LDAP queries increase when scanning Information Rights Management-protected files after updating to the 5800 Scan Engine

Technical Articles ID: KB87172
Last Modified: 1/27/2020

Environment

McAfee VirusScan Enterprise (VSE) 8.x
McAfee Anti-Malware Scan Engine 5.8.00 (5800)

Problem

Lightweight Directory Access Protocol (LDAP) queries increase when scanning Information Rights Management (IRM) protected files after you update the 5800 Scan Engine.

Cause

The function of querying Active Directory is an artifact of the Alert Manager product. The Alert Manager product has reached End of Life (EOL); but, there is still code within VSE that retains some of the Alert Manager functionality.

In an Active Directory environment, the Alert Manager Server would be located using an LDAP query. When the Active Directory Object for the Alert Manager server was found, the Alert would be sent to that server.

When the 5800 Scan Engine sees the IRM-protected file, it sends an alert through MFEANN.exe, which works with Alert Manager. Previous Scan Engine versions found nothing.

This behavior is expected and results from detection enhancements implemented with the 5800 Scan Engine.

Solution

This issue is resolved in VirusScan Enterprise 8.8.0 Update 9, which is available from the Product Downloads site at: https://www.mcafee.com/enterprise/en-us/downloads/my-products.html.

NOTE: You need a valid Grant Number for access. See KB56057 - How to download Enterprise product updates and documentation for more information about the Product Downloads site, and alternate locations for some products.

Updates are cumulative; Technical Support recommends that you install the latest one.

Workaround

CAUTION: This article contains information about opening or modifying the registry.

The following information is intended for System Administrators. Registry modifications are irreversible and could cause system failure if done incorrectly.
Before proceeding, Technical Support strongly recommends that you back up your registry and understand the restore process. For more information, see the Microsoft Windows registry information for advanced users article.
Do not run a REG file that is not confirmed to be a genuine registry import file.

In the VSE Console, disable Access Protection.
Press Windows+R, type regedit, and click OK.
Navigate to:

64-bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\McAfee\SystemCore\VSCore\Alert Client\VSE]
32-bit: [HKEY_LOCAL_MACHINE\SOFTWARE\McAfee\SystemCore\VSCore\Alert Client\VSE]

Select the No Active Dir value.

If the No Active Dir key is not present, create a new DWORD value name (called No Active Dir) by right-clicking New, DWORD(32-bit) value.
Double-click the No Active Dir value and change the value to 1.
In the VSE Console, enable Access Protection.

Workaround

In an ePolicy Orchestrator (ePO) managed environment, disable the Active Directory Lookup settings in the Alert Manager Policy.

Log on to the ePO console.
Click Menu, Policy Catalog.
From the Product drop-down list, select VirusScan Enterprise 8.8.
From the Category drop-down list, select Alert Policies.
Click your policy.
At the top, select either Workstation or Server from the drop-down list.
Select Do not use Active Directory Lookup and click Save.

Related Information

For product lifecycle details, see the McAfee Product and Technology Support Lifecycle page at http://www.mcafee.com/us/support/support-eol.aspx.
For EOL policy details, see the Enterprise Products End of Life Policy at http://www.mcafee.com/common/media/mcafeeb2b/support/terms/Support_Policy-Product_Support_EOL.pdf.

Affected Products

Known Issue/Product Defect
Scan Engine
VirusScan Enterprise 8.8

Languages:

This article is available in the following languages:

English United States
Spanish Spain
French
Italian
Japanese
Portuguese Brasileiro

Glossary of Technical Terms

Highlight Glossary Terms

Please take a moment to browse our Glossary of Technical Terms.

Knowledge Center

LDAP queries increase when scanning Information Rights Management-protected files after updating to the 5800 Scan Engine

Environment

Problem

Cause

Solution

Workaround

Workaround

Related Information

Affected Products

Languages:

Glossary of Technical Terms

Title

Title

Knowledge Center

LDAP queries increase when scanning Information Rights Management-protected files after updating to the 5800 Scan Engine

Environment

Problem

Cause

Solution

Workaround

Workaround

Related Information

Affected Products

Languages:

Glossary of Technical Terms

Choose your region

Title

Title