cause of issue could be due to macmnsvc security group is missing from the folder permissions on one or both of the following Agent directories:
- C:\ProgramData\McAfee\Agent\Logs
- C:\ProgramData\McAfee\Agent\msgbus
NOTE: The folder ProgramData is a hidden by default. To access this folder, you must type the location directly into the run field in the File Explorer window, or configure the Windows options to show hidden folders.
These needed permissions may have been removed from the TA folders. This could happen if customer configured a Group Policy to set specific permissions on the folders that TA uses or if there's a third-party mechanism that enforces folder permissions in the customer’s environment.
To resolve this, customer may uninstall and reinstall Trellix Agent to re-create the folders with the correct permissions:
- Remove Trellix Agent via Agent-ePO policy. For details, see KB65863 - How to manually remove Trellix Agent 5.x. or Remove using Trellix EPR tool, see https://thrive.trellix.com/s/article/KB90895?language=en_US&page=content&id=KB90895
- Verify that the following folders have been removed (might require a reboot):
C:\ProgramData\McAfee\Agent\Logs
C:\ProgramData\McAfee\Agent\msgbus - Reinstall the Trellix Agent
- KB for reference: http://thrive.trellix.com/s/article/KB86760?language=en_US&page=content&id=KB86760&locale=en_US