Our company utilizes a full Trellix stack of products (unfortunately) in addition to Endpoint Privilege Management.  We have recently upgraded from our On-Prem ePO managed Privilege Management solution to the new SaaS PMC.  One thing we have learned is that when using the EndpointUtility.exe tool to gather logs, is that the Endpoint Utility wants to grab all of the McAfee ProgramData logs even though we have just finished fully migrating over from on-prem ePO managed to SaaS.

It seems Trellix Self-Protection is causing a permissions error at the very end of the log capturing process. After working with support and confirming there is no CLI available in this tool, we are basically forced to disable all of self-protect in order to gather logs, McAfee logs at that, that aren’t even necessary.

Making this post as a means to communicate our findings in case others coming from on-prem ePO to SaaS experience this problem.  It would be extremely beneficial if there were baked in CLI arguments that we could pass to suppress errors, or even better if the Endpoint Utility could be re-released as a SaaS only tool and with the option to not gather McAfee/ePO logs.