The product development team has confirmed that
SCCM.exe explicitly seeks to acquire the "close process" privilege. The Access Protection rule is behaving as expected.
To trust the program, exclude the
ccmexec.exe and
smsexec.exe processes from the rule. These processes do not terminate McAfee programs even though they seek the "terminate process" privilege:
- Click Start, Programs, McAfee, VirusScan Console.
- Double-click Access Protection, and select Common Standard Protection.
- Double-click Prevent termination of McAfee processes.
- Under Processes to exclude, navigate to the end of the list.
NOTE: You might have to search a long way down with your cursor.
- Type ccmexec.exe and then click OK.
- Type smsexec.exe and then click OK.
IMPORTANT:
- Make sure that there are no spaces before or after the commas that separate process names.
- Use a partial path name if other processes with the same name exist. See KB66909 for a consolidated list of VSE exclusion articles.
-
Click OK until the Access Protection Properties window closes, and then exit the VirusScan console.
NOTE: Other exclusions might be required. Search the Microsoft support site for SCCM, and select your Windows operating system version to learn version-specific details. Or, use McAfee Profiler to identify what might need exclusions with regards to this application.
