Release Notes

McAfee ePolicy Orchestrator 4.6.0

About this document
New features
Known issues
Additional information
Finding product documentation

About this document

Thank you for choosing this McAfee product. This document contains important information about the current release. We strongly recommend that you read the entire document.

ImportantWe do not support the automatic upgrade of a pre-release software version. To upgrade to a production release of the software, you must first uninstall the existing version.

New features

Here is a summary of the new and updated features included in this release of ePolicy Orchestrator software.

Simplified installation

Now you can choose the installation option that works best for your needs: Express, Custom, or Cluster. These options simplify the decisions needed to install your ePolicy Orchestrator software.

Guided Configuration

This version of the software introduces a Guided Configuration setup tool that streamlines the process of creating a managed environment. After installation, go to the Dashboards page to use the Guided Configuration tool to perform important tasks, including:

Selecting McAfee software to install and deploy to your network.
Selecting the systems your ePolicy Orchestrator server manages.
Configuring policies for your managed systems.

Improved security

Enhancements designed to improve security include:
Automatic notification about available product updates and patches in the Software Manager from the Automatic Responses feature.
Better task management. When using McAfee Agent 4.6, you can now:
Run any task immediately using the new Run Now feature.
Assign tasks to run in response to a query or event.
Assign tasks on an ad hoc basis.

Improved performance

Enhancements designed to improve performance include:
Reduced use of WAN bandwidth with SuperAgent repositories with McAfee Agent 4.6.
Improved event handling
Reduced Agent footprint with McAfee Agent 4.6

Software Manager

The Software Manager provides a single location within the ePolicy Orchestrator console where you can review and download McAfee software, software components, and documentation. It eliminates the need to access the McAfee download website separately for new McAfee software and updates. You can also configure notifications and automatic responses to inform you about and install updates and patches.

McAfee Agent deployment to Linux Red Hat 5.2 and Mac OS 10.5 or later

You can deploy the McAfee Agent 4.6 to client systems running Linux Red Hat version 5.2 and Mac OS X versions Leopard (10.5) and Snow Leopard (10.6) using the ePolicy Orchestrator user interface.

Client task catalog

Client tasks are now independent, reusable objects. As a result, you can:
Use the client task catalog to manage client task objects separately from their assignments and schedules.
Assign a single client task to multiple locations, each with a unique schedule.
Share client task objects across multiple registered ePolicy Orchestrator servers.
Import and export tasks to ensure consistency across your servers while reducing the effort to create a common environment.

Additionally, in this release you can run a client task on demand using the Run Client Task Now feature on systems where the McAfee Agent 4.6 is deployed. Similar to the existing Update Now feature, this action handles client tasks instead of software deployment. It is especially useful in performing troubleshooting tasks for individual or small sets of computers.

Tag-based policy assignment

Tag-based policy assignments simplify policy management. You can now use tags to assign policies. You no longer need to search the System Tree for elusive policy assignments. Tags can be used to assign policies from multiple products in one step based on business need or security status.

Dashboard enhancements

Dashboard management has been significantly streamlined and includes these enhancements:

A new Monitor Gallery from which you can drag and drop dashboard elements, configure options and refresh rates, and move and resize individual monitors.
The ability to share dashboards with groups of users, including the ability to share based on a specific permission set.
The option to configure default dashboard by permission sets.
The ability to import and export dashboards, and all associated queries.
Updated and expanded default dashboards.

Certificate-based authentication

ePolicy Orchestrator software fully supports certificate-based authentication, allowing more secure forms of system access. In addition, this authentication method integrates with Active Directory for ease of configuration.


You can now create detailed reports that contain multiple queries and images, configure reports to use run-time parameters to create report templates that are populated with different data sets at runtime, and customize reports on-demand or on a customized schedule.

Permission set enhancements

Three new permission set queries allow Global Administrators to easily view which users have been assigned which permissions. Permission sets can now be imported and exported.


McAfee ePO software now provides a Web API you can use to automate key ePolicy Orchestrator functionality. Use this feature to further customize and leverage ePolicy Orchestrator software in your managed environment.

Other usability enhancements

Other usability enhancements include:
Tabbed System Information page — The System Information page (formerly the System Details page) now includes three dashboard monitors that you can customize to display product specific information at a glance for the products each user is interested in.
Persistent table filters — You can now create custom filters on tables of data and save them per user.
Expanded drag and drop support — More places within the user interface now support drag and drop; including queries, agent repository selection lists, the System Tree, report designer, and dashboard editing pages.
Multi-select table rows — Now you can use "Shift + Click" to select or deselect multiple table rows.

Known issues

Here is a list of known issues that we were aware of at production time.

To view an updated list of issues associated with this release, see KB65773.

Installation issues

1Issue — When installing your ePolicy Orchestrator software in a different domain than your ePolicy Orchestrator SQL database server, might trigger a Network Error. (Reference: 629704)

Workaround — Provide the Fully Qualified Domain Name (FQDN) of your SQL server. For example, type SQLSERVER.MYDOMAIN.COM instead of SQLSERVER.

2Issue — During installation of your ePolicy Orchestrator server or remote Agent Handler installation a syntax error might occur if you use a username containing double-byte characters when the Visual C++ 2005 Redistributable is installed. This issue is caused when Windows creates temp directories during the install process. (Reference: 626759, 617731, 640743)
Workaround — You can use either of the following workarounds to prevent this issue:
Avoid using double-byte characters in usernames used for installation.
Modify the user's TMP and TEMP environment variables so they do not include double-byte characters.
3Issue — If you use double-byte characters in your SQL server login, an error occurs and the following message is displayed on the logon page:
The Apache service named reported the following error: 
>>> SSLCertificateFile: file 
'C:/Program Files/McAfee/ePolicy Orchestrator/Apache2/conf/
ssl.crt/ahcert.crt' does not exist or is empty
(Reference: 631079)

Workaround — Avoid using double-byte characters for your SQL server credentials.

Upgrade Issues

1Issue — When upgrading from the Leatherman release of ePolicy Orchestrator software (version 4.5 Patch 1), you must first upgrade to version 4.5 Patch 3, then upgrade to ePolicy Orchestrator software version 4.6. During the upgrade process, the Welcome tour dashboard monitor is removed. When the upgrade is complete, any dashboard monitor that references this tour displays an empty space where the tour monitor would appear. (Reference: 582216)

Workaround — There is currently no workaround for this issue.

2Issue — When upgrading to ePolicy Orchestrator software version 4.6 from version 4.5 Patch 3 with GroupShield for Domino version 7 installed, an error occurs and the following message is displayed on the logon page:
GSD7REPORTS - Error creating bean with 
GSD7REPORTS.type.registration: Invocation of 
init method failed; nested exception is 
Registered Type computer already exists.
(Reference: 584960)

Workaround — Acquire and check in the latest patch for GroupShield for Domino version 7, or remove the existing GSD7REPORTS extension from the Extensions page in the ePolicy Orchestrator 4.6 interface.

3Issue — When upgrading to ePolicy Orchestrator software version 4.6, some of the Issues Management permission settings for the Global Reviewer permission set are automatically set to View only from No permissions. (Reference: 646099,646158)

Workaround — After the upgrade is complete, you must manually reset these permission settings.

Agent communication issues

Issue — McAfee Agents version 4.6 cannot receive broadcast messages from version 4.5 or older SuperAgents. Additionally, version 4.5 or older agents cannot receive broadcast messages from version 4.6 SuperAgents. (Reference: 631922)
Workaround — You have three options to work around this issue:
Do not use the 2048 bit key as the Master Key for Agent-server secure communication. To change this setting, in the ePolicy Orchestrator console click Menu | Configuration | Server Settings and edit the Security Keys settings category to use a different license key.
Use two SuperAgents on each of your subnets; one using a version 4.5 agent, another using a version 4.6 agent.
Upgrade your agents to version 4.6.

Agent Handler issues

Issue — On the Agent Handler page, the Inactive Handler monitor displays the number of disabled Agent Handlers, instead of inactive Agent Handlers. (Reference: 640648)

Workaround — There is currently no workaround for this issue. However, you can run the Agent Handler Status query from the Queries page to view the number of inactive Agent Handlers.

NoteA disabled Agent Handler is one that has not been enabled yet. An inactive Agent Handler is one that has been enabled, but has not communicated with the server with in five minutes. However, the Agent Handler Status query reports Agent Handlers as inactive when the handler has been out of contact for 60 minutes or more.

Registered Server issues

Issue — In an IPv6 only environment, the option to register an Active Directory server using the DNS name is not successful. (Reference: 568902)
Workaround — Use the Server Name option to specify the server name or IPv6 address to register the server.
NoteWhen using the IPv6 address, the address must be wrapped in brackets to successfully register the server. For example, [3ffe:1900:4545:3:200:f8ff:fe21:67cf]. (Reference: 569929).

Client Task issues

Issue — Systems where the version 4.6 non-Windows McAfee Agent is deployed appear in the Run Client Task Now page Affected Systems list even though this feature is not supported for use with non-Windows agents. (Reference: 632013)

Workaround — There is currently no workaround for this issue.

Server Task issues

1Issue — When a server task that includes the Deploy McAfee Agent actions is exported, authentication information is saved in the export XML file in plain text. (Reference: 642466)

Workaround — There is currently no workaround for this issue.

2Issue — When creating a Data roll up report Server Task using Internet Explorer (IE), you might not be able to chain multiple tasks to include additional data types. The inability to chain multiple tasks is caused by IE Enhanced Security Configuration (ESC), which is enabled by default on Windows Server 2003 and 2008. (Reference: 630107)

Workaround — To enable the ability to chain these tasks on Windows Server 2003 you must uninstall the IE ESC using the Add or Remove Programs feature. On Windows Server 2008 you can disable IE ESC using the Server Manager utility. For more information on how to perform either of these tasks, refer to your Microsoft Windows Server documentation.

3Issue — Server task completion times and durations in the task scheduler might be reported incorrectly. This can occur when there is a discrepancy between the time reported by your ePolicy Orchestrator server and the time reported by your database server. (Reference: 648553)

Workaround — Synchronize your ePolicy Orchestrator server and database server to the same time service. For more information on synchronizing the time reported by a Windows server, see the Microsoft documentation, including KB article

Software Manager issues

Issue — The Software Manager cannot update an existing version of McAfee® VirusScan® Enterprise 8.7 software. (618551)

Workaround — You must Check In the VirusScan Enterprise 8.7 product updates manually.

Import/Export issues

1Issue — Some unicode characters are not displayed in exported PDF reports. (Reference: 623698)

Workaround — Add the arialuni.ttf font file to your font directory. This font is included with most Microsoft Office Suites. If you do not have this font, you can download it here:

2Issue — Importing McAfee Agent repository policies into a version 4.6 ePolicy Orchestrator server from a version 4.0 or 4.5 server does not overwrite existing policies already on the 4.6 server with duplicate names. (Reference: 541623)

Workaround — Backup your existing agent repository policies by exporting a copy from your 4.6 server before importing the agent policies from an earlier version of the software. After importing the policies, manually verify that no unintended changes have been made to the existing "Repository" policies. If changes have occurred, use the backup you created to restore those policies.

3Issue — Importing a .zip file containing more than one security key causes an Invalid key file error to occur, and the import process cannot be completed. (Reference: 636752)
Workaround — You can only import one set of security keys at a time. You can workaround this issue using either of the following options:
Extract the contents of the .zip file containing multiple security keys to a temporary location, then add each key to a new .zip file and import them individually.
Export your security keys one at a time, and then import them individually.
4Issue — Importing a password protected .zip file causes an Unexpected Error to occur, and the import process cannot be completed. (Reference: 636752).

Workaround — Export your data without adding a password to the .zip file, then repeat the import.

5Issue — Including non-ASCII characters in a password when exporting a .zip file causes the delivery of an inaccurate error message: "Unable to extract files with the provided password." However, the error is actually caused by the use of non-ASCII characters in the password. (Reference: 635266)

Workaround — Do not use non-ASCII characters when specifying a password while exporting to a .zip file.

Browser issues

Issue — When using Internet Explorer (IE) 7, some Dashboards might become unresponsive, and cause your browser session to hang. Restarting your browser session does not resolve the issue, because when you reopen the ePolicy Orchestrator console, the same dashboard is displayed, and your session hangs again. This occurs because, by default, IE 7 imposes a limit of two concurrent connections to a server. (Reference: 646156)

Workaround — To workaround this issue, you can configure IE to allow more concurrent connections by modifying the IE MaxConnectionsPerServer registry key. For more information on modifying this registry key, see Microsoft KB article or McAfee KB71159.

Usability issues

1Issue — Using the "Shift + Click" feature to select more than 1,500 rows in a table simultaneously might cause a spike in CPU utilization and/or trigger an error message describing a Script error. (Reference: 637829)

Workaround — Limit the number of table rows you select using "Shift + Click."

2Issue — If both the ePolicy Orchestrator console and help portal are open, and the help portal browser session times out, you're console browser session might time out as well. (Reference: 620064)

Workaround — To workaround this issue, you must close both browser windows and log in to the server console again.

Managed Product issues

Issue — McAfee Firewall Enterprise ePolicy Orchestrator Extension 5.0 is not supported on ePolicy Orchestrator software version 4.6 (649181)
Workaround — Take the following steps to workaround this issue:
1Uninstall the McAfee Firewall Enterprise ePolicy Orchestrator Extension 5.0 from your ePolicy Orchestrator server before you begin your upgrade.
2Upgrade to ePolicy Orchestrator software version 4.6
3Install Firewall Enterprise ePolicy Orchestrator Extension 5.1.0
NoteFor more information on this task, see the McAfee Firewall Enterprise documentation, or the section in these release notes titled Additional information; Important upgrade information about your managed products and ePolicy Orchestrator software 4.6 .

Additional information

Review this section for important, additional information about this product release.

Important upgrade information about your managed products and ePolicy Orchestrator software 4.6

When upgrading your ePolicy Orchestrator software to version 4.6, some of your managed products require special consideration. For details on these managed products, and what steps to take when upgrading your server, see McAfee KB71259.

About LDAP configuration and chase referrals

The following LDAP registered server configurations are supported in environments with parent and child domains:
The parent and child domains are used without chasing referrals.
Chasing referrals is enabled only on the parent domain.

About using ePolicy Orchestrator software with Internet Explorer Enhanced Security enabled

Accessing the ePolicy Orchestrator console using Internet Explorer (IE) with IE Enhanced Security enabled might prevent some content from loading correctly. If you are using IE with this feature enabled, add your ePolicy Orchestrator site to the IE Trusted Sites list to ensure that you can view all content correctly.

About agent reporting in a cluster environment

In a Microsoft Server cluster environment managed by an ePolicy Orchestrator server, agent communications might report the cluster IP address instead of the node IP address. This can cause a problem if the active node fails over and a passive node becomes active. In this scenario, when the node that failed over comes back online in the passive state, the ePolicy Orchestrator server can no longer communicate with that node because it has the wrong IP address. This issue is resolved during the next agent-server communication, when the correct IP address is reported back to the server.

About registered remote databases

ePolicy Orchestrator software 4.6 enables you to register and then query against remote databases used by other ePolicy Orchestrator managed products in your environment. To use this feature, you must check in a managed product extension that has a predefined database schema. Once a managed product that supports this feature is checked in, the option to register a remote database server automatically appears in the Registered Server builder wizard's server type drop down menu. For more information on the availability of additional supported database schemas, see your managed product documentation.

About rollup reports from legacy ePolicy Orchestrator

ePolicy Orchestrator software version 4.6 fully supports rollup reporting from version 4.0 and 4.5 registered servers. When configuring your rollup reporting tasks on these supported legacy ePolicy Orchestrator servers, you must ensure that you specify only those data types supported for that particular server version. Use the following table as a reference to confirm which data types can are supported for roll up reports on each version of ePolicy Orchestrator software.

Supported roll up data types by ePolicy Orchestrator software version
Data type v4.6 v4.5 v4.0
Applied Client Tasks X    
Applied Policies X X  
Client Events X X  
Compliance History X X X
Managed Systems X X X
Threat Events X X  

Finding product documentation

McAfee provides the information you need during each phase of product implementation, from installation to daily use and troubleshooting. After a product is released, information about the product is entered into the McAfee online KnowledgeBase.

1 Go to the McAfee Technical Support ServicePortal at
2 Under Self Service, access the type of information you need:
To access... Do this...
User documentation
1Click Product Documentation.
2Select a Product, then select a Version.
3Select a product document.
Click Search the KnowledgeBase for answers to your product questions.
Click Browse the KnowledgeBase for articles listed by product and version.