Access Protection rule prevents Windows Service Pack or Windows Update installation

Technical Articles ID: KB52624
Last Modified: 1/3/2020

Environment

McAfee VirusScan Enterprise (VSE) 8.x

Problem

Windows Service Packs or updates fail to install. This situation triggers the Prevent Windows Process spoofing rule and displays an error in the Application Event log.

Source

McLogEvent

ID:

257

Message:

Blocked by access protection rule. Access to object C:\Users\Administrator\AppData\Local\Temp\SPI24D2.tmp\amd64_microsoft-windows-lsa_31bf3856ad354e35_6.0.6001/16633_none_024bf054153e04ec\ lsass.exe was blocked by rule Anti-virus Standard Protection:Prevent Windows Process spoofing.

Cause

VSE can prevent Windows process spoofing and can stop unexpected Windows processes from starting. The Access Protection rule that provides this functionality is Prevent Windows Process spoofing, which is disabled by default. When enabled, this rule might also stop genuine Windows updates during which the Operating System must replace core Operating System processes. Then, it might start them from unexpected locations such as temporary folders.

In the event log entry above, LSASS.EXE tries to start from an unexpected location. This attempt is what triggers the rule. This path can be expected during a legitimate Windows update or Service Pack upgrade.

Solution

To allow an update of any core Windows processes, disable the Prevent Windows Process spoofing rule before performing the update, or configure it to Report only.

Click Start, Programs, McAfee, VirusScan Console.
Right-click Access Protection and select Properties.
Select Anti-virus Standard Protection.
Select Prevent Windows Process spoofing and deselect the Block option. If you want, select the Report option to have entries noted in the Access Protection logs.
Click OK.
Perform the Windows update.

To view entries in the Access Protection logs:

Click Start, Programs, McAfee, VirusScan Console.
Click Access Protection.
Click Task, and select View Log.
Verify the entries which occurred after disabling Prevent Windows Process spoofing.

Affected Products

Known Issue/Product Defect
VirusScan Enterprise 8.8

Languages:

This article is available in the following languages:

English United States
Spanish Spain
French
Italian
Japanese
Portuguese Brasileiro

Glossary of Technical Terms

Highlight Glossary Terms

Please take a moment to browse our Glossary of Technical Terms.

Knowledge Center

Access Protection rule prevents Windows Service Pack or Windows Update installation

Environment

Problem

Cause

Solution

Affected Products

Languages:

Glossary of Technical Terms

Title

Title

Knowledge Center

Access Protection rule prevents Windows Service Pack or Windows Update installation

Environment

Problem

Cause

Solution

Affected Products

Languages:

Glossary of Technical Terms

Choose your region

Title

Title