Application and Change Control might not switch the protection mode with Windows FBWF installed

Technical Articles ID: KB77610
Last Modified: 5/20/2020

Environment

McAfee Application and Change Control (MACC) 8.x.x, 7.x.x, 6.x.x

Microsoft Windows Embedded (all supported versions)

Problem

MACC protection can be set to any of the following four modes:

Enable Mode
Disable Mode
Update Mode
Observation Mode

If Windows File Based Write Filter (FBWF) is enabled, switching the protection modes of MACC might not be successful.

For example, if you run sadmin disable to disable the MACC protection and restart the system, the system starts with MACC enabled.

Cause

MACC keeps the mode on reboot information in the registry. If FBWF is enabled, Windows prevents MACC from writing to the registry and the application starts in the same mode as before the restart.

Solution

Run the following command and add the config folder as an FBWF exclusion:

Fbwfmgr /addexclusion <system drive>\windows\system32\config

Example:

Fbwfmgr /addexclusion c:\windows\system32\config

Doing so allows write calls to the MACC registry keys and allows the mode on reboot information to be saved in the registry.

For more information about FBWF exclusion rules, see: http://msdn.microsoft.com/en-us/library/ee832773.aspx#Add_File.

Affected Products

Application and Change Control 8.0.x
Application and Change Control 7.0.x
Application and Change Control 6.5.x
Application and Change Control 6.2.x
Application and Change Control 6.1
Configuration

Languages:

This article is available in the following languages:

English United States
Japanese

Glossary of Technical Terms

Highlight Glossary Terms

Please take a moment to browse our Glossary of Technical Terms.

Knowledge Center

Application and Change Control might not switch the protection mode with Windows FBWF installed

Environment

Problem

Cause

Solution

Affected Products

Languages:

Glossary of Technical Terms

Title

Title

Knowledge Center

Application and Change Control might not switch the protection mode with Windows FBWF installed

Environment

Problem

Cause

Solution

Affected Products

Languages:

Glossary of Technical Terms

Choose your region

Title

Title