Press CTRL+K to open search

Frequently asked questions

  • Published on Aug 26, 2026
  • 6 minute(s) read
Prev Next

Here are answers to frequently asked questions.

Smart Installer

Note

For a consolidated list of common questions and answers for Trellix Agent 5.x.x, see KB75298.

Is the Smart Installer URL accessible on the Internet?

Yes. You can access the Smart Installer URL using the Internet if your ePO - On-prem is accessible over a public network.

Can I restrict the Smart Installer URL to be used only a specific number of times or number of days?

Yes. The Smart Installer URL can be used for a predefined number of times.

Can I run the Smart Installer if I don't have administrator rights on the client system?

No. The user must have administrator rights to install Trellix Agent on client systems.

Remote Provisioning

Is there a temporary credential available that can be shared with end users for remote provisioning? I do not want to share my ePO - On-prem administrator credentials.

No. The user needs administrator credentials to connect to ePO - On-prem.

Peer-to-Peer communication

Is peer-to-peer information displayed on the Agent monitor?

No. These details are available in the detailed logs.

How many concurrent connections does a peer-to-peer server support?

A peer-to-peer server supports 10 connections concurrently.

How does a peer-to-peer client get updated content?

When an agent requires a content update, it tries to discover peer-to-peer servers with the content update in its broadcast domain. On receiving the request, the agents configured as peer-to-peer servers check if they have the requested content and respond back to the agent. The agent requesting the update, downloads the content update from the peer-to-peer server that responded first.

What type of content does a peer-to-peer server provide?

A peer-to-peer server provides all content available in its ePO - On-prem repositories.

Can I configure the disk quota for peer-to-peer content?

Yes. See Enable peer-to-peer service for details.

General

Why do I see many Trellix Agent processes for Linux?

The runtime environment uses Linux Native threads through the Light Weight Process implementation. Using Linux Native threads causes each thread to show as a separate process on the client computer.

(ePO - On-prem) How can I change the language of Trellix Agent during installation?

  1. Run this command on the client system.

  1. framepkg.exe /install=agent /uselanguage=<Locale ID>

(ePO - On-prem) Are there best practices or important considerations for upgrading Trellix Agent?

  1. Any action that generates network traffic must be carefully considered. Because ePO - On-prem is used to deploy products, updates, and Trellix Agent, a ePO - On-prem administrator's actions can negatively affect the network. Though the Trellix Agent installation package is not large by itself, it can have significant impact on a network if sent to thousands of systems at once. So, apply careful planning to any deployment effort.

  1. Before checking in the new package, make sure you:

    • Disable Global Updating — Checking in a Trellix Agent package with Global Updating enabled can cause the new version of Trellix Agent to be deployed even if the Product Deployment task is not enabled.

    • Disable the Product Deployment Task — If the Product Deployment task is still enabled from the previous deployment, the new version causes deployments to begin according to the configured schedule. To reduce the risk of existing task execution, send the task change to client systems before checking in the new package.

  1. Before deploying Trellix Agent:

    • Enable Product Deployment task below Directory level — Do not set the Product Deployment task at the root level. Schedule Product Deployment tasks at a site level, or even at the group level, if needed, to reduce the number of systems downloading the new Trellix Agent at the same time.

    • Randomize Product Deployment tasks — Do not configure the Product Deployment task to start at a set time for the entire site. Using the randomization feature in the task allows the network traffic to be spread out over a specified time.

(ePO - On-prem) How can I redirect the communication from a Trellix Agent to a new ePO - On-prem server?

Use one of these installation methods to redirect communication from a Trellix Agent to a new ePO - On-prem server. See ePO - On-prem product documentation for alternate methods.

Method

Action

Using FrmInst.exe

Note

This method is supported only on Windows.

  1. On ePO - On-prem, navigate to C:\Program Files\McAfee\ePO\DB\Software\Current\ePOAgent3000\Install\0409.

  2. Copy these files to a temporary location on the client system.

    • Sitelist.xml file

    • sr2048pubkey.bin

    • srpubkey.bin (the server public key)

    • agentfipsmode file

    • reqseckey.bin (the initial request key)

    • req2048seckey.bin

  3. Run this command on the client system.

    FrmInst.exe /SiteInfo=<Temporary_folder_path>\Sitelist.xml

Using remote provisioning commands

Run this command on the client system.

maconfig -provision -managed -auto -dir "temp location to copy keys"
 -epo ePOServerMachine [-user ePO-User-name] [-password epo-admin-password]

For example,

maconfig -provision -managed -auto -dir "/temp"
 -epo ePOServerMachine [-user admin] [password password123]
How can I redirect the communication from a Trellix Agent to a new McAfee ePO Cloud server?

Use this installation method to redirect communication from Trellix Agent to a new McAfee ePO Cloud server. See McAfee ePO Cloud product documentation for alternate methods.

Method

Action

Using remote provisioning commands

Run this command on the client system.

maconfig -provision -managed -auto -dir "temp location to copy keys"
 -epo ePOServerMachine [-user ePO-User-name] [-password epo-admin-password]

For example,

maconfig -provision -managed -auto -dir "/temp"
 -epo ePOServerMachine [-user admin] [password password123]
How does ePO - On-prem sort Trellix Agent at the first connection?

  1. When Trellix Agent is installed on a system, a unique GUID is created based on the MAC address and computer name of the system. Trellix Agent then connects to ePO - On-prem in a randomized interval.

  1. At that connection, ePO - On-prem uses these system properties to see if Trellix Agent is populated in the System Tree. A new object is created in the System Tree if this search doesn't find a match. The location for the new object is also based on this sort order.

    System properties used when Sorting Criteria is disabled

    System properties used when Sorting Criteria is enabled

    Agent GUID

    Agent GUID

    Domain Name

    IP address and Tags evaluated for the computer

    Computer Name

    Domain Name

    IP address

    Computer Name

  1. If an entry is found that is listed in the search order, Trellix Agent lists the client system in the correct group. If it does not find any of the above, it then lists the client in the Lost & Found group at the My Organization level.

What are the ports used by Trellix Agent?

Ports

Protocols

Traffic direction

8081

TCP

(ePO - On-prem) Inbound connection from ePO - On-prem or Agent Handler.

Peer-to-peer server serves content, Relay connections established.

8082

UDP

Inbound connection to Trellix Agent.

Peer-to-peer server discovery, RelayServer discovery.

8083

UDP

RelayServer discovery for previous versions of Trellix Agent.

Note

If peer-to-peer service and RelayServer are disabled, these ports are not open.

:
Related articles