Device rules do not work on endpoints after fresh extension installation

技術的な記事 ID: KB85290
最終更新: 12/22/2021

環境

McAfee Data Loss Prevention (DLP) Endpoint 11.x.x
McAfee ePolicy Orchestrator (ePO) 5.x
McAfee VirusScan Enterprise (VSE) 8.x

問題 1

The VSE Access Protection log records the following:

Blocked by Access Protection rule     NT AUTHORITY\LOCAL SERVICE    C:\Windows\system32\svchost.exe    \REGISTRY\MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Epoch    Common Maximum Protection:Prevent programs registering
as a service    Action blocked : Create
Blocked by Access Protection rule     NT AUTHORITY\LOCAL SERVICE    C:\Windows\system32\svchost.exe    \REGISTRY\MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Epoch2    Common Maximum Protection:Prevent programs registering
as a service    Action blocked : Create
Blocked by Access Protection rule     NT AUTHORITY\LOCAL SERVICE    C:\Windows\System32\svchost.exe    \REGISTRY\MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Epoch    Common Maximum Protection:Prevent programs registering
as a service    Action blocked : Create
Blocked by Access Protection rule     NT AUTHORITY\SYSTEM    C:\Windows\system32\svchost.exe    \Registry\Machine\System\CurrentControlSet\Services\LanmanServer\Shares    Common Maximum Protection:Prevent programs registering
as a service    Action blocked : Create
Blocked by Access Protection rule     NT AUTHORITY\LOCAL SERVICE    C:\Windows\system32\svchost.exe    \REGISTRY\MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Epoch    Common Maximum Protection:Prevent programs registering
as a service    Action blocked : Create
Blocked by Access Protection rule     NT AUTHORITY\LOCAL SERVICE    C:\Windows\system32\svchost.exe    \REGISTRY\MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Epoch2    Common Maximum Protection:Prevent programs
registering as a service    Action blocked : Create

問題 2

Event viewer records the following:

Error 1:

Log Name:      Application
Source:        McLogEvent
Event ID:      257
Task Category: None
Level:         Information
Keywords:      Classic
User:          SYSTEM
Description:
Blocked by access protection rule. Access to object \REGISTRY\MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Epoch2 was blocked by rule Common Maximum Protection:Prevent programs registering as a service.
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
<System>
    <Provider Name="McLogEvent" />
    <EventID Qualifiers="16384">257</EventID>
    <Level>4</Level>
    <Task>0</Task>
    <Keywords>0x80000000000000</Keywords>
        <EventRecordID>23620</EventRecordID>
    <Channel>Application</Channel>
</System>
<EventData>
    <Data>Blocked by access protection rule. Access to object \REGISTRY\MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Epoch2 was blocked by rule Common Maximum Protection:Prevent programs registering as a service.</Data>
</EventData>
</Event>

Error 2:

Log Name:      Application
Source:        McLogEvent
Event ID:      257
Task Category: None
Level:         Information
Keywords:      Classic
User:          SYSTEM
Description:
Blocked by access protection rule. Access to object \REGISTRY\MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Epoch was blocked by rule Common Maximum Protection:Prevent programs registering as a service.
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
<System>
    <Provider Name="McLogEvent" />
    <EventID Qualifiers="16384">257</EventID>
    <Level>4</Level>
    <Task>0</Task>
    <Keywords>0x80000000000000</Keywords>
    <EventRecordID>23619</EventRecordID>
    <Channel>Application</Channel>
</System>
<EventData>
    <Data>Blocked by access protection rule. Access to object \REGISTRY\MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Epoch was blocked by rule Common Maximum Protection:Prevent programs registering as a service.</Data>
</EventData>
</Event>

原因

The registry changes are configured to block in the VSE Access Protection rule Prevent programs registering as a service under the Common Maximum Protection category.

解決策

Exclude the following DLP folders in the VSE Access Protection rules:

C:\Program Files\McAfee\DLP

C:\ProgramData\McAfee\DLP

Enforce the policy and insert the removable storage device. The DLP Endpoint can now block and monitor the device.

影響を受ける製品

Data Loss Prevention Endpoint 11.6.x
Data Loss Prevention Endpoint 11.4.x (EOL)
VirusScan Enterprise 8.8

言語:

この記事は、次の言語で表示可能です:

English United States
Spanish Spain
French
Italian
Japanese
Portuguese Brasileiro

技術用語集

用語集にある用語をハイライトする

当社の技術用語集を参照してください。

Knowledge Center

Device rules do not work on endpoints after fresh extension installation

環境

問題 1

問題 2

原因

解決策

関連情報

影響を受ける製品

言語:

技術用語集

Title

Title

Knowledge Center

Device rules do not work on endpoints after fresh extension installation

環境

問題 1

問題 2

原因

解決策

関連情報

影響を受ける製品

言語:

技術用語集

地域を選択してください

Title

Title