Application and Change Control might not switch the protection mode with Windows FBWF installed

Technical Articles ID: KB77610
Last Modified: 5/20/2020

Environment

McAfee Application and Change Control (MACC) 8.x.x, 7.x.x, 6.x.x

Microsoft Windows Embedded (all supported versions)

Problem

MACC protection can be set to any of the following four modes:

Enable Mode
Disable Mode
Update Mode
Observation Mode

If Windows File Based Write Filter (FBWF) is enabled, switching the protection modes of MACC might not be successful.

For example, if you run sadmin disable to disable the MACC protection and restart the system, the system starts with MACC enabled.

Cause

MACC keeps the mode on reboot information in the registry. If FBWF is enabled, Windows prevents MACC from writing to the registry and the application starts in the same mode as before the restart.

Solution

Run the following command and add the config folder as an FBWF exclusion:

Fbwfmgr /addexclusion <system drive>\windows\system32\config

Example:

Fbwfmgr /addexclusion c:\windows\system32\config

Doing so allows write calls to the MACC registry keys and allows the mode on reboot information to be saved in the registry.

For more information about FBWF exclusion rules, see: http://msdn.microsoft.com/en-us/library/ee832773.aspx#Add_File.

Affected Products

Application and Change Control 8.0.x
Application and Change Control 7.0.x
Application and Change Control 6.5.x
Application and Change Control 6.2.x
Application and Change Control 6.1
Configuration

Languages:

This article is available in the following languages:

English United States
Japanese

Glossary of Technical Terms

Highlight Glossary Terms

Please take a moment to browse our Glossary of Technical Terms.

Application and Change Control might not switch the protection mode with Windows FBWF installed

Environment

Problem

Cause

Solution

Affected Products

Languages:

Glossary of Technical Terms

Title

Title

Featured Solutions:Draft for New Nav

Explore Our Portfolio

Security Outcomes

Industries

Products

Featured Solutions

Explore Our Portfolio

MVISION Products

Services & Training

Threat Research

Our Researchers

Threat Landscape Dashboard

Tools

Contact Us

Resources

Downloads

Product Help

Connect with Us

Explore

Our Company

Our Efforts

Other Resources

Careers

Partnerships

Application and Change Control might not switch the protection mode with Windows FBWF installed

Environment

Problem

Cause

Solution

Affected Products

Languages:

Glossary of Technical Terms

Choose your region

Title

Title