How the Custom Properties policy works

You can configure the Custom Properties policy to report any text value as part of system properties. You can also determine which Custom Properties are set on the client system.

These system properties can be used to tag and identify managed systems to perform actions such as assign policies, tasks, and sort systems in the System Tree. You can configure Custom Properties policy to determine which custom properties are set on the client system.

Custom Properties features include:

Eight default Custom Properties.
ePO - On-prem administrator can perform the following actions:
- Set Custom Properties remotely from the ePO - On-prem console.
- Allow or deny system administrators to view a particular custom property using registry or command-line options.
- Allow or deny system administrators to edit a particular custom property using installer or command-line options.
- Grant one-time edit permission to system administrators to change a particular custom property that has write access revoked.
A custom property that is empty can be overwritten by system administrators regardless of write policy set.

Note

Starting with version 5.0.5, you can set up to eight Custom Properties. When using McAfee Agent 5.0.5 with earlier versions of ePO - On-prem (before 5.9.0), the first four (1–4) Custom Properties are reported as part of system properties that can be effectively used for tagging, queries, and quick find features. The remaining four (5–8) Custom Properties can't be used for tagging features and are reported as part of Trellix Agent product properties.

The following table explains the behavior of Custom Properties on the System Properties page for different versions of ePO - On-prem and Trellix Agent.

ePO - On-prem	Trellix Agent	Custom Properties supported by Trellix Agent	Custom Properties supported by ePO - On-prem	Custom property tagging	Properties reported on Trellix Agent tab	Custom Properties reported as system property
(ePO - On-prem) 5.1.x and 5.3.x	5.0.4 and earlier	4	4	4	4	4
(ePO - On-prem) 5.1.x and 5.3.x	5.0.5 and later	8	4	4	8	4
(McAfee ePO Cloud) 5.6.x	5.0.4 and earlier	4	4	4	4	4
(McAfee ePO Cloud) 5.6.x	5.0.5 and later	8	4	4	8	4
5.9.0 and later	5.0.4 and earlier	4	8	8	4	4
5.9.0 and later	5.0.5 and later	8	8	8	8	8

The custom properties field does not support use of double quotation marks ("). you can use the single quotation mark (') as an alternative. For example:

maconfig.exe -custom -prop1 "'quoted text' 1"

Important

maconfig.exe is changed from a console application to Windows application. To view console logs, use maconfigCmd.exe instead of maconfig.exe for Trellix Agent version 5.8.1 and above.

System administrators' action on Custom Properties is based on the following policy conditions:

If the Allow edit option is enabled in the policy, system administrators can change a custom property multiple times using the maconfig/frminst command.
- At the command prompt, execute the following maconfig commands as needed.
  - Windows: maconfig.exe -custom -prop1 "prop1" -prop2 "prop2".........-prop8 "prop8"
  - Non-Windows: maconfig -custom -prop1 "prop1" -prop2 "prop2"........-prop8 "prop8"
- frminst command-line options
  - Windows: frminst.exe /install=Agent /customProps1="prop1" /customProps2="prop2"......../customProps8="prop8"
If the Allow edit option is disabled in the policy, system administrators:
- Can edit a custom property if the value on the client system is blank.
- Can edit a custom property once if ePO - On-prem administrator grants One-time edit permission to the property.
- Can't edit a custom property if the property already contains a value, and is not permitted with one-time access.
If Allow view is enabled in the policy, system administrators can view the custom property value from the registry or using the cmdagent command.
- At the command prompt, execute the following maconfig commands as needed.
  - Windows: cmdagent.exe -x
  - Non-Windows: cmdagent -x
If the Allow view option is disabled in the policy, system administrators can't view the custom property value from the registry or using the cmdagent command.