This minifilter driver is required such that procmon is able to intercept IO operations and log them. You can see that by starting the procmon executable, the PROCMON24 minifilter driver was loaded.

The output of this command lists the minifilter drivers that are active on your operating system. You may ask yourself: What is this altitude you are speaking about and why should I want to reduce it? Well, after you downloaded and successfully started procmon, you can run fltmc instances in an elevated cmd or PowerShell. In this blog post, I present how to reduce the altitude of the procmon in the filter driver stack. We have support and I am going to give McAfee a call on monday but wanted to ask here just in case anyone has seen this issue and might have a fix.The Process Monitor (also known as procmon) is part of Microsoft’s Sysinternals Suite and a well-known tool for troubleshooting a Windows system. SO i am not sure what I am missing as to why from the agent it wont install but manually it will. I downloaded the V3 DATs from the mcafee website and installed it manually and it works. When i look at the logs I see this: ' 04:31:53.129 masvc(3096.3544) msgbus.Error: Failed to write data on pipe name 04:31:53.129 masvc(3096.3544) msgbus.Error: UV write failed - uv error ' when i search that error i dont see much other than to make sure the security groups for mcafee have full control of the logs and msgbus folders (which they do). It looks to download the file(s) file but doesn't install it. However, when the agent tries to install the AMcore content, it fails to update to 4499 (it stays at 0.5). The agents on the client workstations download and install the products with no issues.

When we updated, we added a product deployment for ENS 10.7 (endoint platform and threat protection). We recently updated from ePO 5.3 to 5.10 U10.

Procmon mcafee