Tuesday, October 22, 2013

Solved: McAfee epo services not starting, error 7024 ID in event viewer

12:41 AM Miraclesoul 39 comments

Issue:
McAfee epo 4.6.3 services were not starting, 7024 ID was seen in logs

Reading the error 7024 description it says that apache server is unable to listen to socket, means port 80 i used by someone. So i quickly disabled my IIS service and SQL Reporting Service , tried to restart McAfee ePO services and all came up seemlessly.

Solution:
1. DISABLE WORLD WIDE WEB PUBLISHING SERVICE (IIS service)
2. DISABLE SQL REPORTING SERVICE (As it uses IIS at some points)

SOLVED: McAfee ePO requires 8.3 naming to be enabled

11:59 PM Miraclesoul 4 comments

McAfee ePO requires 8.3 naming to be enabled

Click Start, Run, type regedit and click OK.
Navigate to:

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\FileSystem]
Change the NtfsDisable8dot3NameCreation value to 0.
Restart the server.

and you are done :)

ePO server backup and disaster recovery procedure

10:37 PM Miraclesoul 16 comments

ePO server backup and disaster recovery procedure
The following detail has been taken from McAfee knowledge base as a handy link for backup and recovery

Reference: https://kc.mcafee.com/corporate/index?page=content&id=KB66616

Environment

McAfee ePolicy Orchestrator (ePO) 5.x, 4.x

For details of all supported operating systems, see KB51109.

Solution

IMPORTANT:

This procedure is intended for use by network and ePO administrators only. McAfee does not assume responsibility for any damage incurred because they are intended as guidelines for disaster recovery. All liability for use of the following information remains with the user.
The procedure is for use with ePO 4.5, 4.6, and 5.x servers only. For ePO 5.x users, it is preferable to use the built-in Disaster Recovery feature and only use these steps if a valid Snapshot was not created and a manual recovery is required.
The Operating System (OS) must be the same if you are going to re-install the OS.
You must reinstall ePO to the exact same directory path as the previous installation or initialization of extensions will fail when the restore is complete. See KB70685 for a Product Management statement regarding this limitation.

NOTES:

The Agent uses either the last known IP address, DNS name, or NetBIOS name of the ePO server. If you change any one of these, ensure that the Agents have a way to locate the server. The easiest way to do this would be to retain the existing DNS record and change it to point to the new IP address of the ePO server. After the Agent is able to successfully connect to the ePO server, it downloads an updated SiteList.xml with the current information.
The procedure can also be used by customers who want to migrate the ePO server to another system. For ePO 5.x users, it is preferable to use the built-in Disaster Recovery feature to migrate the ePO server to another system.

Preparation
To ensure a smooth recovery, do not perform a backup while the server is in the middle of installing an extension.

Before backing up

If possible, shut down the McAfee ePolicy Orchestrator Application Server service (Tomcat) entirely when doing the backup. Otherwise, ensure that no one is performing the following actions during the backup:

Installing, uninstalling, or upgrading an extension
Updating the ePO database configuration

Backing up1. Use the following to back up the SQL database (normally named ePO4_, where the is your ePO 4.5 / 4.6 server name):

See article KB59562 - How to back up the ePO database using OSQL commands, or KB52126 - How to back up and restore the ePO database using Enterprise Manager/ Management Studio.
SQL Enterprise Manager

2. You must also backup the following folder paths (the default installation path is used - your installation might differ):

C:\Program Files\McAfee\ePolicy Orchestrator\SERVER\
All installed extensions and configuration information for the ePO Application Server service is found here.

NOTE: If you want to reduce the number of items to back up from the \SERVER folder backup, consider excluding onlythe following:

C:\Program Files\McAfee\ePolicy Orchestrator \server\logs (server log files)

C:\Program Files\McAfee\ePolicy Orchestrator\server\cache (Contains cached information that ePO creates and uses, such as generated chart images. ePO will regenerate that information, if deleted.)

C:\Program Files\McAfee\ePolicy Orchestrator\server\work (Contains cached information about web applications registered with Tomcat. Tomcat will regenerate that information, if deleted.)

C:\Program Files\McAfee\ePolicy Orchestrator\DB \SOFTWARE\All Products that have been checked into the Master Repository are located here.

C:\Program Files\McAfee\ePolicy Orchestrator\DB \KEYSTORE\The Agent to Server Communication and Repository Keys that are unique to your installation are located here. Failing to restore this folder results in re-pushing the agent to all your systems, and checking in all of your deployable packages again.

C:\Program Files\McAfee\ePolicy Orchestrator\APACHE2\CONFThe Server configuration settings for Apache, the SSL Certificates needed to authorize the server to handle agent requests, and Console Certificates are located here. Failure to back up and restore this directory results in a re-installation of ePO to create new ones and possibly using a clean database installation.

Recovery

Delete the ePO database on the SQL server.
If you do not know how to perform the MSSQL operation, refer to http://technet.microsoft.com/en-us/library/ms177419.aspx or contact Microsoft Support.
If restoring ePO to the same system, uninstall ePO. Ensure that there is no ePolicy Orchestrator folder in the original install path after the software is uninstalled.

NOTE: Renaming the existing ePolicy Orchestrator folder and leaving the old directory in place may interfere with the new installation. McAfee recommends that you remove the old directory completely.
Reinstall ePO to the same version and patch level as the server you are restoring.

NOTE: You can verify the ePO patch level by looking at the Version field in the backed up Server.ini file (C:\Program Files\McAfee\ePolicy Orchestrator\DB\) and cross referencing it with article KB59938 - Version information for ePolicy Orchestrator.

IMPORTANT: You must reinstall ePO to the exact same directory path as the previous installation or initialization of extensions will fail when the restore is complete. Also, you do not have to specify the same port configuration except for the database. The ports are restored to the previous installation values during the restore.
Apply any additional patches/hotfixes/POCs to ePO that had been previously applied.

For ePO 4.x:- If you have previously installed Policy Auditor 5.x for use with ePO, install the same version of Policy Auditor (including the hotfix release) that had been installed before.
- If you have previously installed McAfee NAC 3.x or McAfee NAC 4.0 for use with ePO, install the same version of McAfee NAC (including the hotfix release) that had been installed before.

For ePO 5.x: - If you have previously installed Policy Auditor 6.2 for use with ePO, install the same version of Policy Auditor (including any hotfix releases) that had been installed before.
After installing, stop and disable all ePO services:
1. Click Start, Run, type services.msc, and click OK.
2. Right-click each of the following services and select Stop:
  
  McAfee ePolicy Orchestrator Application Server
  McAfee ePolicy Orchestrator Event Parser
  McAfee ePolicy Orchestrator Server
3. Double-click each of the following services and change Startup type to Disabled:
  
  McAfee ePolicy Orchestrator Application Server
  McAfee ePolicy Orchestrator Event Parser
  McAfee ePolicy Orchestrator Server
Restore the database.

NOTE: Restore the database so that you do not require the ePO database configuration to be updated (for example: same name, host, port, and so on). Otherwise, you must update the restored DB.PROPERTIES file in C:\Program Files\McAfee\ePolicy Orchestrator \server\conf\Orion with the new information before starting up the server.
Delete the following folders, then replace them with the corresponding folders that were backed up earlier:

C:\Program Files\McAfee\ePolicy Orchestrator\SERVER\
C:\Program Files\McAfee\ePolicy Orchestrator\APACHE2\CONF
C:\Program Files\McAfee\ePolicy Orchestrator\DB \SOFTWARE\
C:\Program Files\McAfee\ePolicy Orchestrator\DB \KEYSTORE\
Before you enable and start the ePO services, ensure that the contents (version numbers) of the C:\Program Files\McAfee\ePolicy Orchestrator\server\extensions\installed folder match the extensions listed in theOrionExtensions table.

To check the contents of the OrionExtensions table, access the SQL Tools and run the following T-SQL command:

Select * from OrionExtensions

If there is a mismatch on server startup, the server removes each extension not listed in the OrionExtensions table. If this happens, check in these extensions again and also restore the database again.
Start the McAfee ePolicy Orchestrator Application Server service.

NOTE: You must start this service for RunDllGenCerts to work.
Rename the SSL.CRT folder (see path below) to SSL.CRT.OLD and manually create an empty folder named SSL.CRT in the same path, otherwise the setup will fail to create a new Cert:

32-bit: "C:\Program Files\McAfee\ePolicy Orchestrator\APACHE2\CONF\SSL.CRT"
64-bit: "C:\Program Files (x86)\McAfee\ePolicy Orchestrator\APACHE2\CONF\SSL.CRT"
Click Start, Run, type cmd, and click OK.
Change directories to your ePO installation directory.

Default path:

32-bit: Program Files\McAfee\ePolicy Orchestrator\
64-bit: Program Files (x86)\McAfee\ePolicy Orchestrator\
Run the following command:

IMPORTANT: - This command will fail if you have enabled User Account Control (UAC) on this server. If this is a Windows Server 2008 or later, disable this feature. You can find more information about UAC at: http://technet.microsoft.com/en-us/library/cc709691(WS.10).aspx.
- This command is case-sensitive. The ahsetup.log (found in ) provides information about whether the command succeeded or failed and will state if it used the files located in the ssl.crt folder

Rundll32.exe ahsetup.dll RunDllGenCerts <"installdir\Apache2\conf\ssl.crt">

where:

is your ePO server's NetBIOS Name
is your ePO Console Port (default is 8443)
is admin (use the default ePO admin account)
is the password to the ePO Admin console account
is your installation path to the Apache folder; Default installation path:

32-bit: "C:\Program Files\McAfee\ePolicy Orchestrator\APACHE2\CONF\SSL.CRT"
64-bit: "C:\Program Files (x86)\McAfee\ePolicy Orchestrator\APACHE2\CONF\SSL.CRT"

Example:Rundll32.exe ahsetup.dll RunDllGenCerts eposervername 8443 administrator password "C:\Program Files\McAfee\ePolicy Orchestrator\APACHE2\CONF\SSL.CRT"
Start the following services:

McAfee ePolicy Orchestrator Event Parser
McAfee ePolicy Orchestrator Server
Look in the DB/logs/server.log to ensure that the Agent Handler (Apache server) started correctly. It should state something similar to the following:

20090923173647 I #4108 NAIMSRV ePolicy Orchestrator server started.
If it does not, there will be an error similar to:

20090923173319 E #4736 NAIMSRV Failed to get server key information.

Related Information

KB75497 - ePO Cluster Backup and Disaster Recovery procedure
KB77214 - Package corrupt, signature position calculated is not within package (issue: mismatched keystore certificates)

Zipping large and alot of files using command line

6:12 AM Miraclesoul No comments

I was trying to zip a zen cart site, it was of quite large size, i did everything other thing to zip it but wasnt possible, at the end of the day it turned out to be that files were not successfully zipped and not all files were there leading to situation where the zip file was corrupt.

so i used 7zip a zipping utility, DONOT use its gui, its not worth in this case, as i tried to do it with gui alot many times.

1. Go to the program files where 7zip is installed.

2. Go to the directory where it shows that there is a "7z.exe" file in the folder.

3. Open command prompt with RUN AS ADMINISTRATOR privileges

4. CD to the directory where the 7zip is installed

5. Run the following command.

7z a -tzip "E:\software_pee.zip" "E:\folder_to_zip"

WHERE:

"E:\software_pee.zip"
Is the zip file that will be created in E drive, you can use your own path

"E:\folder_to_zip"
Folder name that needs to be zipped, in my case it was in E drive.

After zip i found out that the entire site for some reason was of 21 GB , wonder what was in it :)

Thanks

Default SVCHOST.exe associated services, users and processes

3:11 AM Miraclesoul 11 comments

Default SVCHOST.exe associated services, users and processes

Svchost.exe

Some time ago, Microsoft started moving all of the functionality from internal Windows services into .dll files instead of .exe files. From a programming perspective this makes more sense for reusability… but the problem is that you can’t launch a .dll file directly from Windows, it has to be loaded up from a running executable (.exe). Thus the svchost.exe process was born.

Why Are There So Many svchost.exes Running?

If you’ve ever taken a look at the Services section in control panel you might notice that there are a lot of services required by Windows. If every single service ran under a single svchost.exe instance, a failure in one might bring down all of Windows… so they are separated out.

Those services are organized into logical groups, and then a single svchost.exe instance is created for each group. For instance, one svchost.exe instance runs the 3 services related to the firewall. Another svchost.exe instance might run all the services related to the user interface, and so on. (htt1)

List of process, Service, Description and Users

S#	Process	Services	Description	Users
1	Svchost.exe	power	power	system
		PlugPlay	Plug and play	system
		DcomLaunch	Dcom server process launcher	System
2	Svchost.exe	RpcSs	Remote procedure calls	Network service
		RpcEptMapper	RPC Endpoint mapper	Network service
3	Svchost.exe	wscsvc	Security center	LocalServiceNetworkRestrict
		lmhost	TCO/IP NetBIOS helper	LocalServiceNetworkRestrict
		Event log	Window event log	LocalServiceNetworkRestrict
		Dhcp	DHCP client	LocalServiceNetworkRestrict
		Audiosrv	Window audio	LocalServiceNetworkRestrict
4	Svchost.exe	UxSms	Desktop Window Manager Session Manager	LocalSystemNetworkRestrict
		UmRdpService	Remote Desktop Services User Mode Port Redirector	LocalSystemNetworkRestrict
		TrkWks	Distributed link tracking client	LocalSystemNetworkRestrict
		TableInputService	Tablet PC Input Service	LocalSystemNetworkRestrict
		SysMain	SuperFetch	LocalSystemNetworkRestrict
		PcaSvc	Program Compatibility Assistance service	LocalSystemNetworkRestrict
		Netman	Network Connection	LocalSystemNetworkRestrict
		CScService	Offline Files	LocalSystemNetworkRestrict
5.	Svchost.exe	wuauserv	Window update	system
		Winmgmt	Window Management Instrumentation	system
		Themes	themes	system
		ShellHWDetection	Shell hardware Detection	System
		SessionEnv	Remote desktop configuration	system
		SENS	System Event Notification	system
		Schedule	Task Schedule	system
6.	Svchost.exe	WdiServiceHost	Diagnostic Service Host	Local Services
		W32Time	Window Time	LocalServices
		sppuinotify	SPP Notification Service	LocalServices
		nsi	Network Store InterFace Service	LocalServices
		netprofm	Network List Service	LocalServices
		EventSystem	COM+Event System	LocalService
7.	Svchost.exe	Remote Desktop Services	Remote Desktop Services	NetworkService
		NlaSvc	Network Location Awarness	NetworkService
		LanManWorkstation	workstation	NetworkService
		Dnscache	DNS client	NetworkService
		CrypSvc	Cryptographic Services	NetworkService
8	Svchost.exe	FontCache	Window Font Cache Service	NetworkService
9	Svchost.exe	MpsSvc	Window Firewall	LocalServiceNoNetwork
		DPS	Diagonastic Policy Service	LocalServiceNoNetwork
		BFE	Base Filtering Engine	LocalServiceNoNetwork
10	Svchost.exe	SDRSVC	Windows Backup	system
11	Svchost.exe	Policy Argent	IPsec Policy Agent	LocalSystemNetworkRestrict