The Windows "Run" registry key gets deleted if Application and Change Control 6.1.1 is uninstalled

Technical Articles ID: KB79793
Last Modified: 12/19/2019

Environment

McAfee Application and Change Control (MACC) 6.1.1

Problem

The following Windows registry gets deleted if MACC 6.1.1 is uninstalled from the system:

[HKLM/SOFTWARE/Microsoft/Windows/CurrentVersion/Run]

Solution

IMPORTANT: Upgrade to the hotfix mentioned below before you uninstall MACC 6.1.1. See the MACC 6.1 Installation Guide for information about upgrading.

Technical Support recommends that you upgrade to MACC 6.1.1-379 or later.

McAfee product software, upgrades, maintenance releases, and documentation are available from the Product Downloads site at: https://www.mcafee.com/enterprise/en-us/downloads/my-products.html.

NOTE: You need a valid Grant Number for access. See KB56057 - How to download Enterprise product updates and documentation for more information about the Product Downloads site, and alternate locations for some products.

Workaround

For systems with VSE installed, do the following:

Log on to the ePO console.
Click Menu, Policy, Policy Catalog.
Select VirusScan Enterprise 8.8.0 from the Product drop-down list and select Access Protection Policies from the Category drop-down list.
Click the appropriate policy under the Category column.
Click User-defined Rules for Categories and click New.
Select Registry Blocking Rule as Rule type and click OK.
Enter the following:
- RUN Key Protection for Rule name.
- Enter the following in Processes to include:
  
  msiexec.exe, explorer.exe, regedit.exe
- Select HKLM for the Registry entry and enter /SOFTWARE/Microsoft/Windows/CurrentVersion/Run in the text box.
- Select Key for the Registry key or value to protect entry.
- Select Delete key or value for Registry actions to block.
  NOTE: A complete properties snapshot is also attached for reference.
Click OK, Save.
Send an Agent Wakeup call to enforce policy.
Uninstall MACC 6.1.1.

Affected Products

Application and Change Control 6.1

Languages:

This article is available in the following languages:

English United States
Japanese

Glossary of Technical Terms

Highlight Glossary Terms

Please take a moment to browse our Glossary of Technical Terms.

Knowledge Center

The Windows "Run" registry key gets deleted if Application and Change Control 6.1.1 is uninstalled

Environment

Problem

Solution

Workaround

Affected Products

Languages:

Glossary of Technical Terms

Title

Title

Knowledge Center

The Windows "Run" registry key gets deleted if Application and Change Control 6.1.1 is uninstalled

Environment

Problem

Solution

Workaround

Affected Products

Languages:

Glossary of Technical Terms

Choose your region

Title

Title