Skip to main content
Jamf Nation, hosted by Jamf, is the largest Apple IT management community in the world. Dialog with your fellow IT professionals, gain insight about Apple device deployments, share best practices and bounce ideas off each other. Join the conversation.

How to turn off McAfee Firewall via script?

Hey folks,

After upgrading our Macs to 10.11 and installing McAfee Endpoint, I lose remote connection to the Macs. ARD or Screen Sharing doesn't work after the install, but oddly I can still run scripts or push packages. I just can't see their screen any longer.

Instead of walking up to the Mac in another building, I'd like to shoot a script to turn off the McAfee Firewall. After I do that, I can see the screen again.

Anybody had this issue and know a script to turn off the Firewall?

Like Comment
Order by:
SOLVED Posted: by mm2270

Although it's possible to disable those or turn them off, it's only temporary as long as your systems are checking in with ePO. In my experience even doing it manually in the GUI it ends up enabled again usually within about 10-15 minutes later, sometimes even sooner. The setting to have those enabled comes from ePO so it overrides any local disablement. At least that's how it is for us.

Like
SOLVED Posted: by dpertschi

And you won't be able to ssh in either. (angry face here) I had this with Endpoint Protection product, and it would clear once the machine checked in an enforced policy, ~20 minutes, You can try adding a script to force the checkin with ePO:

/Library/McAfee/cma/bin/cmdagent -c

With the Endpoint Security product, you can get just the Threat Prevention installer if you don't want firewall also.

Like
SOLVED Posted: by Taylor.Armstrong

I'm running this script after install to not only turn it off, but remove the feature entirely:

#!/bin/bash
echo "Disabling WebControl"
/usr/local/McAfee/uninstall WebControl
echo "Disabling McAfee Firewall"
/usr/local/McAfee/uninstall Firewall
exit 0
Like
SOLVED Posted: by mvu

I get "uninstallation failed" or "permission denied." Any thoughts?

Like
SOLVED Posted: by Taylor.Armstrong

Are you running it with sudo? I run it as part of my McAfee install/upgrade, but if you're just testing locally it will require sudo.

Like
SOLVED Posted: by AVmcclint

Your best bet would be to have your ePO administrator adjust the Firewall policy to allow all the pertinent ports you need to manage the Macs. Immediately after installing McAfee on a Mac, the firewall will default to blocking everything, but after 10-15 minutes it will check in with the server and pull down the firewall policy that permits ssh and ARD and anything else you need.

Like
SOLVED Posted: by mvu

I tried using the script through ARD's Unix button. Yes, I used sudo. I'm probably missing something simple.

I will contact the ePO admin. The thing is when I update to endpoint 2.3 on 10.12 Macs, I don't lose remote connection. I install the agent and I am on my way.

But going from 1.2 to 2.3 endpoint on 10.11 Macs, I lose connection and can't SSH. 10.12 Macs are just fine. So I am puzzled.

Like