Process exclusion for Access Protection has no effect when the source process includes 'System:Remote'

Technical Articles ID: KB68560
Last Modified: 6/23/2021

Environment

McAfee Endpoint Security (ENS) Threat Prevention 10.x
McAfee VirusScan Enterprise (VSE) 8.x

Problem

You specify a Process to Exclude, such as psexec.exe or sms.exe, in an Access Protection rule that specifies as a Process to Include only System:Remote. The exclusion does not take effect.

For example, you added a process to the Process to Exclude field of the Access Protection rule Anti-virus Standard Protection:Prevent remote creation/modification of executable and configuration files. The exclusion has no effect.

Cause

No information about that process that performs the I/O makes it across the network. The process that performs the action on the client system is the operating system itself (specified as System:Remote). Because the only process included in the rule is System:Remote, the only process that can be excluded would also be System:Remote, effectively disabling the rule.

Solution

Disable the Access Protection rule that is using System:Remote as the Process to Include. There is no way to add a specific process to be excluded when the access is performed across the network.

Affected Products

Endpoint Security Threat Prevention 10.7.x
Endpoint Security Threat Prevention 10.6.x
VirusScan Enterprise 8.8

Languages:

This article is available in the following languages:

English United States
Japanese

Glossary of Technical Terms

Highlight Glossary Terms

Please take a moment to browse our Glossary of Technical Terms.

Knowledge Center

Process exclusion for Access Protection has no effect when the source process includes 'System:Remote'

Environment

Problem

Cause

Solution

Affected Products

Languages:

Glossary of Technical Terms

Title

Title

Knowledge Center

Process exclusion for Access Protection has no effect when the source process includes 'System:Remote'

Environment

Problem

Cause

Solution

Affected Products

Languages:

Glossary of Technical Terms

Choose your region

Title

Title