The Windows "Run" registry key gets deleted if Application and Change Control 6.1.1 is uninstalled

Technical Articles ID: KB79793
Last Modified: 12/19/2019

Environment

McAfee Application and Change Control (MACC) 6.1.1

Problem

The following Windows registry gets deleted if MACC 6.1.1 is uninstalled from the system:

[HKLM/SOFTWARE/Microsoft/Windows/CurrentVersion/Run]

Solution

IMPORTANT: Upgrade to the hotfix mentioned below before you uninstall MACC 6.1.1. See the MACC 6.1 Installation Guide for information about upgrading.

Technical Support recommends that you upgrade to MACC 6.1.1-379 or later.

McAfee product software, upgrades, maintenance releases, and documentation are available from the Product Downloads site at: http://www.mcafee.com/us/downloads/downloads.aspx.

NOTE: You need a valid Grant Number for access. KB56057 provides additional information about the Product Downloads site, and alternate locations for some products.

Workaround

For systems with VSE installed, do the following:

Log on to the ePO console.
Click Menu, Policy, Policy Catalog.
Select VirusScan Enterprise 8.8.0 from the Product drop-down list and select Access Protection Policies from the Category drop-down list.
Click the appropriate policy under the Category column.
Click User-defined Rules for Categories and click New.
Select Registry Blocking Rule as Rule type and click OK.
Enter the following:
- RUN Key Protection for Rule name.
- Enter the following in Processes to include:
  
  msiexec.exe, explorer.exe, regedit.exe
- Select HKLM for the Registry entry and enter /SOFTWARE/Microsoft/Windows/CurrentVersion/Run in the text box.
- Select Key for the Registry key or value to protect entry.
- Select Delete key or value for Registry actions to block.
  NOTE: A complete properties snapshot is also attached for reference.
Click OK, Save.
Send an Agent Wakeup call to enforce policy.
Uninstall MACC 6.1.1.

Affected Products

Application and Change Control 6.1

Languages:

This article is available in the following languages:

English United States
Japanese

Glossary of Technical Terms

Highlight Glossary Terms

Please take a moment to browse our Glossary of Technical Terms.

The Windows "Run" registry key gets deleted if Application and Change Control 6.1.1 is uninstalled

Environment

Problem

Solution

Workaround

Affected Products

Languages:

Glossary of Technical Terms

Title

Title

Featured Solutions

Explore Our Portfolio

Security Outcomes

Industries

Products

Featured Solutions

Explore Our Portfolio

MVISION Products

Services & Training

Threat Research

Our Researchers

Threat Landscape Dashboard

Tools

Contact Us

Resources

Downloads

Product Help

Connect with Us

Explore

Our Company

Our Efforts

Other Resources

Careers

Partnerships

The Windows "Run" registry key gets deleted if Application and Change Control 6.1.1 is uninstalled

Environment

Problem

Solution

Workaround

Affected Products

Languages:

Glossary of Technical Terms

Choose your region

Title

Title