensors McAfee Host Intrusion Prevention Firewall (Firewall) are "McAfee Host Intrusion Prevention Firewall out of date, on access scan running". This is quite strange as McAfee ePolicy Orchestrator shows that all components on all computers are up to date. Could you please explain what version number it uses to compare with desktops, where it comes from? Where I can find its value?

Thanks, Sergey Tchemchit

Article Comments

PRTG gets the Anti-Virus status from WMI so you would need to check why the Windows Security Center is reporting that the software is out of date.


Feb, 2014 - Permalink

Is it possible that PRTG incorrectly interprets WMI response?


Feb, 2014 - Permalink

Please try and run this query "SELECT * FROM FirewallProduct" with the Namespace root\SecurityCenter2 with the WMI Tester and post the results here.


Feb, 2014 - Permalink

displayName;instanceGuid;pathToSignedProductExe;pathToSignedReportingExe;productState McAfee Host Intrusion Prevention Firewall;{959DA8E2-3527-57D1-4915-924367AD4FE9};"";C:\Program Files\McAfee\Host Intrusion Prevention\FireSvc.exe;266256


Feb, 2014 - Permalink

I've found the reason - McAfee ePO has Patch 3 for Host Intrusion Prevention Firewall, but it supports Windows 8 and Server 2012 operating systems only, while I have Windows 7 computers with Patch 2.

Sorry for disturbing.


Feb, 2014 - Permalink

Glad you were able to find the patch :) and we are always glad to help out with issues such as these.


Feb, 2014 - Permalink

Thanks :)


Feb, 2014 - Permalink