Loading...

Knowledge Center


Microsoft SMS Agent Host service (ccmexec.exe or smsexec.exe) triggers the Access Protection rule: Prevent termination of McAfee processes
Technical Articles ID:  KB71970
Last Modified:  3/26/2015
Rated:


Environment

McAfee VirusScan Enterprise (VSE) 8.x

Microsoft SMS Agent Host service (ccmexec.exe, smsexec.exe)

Problem

The Microsoft SMS Agent Host service (ccmexec.exe, smsexec.exe) triggers the Access Protection rule: Prevent termination of McAfee processes.

Cause

  • VSE 8.8
    Unlike earlier versions of VSE, the Access Protection rule Prevent termination of McAfee processes triggers only if the process is explicitly seeking the right to terminate our process.
     
  • VSE 8.7i
    The Access Protection rule Prevent termination of McAfee processes is considered triggered if the process seeks to acquire the privilege to terminate a McAfee process. It does not actually have to try and terminate the process. The rule is less finely tuned than in VSE 8.8.  

Solution

Intel Security has confirmed that SCCM.exe explicitly seeks to acquire the "terminate process" privilege. The Access Protection rule is behaving as expected.

To trust the program, exclude the ccmexec.exe and smsexec.exe processes from the rule. These processes do not terminate McAfee programs even though they will seek the "terminate process" privilege.
  1. Click Start, Programs, McAfee, VirusScan Console.
  2. Double-click Access Protection, and select Common Standard Protection.
  3. Double-click Prevent termination of McAfee processes.
  4. Under Processes to exclude, navigate to the end of the list.

    NOTE: You might have to move a long way down with your cursor. 
     
  5. Type ccmexec.exe and then click OK.
  6. Type smsexec.exe and then click OK.

    IMPORTANT:
    • Ensure that there are no spaces before or after the commas separating process names.
    • Use a (partial) path name if other processes with the same name exist. See KB66909 for a consolidated list of VSE exclusion articles.
       
  7. Click OK until the Access Protection Properties window is closed, and then exit VirusScan Console.
NOTE: Other exclusions might be required. Search the Microsoft support site for SCCM and select your Windows operating system version to learn version-specific details, or use McAfee Profiler to identify what might need exclusions with regards to this application.

Rate this document

Did this article resolve your issue?

Please provide any comments below

Beta Translate with

Select a desired language below to translate this page.

Glossary of Technical Terms


Highlight Glossary Terms

Please take a moment to browse our Glossary of Technical Terms.