System crashes with Application Control bug check E0100010 on every boot

Technical Articles ID: KB83203
Last Modified: 1/3/2020

Environment

McAfee Application and Change Control (MACC) 6.1
Microsoft Windows (all supported versions)

Summary

This article describes an issue where the system might crash on every boot cycle with bug check E0100010.

Problem

MACC-generated bug check E0100010 is a crash that occurs if the system boots in Enable mode and the inventory (whitelist) is corrupt. A scan is performed on the inventory to determine if it is corrupted. When found, inventory corruption triggers an MACC recovery process. This recovery process forces the system to crash and boot into Disable mode.

Cause

The inventory (whitelist) can become corrupt in the following scenarios:

A crash or hard reboot occurs while the inventory is being updated with changes to files on the system.
The inventory has been edited or tampered with in Disable mode or Update mode.

Solution

This issue is resolved in MACC 6.1.3.392 and later. If upgrading is not a viable option, perform one of the workarounds provided in this article.

Workaround

Steps to recover:

Boot the system in Safe Mode with Networking.
Open a command prompt and run the scsrvc -d command.
NOTE: Keep the command prompt running.
Open another command prompt and run the sadmin disable command.
Reboot in normal mode.
Run the sadmin so command or push the solidification task from ePO and resolidify the system.
Enable MACC with the command sadmin enable or the enable task from ePO.

Workaround

CAUTION: This article contains information about opening or modifying the registry.

The following information is intended for System Administrators. Registry modifications are irreversible and could cause system failure if done incorrectly.
Before proceeding, Technical Support strongly recommends that you back up your registry and understand the restore process. For more information, see: http://support.microsoft.com/kb/256986.
Do not run a REG file that is not confirmed to be a genuine registry import file.

Place MACC in Disable mode by performing the following steps:

Boot the system into Safe Mode (press F5 before the Windows boot screen).
Open the Registry editor. Click Start, Run, type regedit, and click OK.
Navigate to the following registry key:

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\swin\Parameters]

Double-click DWORD RTEMode and change the value to 0.
Double-click DWORD RTEModeOnReboot and change the value to 0.
Reboot the system. MACC is now in Disable mode.

Affected Products

Application and Change Control 6.1
Known Issue/Product Defect

Languages:

This article is available in the following languages:

English United States
Japanese

Glossary of Technical Terms

Highlight Glossary Terms

Please take a moment to browse our Glossary of Technical Terms.

System crashes with Application Control bug check E0100010 on every boot

Environment

Summary

Problem

Cause

Solution

Workaround

Workaround

Affected Products

Languages:

Glossary of Technical Terms

Title

Title

Featured Solutions

Explore Our Portfolio

Security Outcomes

Industries

Products

Featured Solutions

Explore Our Portfolio

MVISION Products

Services & Training

Threat Research

Our Researchers

Threat Landscape Dashboard

Tools

Contact Us

Resources

Downloads

Product Help

Connect with Us

Explore

Our Company

Our Efforts

Other Resources

Careers

Partnerships

System crashes with Application Control bug check E0100010 on every boot

Environment

Summary

Problem

Cause

Solution

Workaround

Workaround

Affected Products

Languages:

Glossary of Technical Terms

Choose your region

Title

Title