The new docs.trellix.com offers a modernized UI and AI-powered features like conversational searches. Content is currently available only in English. Other languages will be available in mid-October 2026. We hope you enjoy the new experience.

Press CTRL+K to open search

Installation command-line interface for Trellix ENS 26.x

  • Published on Sep 13, 2026
  • 5 minute(s) read
Prev Next

Use the command line interface to customize installation of Trellix ENS 10.7. You can specify commands when creating ePO - On-prem deployment tasks. You can also run setupEP.exe using a third-party tool or the Windows command prompt on the endpoint.

Syntax: Deployment task options

When creating a deployment task in ePO - On-prem, in the Command line box, you can enter the commands listed in the Deployment task and setupEP.exe command-line options table.

When using the setupEP.exe command line on the endpoint, or installing on the endpoint using a third-party tool, the command-line syntax for installation is:

installation_path\setupEP.exe [ADDLOCAL="tp,fw,wc,atp"] [ command_args setupEP_command_args]

  • installation_path — The folder where you extracted the installation package.

  • command_args— Commands in the Deployment task and setupEP.exe command-line options table.

  • setupEP_command_args— Commands in the setupEP.exe command-line options table

These options are available when installing with a deployment task in ePO - On-prem or by running setupEP.exe from the command line on the endpoint.

Options are not case sensitive.

Deployment task and setupEP.exe command-line options

Option

Parameters

Description

Notes

CAVA="thread_count"

thread_count — (Optional) Specifies the number of scanning threads to use.

Installs Trellix ENS with support for the Common AntiVirus Agent (CAVA). Requires Threat Prevention.

Required when upgrading from a previous version of Trellix ENS with CAVA.

This option disables the blocking cache in the on-access scanner, increases the number of on-access scanning threads to 200, and enables network scanning, to ensure that all files from CAVA are scanned. You can also specify a different number of scanning threads.

See How to install Endpoint Security with support for CAVA (KB88973) for more information.

INSTALLDIR="path"

path

Specifies where to install the product files on the endpoint.

The installer creates an Endpoint folder at the specified location and installs the product to this folder.

By default, product files are installed in the folder C:\Program Files\McAfee\Endpoint Security.

/log"path"

/l"path"

path

Specifies where to save the installation log files for tracking installation events.

The installer creates an Endpoint folder at the specified location and saves the log files to this folder.

By default, log files are saved in the Windows System TEMP folder C:\windows\Temp\McAfeeLogs.

/l*v"path"

path

Specifies where to save the installation log files and verbose (more descriptive) logging entries.

/nocontentupdate

Does not automatically update product content files on the endpoint as part of the installation process.

Content files include the latest AMCore, Exploit Prevention, and Adaptive Threat Protection content files required for Trellix ENS.

Caution

Update content files to make sure that the endpoint is fully protected. If you don't update them during installation, schedule an update as soon as possible.

/noinstalltelemetry

noinstalltelemetry

Disables the AMCore install telemetry.

This command line option is applicable only for the Threat Prevention installer.

/override"program"

hips — Host Intrusion Prevention

Overrides and removes the specified conflicting product.

/quarantinefolder="path"

path

Specifies the location of the Quarantine folder where detected threats are placed. The folder path is limited to 190 characters.

By default, the Quarantine folder is located in the folder <SYSTEM_DRIVE>\Quarantine.



These additional options are available when running setupEP.exe from the command line on the endpoint.

setupEP.exe command-line options

Option

Parameters

Description

ADDLOCAL="tp,fw,wc,atp"

  • tp — Threat Prevention

  • fw —Firewall

  • wc — Web Control

  • atp — Adaptive Threat Protection

Specifies individual product modules to install in silent mode.

Before you can install atp, tp must be installed.

Best practice: For optimal performance and protection, install the same version of the Trellix ENS modules or upgrade all modules to the latest version. All Trellix ENS modules installed or upgraded on a system should originate from the same source package, avoiding a mix and match of installed module versions.

Tip

When using ADDLOCAL, there are no endpoint notifications or user interactions. It behaves like /qn is specified. To change this behavior, you can specify /q! or /qb.

/noinstalltelemetry

installtelemetry

Disables the AMCore install telemetry.

This command line option is applicable only for the Threat Prevention installer.

/qn or /quiet

/qb! or /passive

/qb

  • qb! — Shows only a progress bar. Users cannot cancel the installation while it is in progress (passive mode).

  • qb — Shows a progress bar and a Cancel button. Users can cancel the installation while it is in progress, if needed.

  • qn — Hides all installation notifications (silent mode). Users have no interaction.

    Note

    When using ADDLOCAL to install, this is the default behavior and you do not need to specify it.

Specifies how users interact with the installer.

/import file

file

Imports settings from the specified file.

/module <TP,FW,WC,ATP,ESP>

  • TP — Threat Prevention

  • FW — Trellix ENS Firewall

  • WC — Web Control

  • ATP — Adaptive Threat Protection

  • ESP — Resources shared by product modules.

Applies imported settings to the specified product modules.

/nopreservesettings

Does not save your product settings when upgrading to Trellix ENS.

By default, settings are preserved.

/policyname name

name

Assigns the specified settings to endpoints where the product is installed.

/unlock password

password

Unlocks the client interface using the specified password.



Examples: Deployment task and setupEP command-line options

To run these example commands:

  • In ePO - On-prem — On the Create Deployment Task page, type options in the Command line box.

  • On the endpoint — Open a command prompt in Windows, then change to the location where you extracted the installation package.

  • In a third-party deployment tool — When creating a deployment task, for the installation command line enter setupEP.exe with the options needed for your environment.

    Best practice: Use setupEP.exe ADDLOCAL="tp,atp,fw,wc" to install all the product modules on endpoints without displaying notifications or interrupting user activity.

To...

Add these options in the deployment task

Run this command from the command line

Install Firewall and Web Control (and Common, if needed).

ADDLOCAL="fw,wc"

setupEP.exe ADDLOCAL="fw,wc"

Install the product modules using a third-party deployment tool. By default, there are no notifications on the endpoint or user interaction.

ADDLOCAL="tp,atp,fw,wc"

setupEP.exe ADDLOCAL="tp,atp,fw,wc"

Install the product modules under D:\Installed Programs\Mcafee\Endpoint Security instead of the default location (C:\Program Files\McAfee\Endpoint Security).

ADDLOCAL="tp,atp,fw,wc"

setupEP.exe INSTALLDIR="D:\Installed Programs"

Install the product modules without uninstalling MOVE.

Important

Ensure the following configuration is also applied through Trellix ENS Threat Prevention policy:

  • Disable the Threat Prevention On-Access Scan.

  • Disable all On-Demand Scan client tasks (Custom On-Demand Scan, Pause On-Demand Scan, Policy On-Demand Scan).

ADDLOCAL="tp,atp,fw,wc" /keepMOVE

setupEP.exe INSTALLDIR="D:\Installed Programs" /keepMOVE

Save product log files under D:\Log Files instead of the default location (C:\Windows\Temp\McAfeeLogs).

/l"D:\Log Files"

setupEP.exe /l"D:\Log Files"

Save product log files under D:\Log Files and specify verbose logging.

/l*v"D:\Log Files"

setupEP.exe /l*v"D:\Log Files"

Remove McAfee Host Intrusion Prevention automatically during installation.

/override"hips"

setupEP.exe /override"hips"

Create a Quarantine folder at D:\reports\Quarantine instead of the default location (<SYSTEM_DRIVE>\Quarantine).

/quarantinefolder="D:/reports"

setupEP.exe /quarantinefolder="D:/reports"

Install Threat Prevention with support for CAVA and increase the number of on-access scanning threads to 220.

ADDLOCAL="tp" CAVA="220"

setupEP.exe ADDLOCAL="tp" CAVA="220"

Install Adaptive Threat Protection (and Threat Prevention and Common) automatically without updating the product content files during installation.

ADDLOCAL="atp" /nocontentupdate

setupEP.exe ADDLOCAL="atp" /nocontentupdate

Import settings from the file called mysettings.

setupEP.exe /import mysettings

Import settings from the file called mysettings to Threat Prevention and Firewall.

setupEP.exe /import mysettings /module TP,FW

Install the product modules using a third-party deployment tool. By default, there are no notifications on the endpoint or user interaction.

setupEP.exe ADDLOCAL="tp,atp,fw,wc"

Related articles