Total Protection for Small Business fails to update on Domain Controllers when no users are logged in.
--------------------------------------------------------------------------------
Account lockout errors are generated for McAfeeMVSUser on domain controllers.
--------------------------------------------------------------------------------
The following error is displayed in the Windows System Event Viewer:
DCOM Error Event ID 10001 / 10004: Unable to start a DCOM Server: {427D6FE2-4FA4-B65C-AC7E2VF0B976} as ./ McAfeeMVSUser. The Error: "Access is denied." Happened while starting this command: "C:\Program Files\McAfee\Managed VirusScan\Agent\MyUsrSrv3.5.0.exe" -Embedding
--------------------------------------------------------------------------------
The following error is displayed in the Windows Security Event Viewer:
Security 529 Logon Failure:
Reason: Unknown user name or bad password
User Name: McAfeeMVSUser
--------------------------------------------------------------------------------
The following event 10004 error is logged on the domain controllers:
DCOM got error "Logon failure: user account restriction. "and was unable to logon .\McAfeeMVSUser in order to run the server:{2242B406-90A2-4EF9-BC19-492D477F7914}
Solution
A user account with sufficient permissions to update must be logged in to the Domain Controller to allow Managed VirusScan / Total Protection for Small Business to update.
--------------------------------------------------------------------------------
Solution 1
To disable the McAfeeMVSUser account for the Domain Controller, use the following steps.
First, create a new group for the Domain Controller:
Log in to http://www.mcafeeasap.com.
At the top of the page, click Groups + Policies.
Click Add Group, type a name for the new group (example: Domain Controller), then click Save.
Next, create a new Policy to disable the McAfeeMVSUser account:
Click Add Policy.
Enter a name for the new policy (example: Domain Controller).
Click the Advanced Settings tab.
Deselect Update client computers where users are not logged in.
Click Save.
Apply the new policy to the Domain Controller:
On the Groups + Policies page, locate the new group and select Edit / Assign Policy.
Use the drop-down menu to select the new Policy and click Save.
At the top of the page, click Computers.
Locate the Domain Controller in the list of computers and select the box beside it.
At the bottom of the page, use the Move to drop-down menu to select the new group and click Move.
The Domain Controller will receive the updated policy at the next update interval.
--------------------------------------------------------------------------------
Solution 2
Manually disable the McAfeeMVSUser account on the Domain Controller.
Click Start, Run, type cmd and click OK.
Navigate to C:\Program Files\McAfee\Managed VirusScan\Agent.
Type the following command and press ENTER:
myUsrSrv4.0.0.358.exe /UnregServer
NOTE: This will only disable the McAfeeMVSUser account. An account with the correct permissions must still be logged in to allow updating.
Cause
Total Protection for Small Business is unable to automatically create a user account with sufficient privileges to update on a Domain Controller. This is to avoid creating any unnecessary security risks on a critical network component.
Product Names
McAfee Total Protection for Small Business
McAfee Total Protection for Small Business Advanced
Microsoft Windows Server Domain Controllers
