Mcafee/Trellix EPO 5.10.0 Service Pack Repost 1, 4098, fails to install and rollback

Update to 5.10.0 Service Pack 1 BUILD 4098

There is an issue with EPO 5.10.0 Service Pack 1 RE-Post.

We have seen some EPO 5.10.0 Service Pack 1 gone through smooth and some larger EPO fail. Trellix member CDINET from Trellix Forum stated a tip how to install sucessfully.

Here is how to solve the update. Worst the MSI Installer rollback does not work and keeps the EPO in a state of not working. Thus it is important to have a Hypervisor FALLBACKUP or VEEAM if this fails.

Make sure you install all PRE SP1 Updates UP TO “ePO_5.10.0_Update_15” (This are add. steps and we asume your ARE at level UPD15 already for the SP1). Please see Trellix KB

On how to get to those Patche Update 15 Level.

Process to patch EPO 5.10 to latest Service Pack 1 from 5.10 UP15 succesfully:

Backup all you have because we have a high % this will fail. It’s re-post Patch they already took back once.

Turn off/Shutdown all Mcafee/Trellix machines you have (EPO, DXL, Broker, TIE etc.)

Logon to TIE and DXL broker Console or SSH and use “shutdown –f 1”

Make a VM Snapshot for disaster fallback. The snapshot should be OFF and at same time because of DXL (If you use DXL)

Start all VM machines

On EPO Server disable the two WMI related Services

1. WMI Performance Adapter (ENG) or WMI-LeistungsadapterService (DEU) name “wmiApSrv”
2. Windows Management Instrumentation (ENG) or “Windows Verwaltungsinstrumentation” (DEU) or Service name “Winmgmt”

Reboot the EPO Server

Install SP1 will be success

Change back the two WMI Services as seen in Screenshot

Services before:

change to disabled/deaktiviert:

Reboot once

Check Events

Change back the Services like they where before

Services before:

If you want to 100% sure check the Logs