Options page

Standard access mode requires a password to view and change settings on the Endpoint Security Client Settings page.

• Password — Specifies the password.
• Confirm password — Confirms the password.

Changing the Administrator password invalidates the time-based password. If you change the Administrator password, save the policy, then generate a new time-based password.

The default password is mcafee.

(Disabled by default)

• Password — Specifies the password.
• Confirm password — Confirms the password.

Entering the time-based password enables Full access to Endpoint Security Client. The interface remains unlocked until it is closed.

This option is available only when the Client Interface Mode is set to Standard access or Lock client interface.

Changing the Administrator password invalidates the time-based password. If you change the Administrator password, save the policy, then generate a new time-based password.

The expiration time is relative to the McAfee ePO server. For example, if you set the expiration time to 1:00 p.m. PST, the password expires at 4:00 p.m. on client systems in the EST time zone.

If a time-based password is in effect, this button toggles to View Password.

If a time-based password is not in effect (not set or expired), this button toggles to Generate New Password.

When you change the language from McAfee ePO, the language change is applied to the Endpoint Security Client on the first policy enforcement.

For managed systems, language changes made from the Endpoint Security Client override policy changes from the management server. The language change is applied after the Endpoint Security Client restarts.

The client language doesn't affect the log files. Log files always appear in the language specified by the default system locale.

• Block and report — Blocks activity and reports to McAfee ePO. (Default)
• Block only — Blocks activity but doesn't report to McAfee ePO.
• Report only — Reports to McAfee ePO but doesn't block activity.

Wildcards are supported.

+ Adds a process to the exclusion list. Click +, then enter the exact resource name, such as avtask.exe.

- Deletes the selected item. Select the resource, then click -.

Specifies certificate options.

This information can include:

• CN — Common Name
• OU — Organization Unit
• O — Organization
• L — Locality
• ST — State or province
• C — Country Code

The default location is:

<SYSTEM_DRIVE>:\ProgramData\McAfee\Endpoint\Logs

This location depends on the operating system.

Enter or select a location from the drop-down list:

• System Drive
• System Root
• System Directory
• Temp Directory
• Program Files Directory
• Program Files Common Directory
• Software Installed Directory

Windows — If the log file exceeds this size, new data replaces the oldest 25 percent of the entries in the file.

Linux — If the log file exceeds this size, the current file is backed up and a new file is created. The last five versions of the log files are available.

Enabling debug logging for any module also enables debug logging for the Common module features, such as Self Protection.

Enable for Access Protection — Logs to AccessProtection_Debug.log. (Windows only)

Enable for Exploit Prevention — Logs to ExploitPrevention_Debug.log. (Windows only)

Enable for On-Access Scan — Logs to OnAccessScan_Debug.log. (Windows only)

Enable for On-Demand Scan — Logs to OnDemandScan_Debug.log. (Windows only)

Enabling debug logging for any Threat Prevention technology also enables debug logging for the Endpoint Security Client.

If the log file exceeds this size, new data replaces the oldest 25 percent of the entries in the file.

The Windows Application log is accessible from the Windows Event Viewer → Windows Logs → Application.

The location of syslog is configurable on Linux systems.

• None — Sends no alerts
• Alert only — Sends alert level 1 only.
• Critical and Alert — Sends alert levels 1 and 2.
• Warning, Critical, and Alert — Sends alert levels 1–3.
• All except Informational — Sends alert levels 1–4.
• All — Sends alert levels 1–5.

• 1 — Alert
• 2 — Critical
• 3 — Warning
• 4 — Notice
• 5 — Informational

Access Protection — Logs to AccessProtection_Activity.log. (Windows only)

Enabling event logging for Access Protection also enables event logging for Self Protection.

Exploit Prevention — Logs to ExploitPrevention_Activity.log. (Windows only)

On-Access Scan — Logs to OnAccessScan_Activity.log. (Windows only)

On-Demand Scan — Logs to OnDemandScan_Activity.log. (Windows only)

• Address — Specifies the IP address or fully qualified domain name of the HTTP proxy server.
• Port — Limits access through the specified port.
• Exclude these addresses — Don't use the HTTP proxy server for websites or IP addresses that begin with the specified entries.

  Enter the comma-separated addresses.

  Tip: Best practice: Exclude the McAfee GTI addresses from the proxy server. For information, see KB79640 and KB84374.

• User name — Specifies the user account with permissions to access the HTTP proxy server.
• Password — Specifies the password for User name.
• Confirm password — Confirms the specified password.

Click this button to manually check for and download updates to content files and software components on the client system.

(Enabled by default)

By default, the Default Client Update task runs every day at 1:00 a.m. and repeats every four hours until 11:59 p.m.

On Macintosh, the Default Client Update task runs every day at 4:45 PM.

• Security content, hotfixes, and patches — Updates all security content (including engine and AMCore and Exploit Prevention content), as well as any hotfixes and patches, to the latest versions.
• Security content — Updates security content only. (Default)
• Hotfixes and patches — Updates hotfixes and patches only.