Application Control 8.x Known Issues (Windows)

Technical Articles ID: KB87839
Last Modified: 12/30/2021

Environment

McAfee Application and Change Control (MACC) 8.x.x

Summary

Recent updates to this article

Date	Update
December 30, 2021	Added: MACC 8.3.4.(Windows) release details. Known and Resolved MACC 8.3.4 issues. Expand and Collapse All feature.
July 28, 2021	Updated Extension build and Client build details for 8.3.3 (GA).
June 4, 2021	Added issue 599348 under Client issues in the "Non-critical Application Control known issues" section.
May 17, 2021	Added issue MACC-10735 to the "Non-critical Solidcore Extension known issues" section.

To receive email notification when this article is updated, click Subscribe on the right side of the page. You must be logged on to subscribe.

NOTE: Known issues listed for previous builds still exist in newer builds, unless identified in this article as fixed.

Contents:
Click to expand the section you want to view:

Product release information

To review the release notes, visit the McAfee Enterprise Documentation site.

Application Control Version	Client Build	Extension Build	Release Date
8.3.4 (GA)	8.3.4.225.3	8.3.4.124	December 29, 2021
8.3.3 (GA)	8.3.3.129	8.3.3.122	June 29, 2021
8.3.2 (GA)	8.3.2.133.2	8.3.2.103	October 13, 2020
8.3.1 (GA)	8.3.1.124.2	8.3.1.111	August 25, 2020
8.3.0 (GA)	8.3.0.303.2	8.3.0.225	March 24, 2020

8.2.6 (GA)	8.2.6.141.3	8.2.6.103	March 24, 2020
8.2.1.535 Hotfix 9 (RTS)	Unavailable	Unavailable	December 17, 2019
8.2.1.482 Hotfix 8 (RTS)	Unavailable	Unavailable	November 18, 2019
8.2.1 Update 5 (GA) Repost	8.2.1.435	8.2.1.229	September 25, 2019
8.2.1 Update 5 (GA)	8.2.1.407	8.2.1.229	September 10, 2019
8.2.1 Update 4 (RTS)	8.2.1.312	8.2.1.210	June 25, 2019
8.2.1 Update 3 (GA)	8.2.1.143	-	March 6, 2019
8.2.1 Hotfix 1 (GA)	-	8.2.1.121	May 2, 2019
8.2.1 (GA)	8.2.1.114	8.2.1.114	October 2, 2018
8.2.0 (GA)	8.2.0.140	8.2.0.126	August 14, 2018

8.1.1 (GA)	-	8.1.1.103	June 12, 2018
8.1.0.179 (GA) Reposted	8.1.0.179	8.1.0.129	May 15, 2018
8.1.0 (GA)	8.1.0.169	-	April 24, 2018

8.0.2 Update 1 (GA)	8.0.2.233	-	March 12, 2019
8.0.2 Hotfix 3	8.0.2.228	-	February 5, 2019
8.0.2 (GA)	8.0.2.125	8.0.2.118	July 10, 2018
8.0.1 (GA)	8.0.1.223	8.0.1.110	May 8, 2018
8.0.0 Hotfix 5	8.0.0.950	8.0.0.242	February 14, 2018
8.0.0 Hotfix 4	8.0.0.875	8.0.0.231	December 12, 2017
8.0.0 Hotfix 3	Unavailable	Unavailable	October 25, 2017
8.0.0 Hotfix 2	8.0.0.817	8.0.0.203	August 15, 2017
8.0.0 Hotfix 1	8.0.0.783	8.0.0.194	July 11, 2017
8.0.0 (GA)	8.0.0.651	8.0.0.182	December 12, 2016

GA=General Availability
RTS=Released to Support

Critical Application Control known issues

There are no critical issues.

Non-critical Application Control known issues

Contents

Client Issues - Under investigation
Client Issues - Resolved
Client Issues - Won’t Fix
Client Issues - Expected Behavior

Client Issues - Under investigation
Reference	Related Article	Found In	Fixed In	Description
MACC-8938	-	8.3.0.303 and later	-	Issue: Buffer Overflow with TIE/GTI causes the scsrvc service to crash. Workaround: Disable TIE/GTI reputation.
MACC-10318	-	8.3.2	-	Issue: Windows version 20H2 installation fails when the Application control is in the Enable Mode. Workaround: From the ePO or client, add the updater rule and then install Windows. sadmin updaters add -p services.exe “\Program Files\Common Files\microsoft shared\ClickToRun\OfficeClickToRun.exe”
MACC-10313	-	8.3.2	-	Issue: When MACC is upgraded from version 8.0.2 to 8.3.x and rebooted, the client upgrade status remains as reboot needed.
MACC-10311	KB93605	8.3.2	-	Issue: In rare cases, the installation of binaries stops for an indefinite period when Package Control and antivirus service are enabled on the system. Workaround: From the ePO or client, configure the passthrough process for antivirus service in Solidcore. Example: In Windows Defender, add the rule: sadmin attr add -p MsMpEng.exe After the passthrough process for antivirus is configured, reboot and run the installer again.
MACC-10327	-	8.3.2	-	Issue: Incorrect offset calculation can sometimes lead to a bug check on Windows 8.1 and Windows 10 x86 systems.
MACC-10295	-	8.3.2	-	Issue: When a client task for enable is triggered from ePO, the Solidcore client doesn’t receive the enable task from MA and sometimes command line interface also stops. Workaround: From the ePO or on client, set the "MaplErrorHandlerEnabled=0" configuration, and restart the enable task.
MACC-10051	-	8.2.1	-	Issue: Unable to create FILE_ATTR_MODIFIED/FILE_ATTR_MODIFIED_UPDATE events even when the registry value is set to 0 for FileAttrCTrack.
MACC-9939	-	8.3.1	-	Issue: One of the Solidcore.log files is displayed as soli.log in the %programdata%/McAfee/Solidcore path.
MACC-10041	-	8.3.1	-	Issue: You try to move the bat script file from a removable or unremovable drive that has skiplist -v applied. On the first attempt, you see the message: Access Denied. Workaround: The second attempt allows moving of the bat script.
MACC-9920	-	7.0.x	-	Issue: Performance issues (high cpu/memory) seen with Reputation enabled on 7.0 and later on observe mode. Cause: Frequent inventory merges that cause high CPU use. Workaround: Disable reputation or go to update/enabled mode.
TSDE-5590	-	8.2.6 and later	-	Issue: Can't insert duplicate key in object 'dbo.SCOR_APPLICATIONS' due to violation of UNIQUE KEY constraint 'SCOR_UNIQUE_CHKSUM'. The duplicate key value is (<NULL>). Cause: This issue occurs when you try to import rule groups having multiple installers with the same AppName and version. If there are multiple installers with different chksum values that have the same appName and version, and if there’s more than one such appName, you see this error. Example: In the following scenario, there’s a bug in the parsing rulegroup xml for installers: 1st App: appName1, version1 installer1: cksum_value1 installer2: cksum_value2 And so on.... 2nd App: appName2, version2 installer1: cksum_value3 installer2: cksum_value4 And so on.... And so on for different appNames Workaround: Don't have multiple installers with the same appName and version in the rulegroup xml.
TSDE-4988	-	8.2.1.143	-	Issue: Some files are denied execution in observe mode. Some files are unsolidified and are denied execution.
MACC-9083	-	8.2.1.435	-	Issue: Delay in website from ASP.net (IIS) on clients with Application control enabled. Workaround: Run the command: sadmin skiplist add -b "c:\Windows\assembly\GAC_32\System.Web\ 2.0.0.0__b03f5f7f11d50a3a\System.Web.dll" NOTE: The above command must be in a single line.
MACC-8897	-	8.2.1.143	-	Issue: Observe mode isn’t pulling inventory because of a deny by Reputation block. Workaround: Disable Reputation (GTI/TIE).
MA-6278 MACC-8897		8.2.1.435	-	Issue: The Scsrvc.exe constantly crashes because of a Msgbus.dll issue.
TSDE-5022	-	8.1 and above	-	Issue: Process marked as updaters don’t get updater permissions. This issue affects all SysCore versions. You see the following log error: ERROR: cap_kern.c : 1786: Failed to compute checksum for '<file>'. err = 1002 Workaround: Run the command Sadmin config set CksumCalcMode=0 and then reboot or relaunch the process.
TSDE-4217	-	8.2.1.435	-	Issue: The MPCompat Key value is overwritten to the default value (1) during the upgrade. NOTE: This issue occurs in all versions except the Solidcore Client version 7.0.2. Workaround: Reconfigure the parameter using: sadmin config set MPCompat="value"
MACC-8759	-	8.2.1.435	-	Issue: The SoIsTidOptimizationEnabled Key value is overwritten to the default value (1) during the upgrade. NOTE: This issue occurs when an earlier Solidcore Client version is upgraded from 8.0.0.855 to 8.0.0.875 or later. Workaround: Reconfigure the parameter using: sadmin config set SoPriority="value"
MACC-8759	-	8.2.1.435	-	Issue: The SoPriority Key value is overwritten to the default value (1) during the upgrade. NOTE: This issue occurs when an earlier Solidcore Client version is upgraded to 8.2.1.114 or later. Workaround: Reconfigure the parameter using: sadmin config set SoPriority="value"
MACC-8746	-	8.3.0.225	-	Issue: There’s a wrong copyright string for the Extension build 8.3.0.225.
MACC-8891	-	8.3.0.225	-	Issue: After the Solidcore standalone installer (InstallShield) is run, the End User License Agreement (EULA) page in the InstallShield wizard displays "EULA (April 2017)".
MACC-8574	-	8.3.0.225	-	Issue: In the Inventory mode, the "SC Begin Update mode" and "SC Observe mode" ePO client tasks when executed, take some time to complete. The reason is because the inventory reconciliation is automatically executed in advance. The time taken is based on the number of files with mismatches, such as checksum and types. Recommendation: Check the task "begin update" or "observe" is completed before the reboot.
MACC-8694	-	8.2.6	-	Issue: Write denied events are seen for .js files after the Windows upgrade.
MACC-9053	-	8.2.6	-	Issue: Copyright version for MACC binaries is displayed as 2019.
MACC-8756	-	8.2.1.435	-	Issue: The Following value is getting overwritten to default value 1 during the upgrade: NOTE: The issue occurs in the following upgrade cases. 8.2.1 Update 3 to Update 4 8.2.1 Update 3 to Update 5 8.2.1 Update 4 to Update 5 Workaround: Reconfigure the parameter using: sadmin config set RemoteFileModificationBypassConfig=0
MACC-8419	-	8.2.1.435	-	Issue: System crash with bug check C2.
MACC-7386	-	8.2.1.435	-	Issue: Renaming of Folder containing solidcore files isn’t blocked.
MACC-7222	-	8.2.1.435	-	Issue: Change tracking event isn’t generated when shared folders are modified from on a remote system.
-	-	8.2.1.143	-	Issue: MACC doesn’t detect changes made from a remote system to a file in a shared directory. The result is content change tracking events aren’t generated.
1256220	-	8.2.1	-	Issue: The Solidcore installation folder isn’t removed after an Uninstall Task.
1257589	-	8.2.1	-	Issue: Deploying Application Control via the ePO Product Deployment workflow doesn’t report back installation status. Even though installation status reporting is impacted, installation of the product can complete normally.
1266718	-	8.2.1	-	Issue: Blue screen (kmode exception not handled) after you reboot a system on Windows. Workaround: After you install MACC and before you do a partial enable, if you’ve installed a VSCore version older than 18.12, reboot the system. Then do the partial enable.
1266827	-	8.2.1	-	Issue: BSOD - DRIVER_UNLOADED_WITHOUT_ CANCELLING_PENDING_OPERATIONS - After execute enable full, disable, and enable limited. Workaround: Send SC: Run commands: task with sadmin clean C:. Then, send task enable with limited activation. Do the same if it’s a standalone.
1259000	KB91225	8.2.0	-	Issue: A system crash without blue screen or a CLI crash occurs on Windows 10 or Server 2016 systems after you place MACC in modes other than Disabled.
1259343	-	8.1.1	-	Issue: Windows servers 2003 SP2 becomes unresponsive when MAC is installed.
1225038	-	8.1.0	-	Issue: Repeated rows per system and request made in Policy Discovery page.
1231217	-	8.1.0	-	Issue: Wrong labels in Approval status drop-down list on the Policy Discovery page.
1231583	-	8.1.0	-	Issue: 'User Comments' repeated for Observations with Global Prevalence greater than 1 on the Policy Discovery page.
1237773	-	8.1.0	-	Issue: Client task for enabling MACC from ePO fails (the second line in the progress bar becomes red). Workaround: Using the command line interface on the client to be solidified, run the command instaconfig /connect as administrator. After you run the command, run the MACC enable task from ePO again. A restart isn’t needed.
1210913	-	8.1.0	-	Issue: SolidCore CASP Code Injection can be bypassed when address is tagged as RX before calling kernel32.dll.
219284	-	8.1.0	-	Issue: Write-protected files can be deleted from the command line when their name exceeds a certain length (DOS short name associated).
1221213	-	8.1.0	-	Issue: Executable files (.exe) in network drives aren’t allowed to be executed when they are in trusted folders.
1223577	-	8.1.0	-	Issue: The swin1.sys file isn’t deleted after MACC is set as Enable.
1230980	-	8.1.0	-	Issue: The wrong error message is displayed when you upgrade MACC on an x64 Windows 10 system with an x86 installer.
1272591	KB79201	8.0.0	-	Issue: For JAR files, the Java interpreter can run a JAR file from any extension. Renaming a valid JAR file to a file with a different extension still allows it to be executed. Workaround: See the related article for details.
1168664	-	8.0.0	-	Issue: Execution control rules are removed and reapplied when policy update is received from ePO.
1170115	-	8.0.0	-	Issue: Under certain circumstances, Missed/Change reputation notification isn’t received on endpoints.
1156303	-	8.0.0	-	Issue: Write/Read denied events not raised while changing a write/read protected file using bash.
1191934	-	8.0.0	-	Issue: ActiveX feature with Webex plug-in causes the TIE database to fill with multiple attempts to resolve _Eatgpc.dll.
1161191	-	8.0.0	-	Issue: [Windows 8] The block interpreter behaves differently between Windows 7 and Windows 8 and later, when a rule is added after the interpreter is started. Behavior on Windows 7 platform: Already started interpreter is terminated. Behavior on Windows 8 and later: Already started interpreter isn’t terminated.
MACC-8708	-	7.0	-	Issue: Solidcore policies can't be duplicated using the Policy Details page because the OK button is disabled. NOTE: This issue occurs in MACC 7.0 and later. Workaround: Use the Policy Catalog page to duplicate policies.
1273074 1274763	KB91569	7.0	-	Issue: Updater rights and permissions unexpectedly granted to svchost.exe. Workaround: See the related article for details. Back to Contents
Client Issues - Resolved
Reference	Related Article	Found In	Fixed In	Description
MACC-10930		8.3.3	8.3.4	Issue: The SCCM updates are blocked. Solution: The default rules now allow SCCM updates without any fail after adding SCCM client rules to the directory.
MACC-10776		8.3.3	8.3.4	Workaround: Solidification status window doesn't hang when you execute the command sadmin config set MaplCommLostRestart=0 and start solidification with sadmin while running the Solidcore with Update Mode enabled.
MACC-10886		8.3.3	8.3.4	Issue: When you enable Observe or Update mode. and reboot the system, it goes into a repair state, and the system must be rebuilt. Solution: A System Crash (Blue screen) doesn't appear on the system when you run Solidcore with Observe Mode or Update Mode enabled. It works successfully on the next reboot of the system.
MACC-10684		8.3.3	8.3.4	Workaround: The VTP_Trusted error message is fixed and is no longer displayed.
MACC-10504		8.3.2	8.3.4	Issue: First reboot after a product upgrade, the system remains in an endless logon screen.
MACC-10663		8.3.2	8.3.4	Issue: Blank blue screen appears when Solidcore is enabled with Inventory Mode and Observe Mode. Workaround: When you enable Solidcore with both the Inventory Mode and Observe Mode, blue screen error doesn't appear on the system.
MACC-10796		8.3.0	8.3.4	Workaround: The finetune.bat entry issue with the correct DLL name on the operating system is resolved.
MACC-10653		8.3.3	8.3.4	Issue: A massive influx of new file write denied events is noticed as a result of Windows 10 upgrade. Workaround: MACC now allows automatic clean-up of previous version of the windows after adding C:\windows.old to default windows updater group.
MACC-10013		8.3.0, 8.3.1, 8.3.3, 8.2.1.435	8.3.4	Issue: When you try to execute binaries by adding trusted rule in a network shared path, .exe file isn’t executed. Workaround: The issue is resolved. All binary files including .exe file can be executed.
MACC-10368		8.3.0.303	8.3.2.270	Issue: Bug Check 9F issue occurs when you shut down the system.
MACC-10554		8.3.0.303	8.3.2.270	Issue: CMD files are now solidified in enable mode when copied through file sharing by a trusted user.
MACC-9256		8.3.0.303	8.3.2.270	Issue: After installation, Windows hangs on start or causes startup to hang. Affects Windows 7 and later. Solution: Fix in 8.3.2.270 and later + set "sadmin config set ServiceStartFinetune=7" after install before reboot for new boot changes.
MACC-10366		8.3.1.124	8.3.2.270	Issue: In rare cases, scsrvc.exe might crash with heap corruption. Workaround: Open regedit and navigate to: HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\scsrvc.exe Create a DWORD value if it doesn’t exist FrontEndHeapDebugOptions Set its value to 8.
MACC-3100		8.2.1.435 8.3.0.303	8.3.1.124	Issue: System crash with BugCheck 3B. NOTE: If the current state of bit-16 in CustomerConfig is 0, flipping it to 1 in Disabled/Enable/Observe/Inventory mode can result in a crash. A similar crash can be observed if this bit is 0 and a product upgrade is undertaken. The reason is because the upgrade process might set this bit to 1. This problem only affects Windows 10 and Windows Server 2016 and later.
MACC-8396	-	8.2.1.435	8.2.6.141 Update 6 and later	Issue: Bug check E3 with SWIN.SYS after you upgrade to MACC 8.2.1.435 (Update 5).
MACC-8568 MACC-8391	-	8.2.1.435	8.2.1.482 Hotfix 8 (RTS)	Issue: Kernel memory leak in MFE0 and Q* tags after you upgrade to MACC 8.2.1.435 (Update 5).
MACC-8375	-	8.2.1.114	8.2.1.435 Update 5 Repost	Issue: Communication issues with MA 5.0.6 when MACC 8.2.1.114 and VSE 8.8 are installed on Windows 7 and 2008 R2.
-	KB91933	8.2.1.407	8.2.1.435 Update 5 Repost	Issue: Execution Control feature causes CMD and other processes to crash after you upgrade from any version of MACC to 8.2.1.407 (Update 5).
	KB91331	8.0.0	8.2.1.435 Update 5 Repost	Issue: Temporary folder C:\Windows\Temp\Solidcore isn’t removed after you upgrade Application and Change Control.
1027687	KB84043	8.0	8.2.1.435 Update 5 Repost	Issue: Upgrade to Application and Change Control fails for endpoints.
1269088 1270552	-	8.2.1	8.2.1.435 Update 5 Repost	Issue: Addition of new MPT 19.4-175.4 now solves the solidification problem.
1270348	-	8.2.1	8.2.1.435 Update 5 Repost	Issue: Extra check in of pkgc_allow_installation configuration doesn’t restrict bypassing application allow list. NOTE: Previously resolved with 8.2.1 Update 4 (RTS).
1269322	-	8.2.1	8.2.1.435 Update 5 Repost	Issue: The file scorsapr.dll is now signed with McAfee certificate.
1268997	-	8.2.1	8.2.1.435 Update 5 Repost	Issue: The Execution Control configuration resets after reboot.
1269626	-	8.2.1	8.2.1.435 Update 5 Repost	Issue: Boot time impacted by Package Control's registries enumeration.
1267287	-	8.2.1.114	8.2.1.435 Update 5 Repost	Issue: Loading of Summary Events in Event Viewer takes more time when AC 8.2.1.114 is enabled.
1258932	-	8.2.1	8.2.1.435 Update 5 Repost	Issue: Unsolidified binary file fails to execute after you rename it to pre-existing.
1262920	-	8.2.1	8.2.1.435 Update 5 Repost	Issue: Windows update now successfully executes on comctl32.dll and gdiplus.dll after reboot.
1257931	-	8.2.1	8.2.1.435 Update 5 Repost	Issue: Access denied message shown when you run a file with Windows short name notations.
1258074	-	8.2.1	8.2.1.435 Update 5 Repost	Issue: Solidification status now remains same when you run chkdsk.
1264297	-	8.2.1	8.2.1.435 Update 5 Repost	Issue: MACC configured with limited features activation failed to load successfully after a service restart.
1268086	-	8.2.1	8.2.1.435 Update 5 Repost	Issue: MACC service no longer crashes when new updater rules are added.
1273790	-	8.2.1	8.2.1.435 Update 5 Repost	Issue: VTP not added to handle Microsoft allow listed binaries.
TSDE-1863	-	8.2.1	8.2.1.435 Update 5 Repost	Issue: ePO property "upgrade status" isn’t updated after reboot.
MACC-6791	-	8.2.1	8.2.1.435 Update 5 Repost	Issue: Temporary folder was removed on upgrade.
MACC-5898	-	8.2.1	8.2.1.435 Update 5 Repost	Issue: The swin1.sys file now is deleted after Solidcore is set as enable.
MACC-6649	-	8.2.1	8.2.1.435 Update 5 Repost	Issue: Windows Updates doesn’t fail with Solidcore in any mode.
MACC-6708	-	8.2.1	8.2.1.435 Update 5 Repost	Issue: The file InteLPPM.sys isn’t blocked now.
1259045 1261196 1267181 1267203	-	8.0.1	8.2.1.143 Update 3	Issue: Updated dlls aren’t updated in the local allow list. February Updates fail on 8.0.2 and 8.2.1. Microsoft update installation fails and rolls back. Execution Denied (checksum-mismatch) when a file is modified through a hard link.
1254892	-	8.0.2	8.2.1.143 Update 3	Issue: Files marked as updater don’t work as expected.
1254539	-	8.0.0	8.1.0.179	Issue: Error “another generic command is running” while inventory is fetched.
1253554	-	8.0.0	8.2.1.143 Update 3	Issue: Added rules to skip pagefile.sys, hiberfil.sys, and swapfile.sys files from deny exec feature.
1247415	-	8.0.1	8.2.1.143 Update 3	Issue: MAC 8.x sadmin trusted command now can be configured with multiple pathnames.
1253497	-	8.2.0	8.2.1.143 Update 3	Issue: Process path is shown as c:\$recycle.bin\.\.\.
1256965	-	8.2.0	8.2.1.143 Update 3	Issue: Testing Application Control 8.2.0.156 and system crash with bug check 1E encountered.
1257100	-	8.2.1	8.2.1.143 Update 3	Issue: CASP doesn’t work and it can't detect an exploit in MACC 8.2 and later.
1258630	-	8.2.0	8.2.1.143 Update 3	Issue: The attr -c can't bypass the CASP process on MACC 8.2.x.
1258932	-	8.2.1	8.2.1.143 Update 3	Issue: Unsolidified binary file is executable with renaming it to other inventory file name.
1259008	-	8.2.1	8.2.1.143 Update 3	Issue: After solidification completes, the system is stuck in update mode unable to control client.
1259925	-	8.2.1	-	Issue: Files added to the updater process remained unsolidified after you upgrade to 7.0.1.462.
1260583	-	8.2.1	8.2.1 Update 3	Issue: Safe-mode-protect feature doesn’t work in the mentioned version.
1261927	-	8.2.1	8.2.1 Update 3	Issue: BugCheck 3B - swin.sys, Win 10 with MACC 8.2.1.
1262892	-	8.2.1	8.2.1 Update 3	Issue: Uninstall of non-msi applications isn’t allowed when 'Allow uninstallation' feature is enabled.
1262925	-	8.2.1	8.2.1 Update 3	Issue: Solidcore blocks .NET. PS1 in temp folders.
1188255	KB91257	7.0.0	8.2.1 Update 3 8.0.2 Update 1	Issue: [Windows 10] MACC prevents the Windows Defender Update process from running successfully. Resolution: Apply the correct update for your version of Application Control: Application Control 8.2.1 Update 3 Application Control 8.0.2 Update 1 See the related article for more guidance.
1247479	KB90785	8.2.0	8.2.1.143 Update 3	Issue: Upgrade from MACC 8.1.0 to MACC 8.2.0 in Windows 32-bit fails. Workaround: See the related article for details.
-	KB91257	8.0	8.2.1 Update 5 8.0.2 Update 1	Issue: Application Control and Change Control driver issues (Windows Update). Resolution: You must resolidify any system that was upgraded to latest version that was below 8.2.1.143 release. You only have to resolidify once after upgrade. NOTE: If the system is newer than 8.2.1.143 and has been resolidified once, resolidification on upgrade isn’t needed.
-	KB90785	8.2.0 8.1.0	8.2.1.143	Issue: System processes fail to start during upgrade of Application and Change Control from 8.1.x to 8.2.0. Workaround: Disable MP-CASP before you upgrade to the latest version of MACC.
1232088	-	8.1.0	8.2.1.114	Issue: FILE MODIFIED events aren’t generated for any file with the "monitor file" rule added.
1247171	-	8.2.0	8.2.1	Issue: Windows 7 endpoints turn into limited activation after you send a full activation task. Workaround: To make a full feature activation on MACC 8.2.0 and later for Windows 7: Send an Enable task as a Limited Feature Activation. Restart the client.
1247758	-	8.1.1	8.2.1	Issue: Extension upgrade from MACC 8.1.1 to another MACC version fails in step 6.
1239874	-	8.1.0	8.2.0	Issue: McAfee Default rule groups are removed after you upgrade to Solidcore ePO Extension 8.1.0.
1241551	-	8.1.0	8.2.0	Issue: Policy Discovery events aren’t displayed on the Policy Discovery page after events are sent from endpoint.
1245623	-	8.1.0	8.2.0	Issue: When you try to import the inventory created as an XML file, the following error is displayed: Inventory could not be imported.
124551	KB90779	8.1.0.129 8.1.1.103	8.2.0	Issue: Application Control Policy Discovery events missing when extension 8.1.0.129 or 8.1.1.103 are installed.
1237379	KB90585	8.1.0.169 8.1.0.179	8.1.1	Issue: Service fails to start after installation is complete on Windows 10.
1227853	-	8.1.0	8.1.1	Issue: When you create a custom filter on the System Tree page the application service crashes.
1197702	KB89466	8.0.0	8.0.0.817	Issue: Script As Updater injection into all application and system processes results in degraded performance and system crashes.
1203341	KB89678	8.0.0	8.2.1.435	Issue: Application and Change Control prevents installation of Endpoint Security. Workaround: Disable Memory Protection.
-	KB89743	8.0.0.651	8.0.0.783	Issue: Application and Change Control doesn’t communicate with ePolicy Orchestrator when you use McAfee Agent 5.0.6.
1205042 1221210 1232397 1220969 1231655 1240535	KB90607	8.0.0	8.0.1.233	Issue: Bug check 7f system crash occurs on systems protected by Application Control.
-	KB90083	8.0.0.855	8.0.1.223	Issue: Application and Change Control causes a system crash when a limited activation Enable task is run.
-	KB88747	8.0.0	Latest extension	Issue: Web MER.exe blocked on client while Application Control is in enabled mode.
1188886	-	8.0.0	8.0.1.223	Issue: AC8 takes twice as long to solidify than AC 7.
-	KB89386	8.0.0	8.0.1.223	Issue: MACC 8.0 consumes a greater number of resources than the previously released versions, resulting in performance issues.
1186809	-	8.0.0	8.0.0.817 Update 2	Issue: The PKG-CTRL-ALLOW-Uninstall gives CMD updater permissions, when CMD /C is in the UninstallString Registry string.
1193571	-	8.0.0	8.0.0.783 Update 1	Issue: System doesn’t start in Observe or Update mode if SAU is enabled.
1049573	KB85156	8.0.0	8.0.0.651	Issue: System slows or stops responding while accessing files over the network.
1269043 1254539	KB91353	8.0.2.228	n/a	Issue: Application Control SC: Run Commands quit when policy enforcement occurs. Resolution: Create an Application Control Client task. See the related article for details.
1250277	-	8.2.0	n/a	Issue: When you enable the Application Control license with limited activation or Change Control license, it results in a crash after you upgrade from 8.1.0.179 to 8.2.0.140. Resolution: See the related article for details.
1269043	KB91353	8.2.1.143	n/a	Issue: Application Control SC: Run Commands quit when policy enforcement occurs. Resolution: See the related article for details.
1271531	KB91528	8.1.0	8.3.0 8.2.6	Issue: Application Control installer enters a hung state during a new installation or upgrade from a previous version. Resolution: See the related article for details.
1189702	-	8.0.0	n/a	Issue: The scsrvc.exe service hangs during restart when in disable mode because Cryptsvc starts after our service. Resolution: Microsoft suggested you add a dependency in Solidcore service: sc config scsrvc depend= cryptsvc.
-	-	8.0	MA 5.0.5	Issue: McAfee Agent high CPU consumption with MACC installed.
1177471	KB88869	8.0	Win 10 RS2	Issue: High CPU use occurs when Windows Credential Manager is enabled on clients with Application Control installed.
-	KB89679	8.0.0.651	n/a	Issue: Solidifier hangs on reboot when going from enable mode to disable mode.
1168594	KB88271	8.0	n/a	Issue: VTP trust for Application and Change Control is lost after you install McAfee Agent.
-	KB86638	8.0	n/a	Issue: Performance issues on Application Control endpoints when Global Threat Intelligence and Threat Intelligence Exchange communication fails. Resolution: Disable GTI/TIE in the policy. See the related article for details. Back to Contents
Client Issues - Won’t Fix - See the related articles for a resolution or workaround.
Reference	Related Article	Found In	Fixed In	Description
599348	-	8.0	n/a	Issue: On viewing the properties of a file on the local drive, deny-write and deny-exec events are generated for the solidified and unsolidified files, respectively.
1269943	KB91502	8.2.0 8.2.1	n/a	Issue: An executable file can't be started from a trusted share or mapped drive. Workaround: See the related article for details.
1181193	KB89179	8.0	n/a	Issue: Application Control prevents Data Loss Prevention policy enforcement on files attached to outgoing mail.
-	KB91353	8.2.1.143 8.0.2.228	n/a	Issue: Application Control SC: Run Commands end when policy enforcement occurs. Resolution: Set MaplCommLostRestart=0.
-	KB77610	8.0	n/a	Issue: Application Control and Change Control might not switch the protection mode with Windows FBWF installed.
-	KB90849	8.0	n/a	Issue: File Write Denied events recorded when a change to the edb.log file is tried. Back to Contents
Client Issues - Expected Behavior - See the related articles for an explanation.
Reference	Related Article	Found In	Fixed In	Description
MACC-8314	KB92081	8.2.1.435	n/a	Issue: MACC reports 8.2.1.407 on Swin.sys when 8.2.1.435 (Update 5 Repost) is installed.
1213956	KB90522	8.0.0.950	n/a	Issue: The path is on an unsupported volume (error on virtual drives after installation of Application Control).
-	KB88915	8.0	n/a	Issue: Exclusions for ENS/VSE with Application and Change Control to improve post-install performance.
-	KB86758	8.0	n/a	Issue: Application Control denies ZIP files when run in the context of Java.exe or Javaw.exe.
-	KB90021	8.0.0	n/a	Issue: Digitally signed files lose the signature when moved from one client system to another.
-	KB88091	6.x	n/a	Issue: Application Control causes a Windows error event to occur when a new USB disk is connected to a solidified client. Back to Contents

Critical Solidcore Extension known issues

Client Issues
Reference	Related Article	Found In	Fixed In	Description
MACC-10698	-	8.3.3	-	Issue: Bug check was observed when an invalid memory region was accessed. Occurred when one thread is trying to modify the utl sid hash while the other is trying to access it. A timing issue. Because the utl sid hash isn’t modified often, the issue is rare.

Non-critical Solidcore Extension known issues

Contents

Solidcore Extension - Under Investigation
Solidcore Extension - Fixed
Solidcore Extension - Won’t Fix

Solidcore Extension - Under Investigation
Reference	Related Article	Found In	Fixed In	Description
MACC-10997	KB90036	8.3.4	-	Issue: MACC 8.3.4 Client package can't be checked in to ePO 5.9.1 by default to the Master repository. Workaround: See the Related Article.
MACC-10905	-	8.3.4	-	Issue: When a file is renamed in case sensitive folder, the old entry isn’t removed from Inventory. Workaround: No Workaround as the functionality at client isn’t impacted.
MACC-10981	-	8.3.4, 8.3.3	-	Issue: When two Binaries present with same name under case sensitive path, only one file gets reflected in ePO Inventory page. Workaround: No Workaround as the functionality at client isn’t impacted.
MACC-10957	-	8.3.4, 8.3.3	-	Issue: Database errors seen intermittently while parsing policy Discovery request. Issue only seen when Binary info is missing in the Policy Discovery XML generated by client.
MACC-10987	-	8.3.4	-	Issue: Errors are reported intermittently for GTI communication in the Orion.log file. Workaround: This error can be ignored and no functionality impact.
MACC-10735	-	8.3.3	-	Issue: After Extension upgrade, newly added configurations under McAfee General (Configuration) Policy for a user-defined policy aren’t updated on Endpoint. The reason is because, currently, migration task doesn’t modify user-defined policies. So on upgrade, migration task doesn’t store new UI values for user-defined configuration policies in the database. Workaround: Open and save the policy manually to get these changes updated in the policy database. NOTE: After you save the policy, send a wake-up call on endpoints.
MACC-10632	-	8.3.3	-	Issue: With Case sensitivity Enabled on Parent folder, and when MACC tries to install on subfolder under parent folder, the install rollback happens as expected. But clean up of files doesn’t happen. Installers leave behind files in the subfolder. Workaround: Manual clean-up needed.
MACC-10631	-	8.3.3	-	Issue: When Solidcore installation is tried on folders with Case Sensitivity Enabled, the installer removes the case sensitivity folder and creates a case insensitivity folder. Installation is continued instead of a graceful install failure on the case sensitive folder.
MACC-10664	-	8.3.3	-	Issue: Rarely observed execution denied for a file when the file copy happens in Enable mode through a non-updater process and solidified. The issue is a rare occurrence and a timing issue.
MACC-10511	-	8.3.2	-	Issue: Unknown query is seen running on SQL for a long time, and is causing performance issues. Error found in Orion logs: 902 DEBUG [scheduler-InternalTask-thread-19] util.CloudUtil - Converting HashResponseVO to CloudBinaryDetail Workaround: Turn off the following solidcore setting in ePO's server setting: Synchronize reputation information with McAfee GTI Server.
MACC-10103	-	8.3.1.111	8.3.2	Issue: (Cosmetic only) Enable task doesn’t save MP, SAU disablement, or the observe mode option when you click Save. Pull inventory also experiences the same behavior.
MACC-10035	-	8.3.1	-	Issue: In Windows 7, when MACC is upgraded from 8.0.2 to 8.3.1, the reboot process takes more than 3 minutes.
MACC-8695	-	8.2.6	-	Issue: After solidcore is upgraded to 8.2.6 version in the "disable" mode and MACC enabled, the Solidcore upgrade property in ePO doesn’t get updated. It shows status as Reboot required, even after multiple reboots. NOTE: The issue occurs only if the upgrade is performed in the "Disable" mode.
MACC-8700	-	8.2.6	-	Issue: When solidcore is upgraded to 8.2.6 and rebooted, the ePO solidcore product version under system "Properties" doesn’t display the upgraded product version. The issue is intermittent.
1254921		8.2.0	8.2.1.143 Update 3	Issue: When you add two or more Solidcore rules to an Integrity Monitoring policy for Windows, after you save the policy, only one Solidcore Rule is saved. NOTE: Previously resolved with MACC 8.2.121 Hotfix 1.
1255177		8.2.1	8.2.1.143 Update 3	Issue: When the Solidcore Client is enabled with Limited Activation in Observe Mode, Solidcore Client Status is shown as “Observe” instead of “Observe (Limited).” This value shows in the Solidcore Client Status column from the System Tree. NOTE: Previously resolved with MACC 8.2.121 Hotfix 1.
1255936		8.2.0	-	Issue: When a rule for updaters is added in an Application Control Rules policy for Windows or UNIX, the rule can be created with three different conditions: None, Library, or Parent. After saving the updater rule with one of the conditions (different to None), if the user tries to edit the rule, the None condition is selected by default. If it’s saved again, it’s saved as None. Workaround: When editing a rule, change the condition to the one selected originally before saving the policy.
1256249		8.2.0	-	Issue: Some Tasks in Server Task Log remain in Waiting status indefinitely after executing different operations. This action causes all other tasks executed after that to remain in Waiting status as well. Workaround: To be allowed to perform Server Tasks, restart McAfee ePolicy Orchestrator services.
1260315		8.2.0	-	Issue: When you add a rule for executable files in an Application Control Rules policy for Windows, the rule can be created with three different rule types: Name, SHA-1, and SHA-256. After you save the rule with one of these types, you can no longer change the rule type. Workaround: Delete the rule and create it again with the other rule type.
1262809		8.2.1		Issue: After you remove a user who is the owner of one or more Solidcore rules, if anyone tries to access the Solidcore Rules page, the message “An unexpected error occurred” is displayed.
-	KB81304	8.0	-	Issue: Application Control endpoint inventory parsing might cause the SCOR_DATA_CHANNEL table to grow quickly in the ePolicy Orchestrator database.
-	KB88248	8.0	-	Issue: Stale records appear on the Inventory page when a Purge System Inventory task is run immediately after a client has been removed from ePolicy Orchestrator.
-	KB88255	8.0	-	Issue: Self-Approval Client pop-up text field limitations within Application Control. Resolution: The Self-Approval Client pop-up text field has a maximum character limitation of 296 characters. The text field for Self-Approval within ePO has a maximum character limitation of 300 characters. Because of the fixed nature of the text field, scrolling of text within the pop-up field on the client isn’t allowed.
1186364	KB89430	8.0	-	Issue: Application Control events are reported back to the ePO server from a client that only has Change Control enabled.
1249451	KB90818	8.0		Issue: High event flow in the SCOR_FD_Data_Channel temporary table results in a deadlock and events stacking up.
1267790	KB91492	8.2.0	-	Issue: Application and Change Control Global Threat Intelligence registered server connection fails in ePolicy Orchestrator 5.10.
1270782 1270891 1247470	KB91532	8.0	-	Issue: Server task "Solidcore: Send Policy and Inventory Feedback to McAfee GTI Server" runs indefinitely. Workaround: Disable the Solidcore: Send Policy and Inventory Feedback to McAfee GTI Server task.
1147259		8.0.0	-	Issue: Need to add an auto-trigger mechanism if a later version content-package is already checked in before you install the extension.
1158794		8.0.0	-	Issue: The site administrator might see the wrong classification for an APP, which the global administrator shares.
1152557		8.0.0	-	Issue: Multiple entries of the help extension are displayed. Workaround: The toc.xml file can be edited, so delete all node tag whose href starts from "mac_700" resolves the issue.
1151953		8.0.0	-	Issue: Internal Server Error is observed when you click the SHA-1 link on the PD detail page.
1169661		8.0.0	-	Issue: Inconsistency on translation for 'fetch'.
1171354		8.0.0	-	Issue: Policy discovery processing might experience performance issues if an inventory pull is performed for 10K or more hosts at the same time.
1171909		8.0.0	-	Issue: Improper translation on the message in Solidcore events page.
1172330		8.0.0	-	Issue: Improper translation on the value for property Upgrade Status: Success.
1242102	KB90646	8.0.0	-	Issue: Rule group import fails if rules contain SHA-256 installers that weren’t added to the Installer tab before import. Workaround: See the related article for details. Back to Contents
Solidcore Extension - Fixed
Reference	Related Article	Found In	Fixed In	Description
MACC-10844		8.3.3	8.3.4	Issue: The Orion.log file records multiple internal reputation check errors. Workaround: Resolved. The file no longer has the error message.
MACC-10881		8.3.3	8.3.4	Issue: When App Control rules are imported, it displays error message. Workaround: After the MACC extension upgrade, importing App Control rules work appropriately without any error messages.
1231366		8.2.1	8.2.1.435 Update 5 Repost	Issue: Pull Inventory now works as expected on all systems. NOTE: Previously resolved with 8.2.1 Update 4 (RTS)
1267576		8.2.1	8.2.1.435 Update 5 Repost	Issue: MACC no longer causes deadlocks on ePO. NOTE: Previously resolved with 8.2.1 Update 4 (RTS)
1261696		8.2.1	8.2.1.435 Update 5 Repost	Issue: Updater Processes in MACC extension now retain Parent Process condition through Edit Updater dialog prompt. NOTE: Previously resolved with 8.2.1 Update 4 (RTS)
1260315 1266061		8.2.1	8.2.1.435 Update 5 Repost	Issue: Executable file events are now saved successfully as SHA-1 or SHA-256 on Edit Updater dialog prompt. NOTE: Previously resolved with 8.2.1 Update 4 (RTS)
1261888		8.2.1	8.2.1.435 Update 5 Repost	Issue: OL7 Rule Group is now added to Integrity Monitor Solidcore Rules. NOTE: Previously resolved with 8.2.1 Update 4 (RTS)
1258409		8.2.1	8.2.1.435 Update 5 Repost	Issue: Solidcore Events Query now runs successfully after you upgrade to a later version. NOTE: Previously resolved with 8.2.1 Update 4 (RTS)
1266119		8.2.1	8.2.1.435 Update 5 Repost	Issue: Automatic Response now works successfully after you add Full Path filter. NOTE: Previously resolved with 8.2.1 Update 4 (RTS)
1255936		8.2.1	8.2.1.435 Update 5 Repost	Issue: Application and Change Control Rule group now retains the conditions correctly after change. NOTE: Previously resolved with 8.2.1 Update 4 (RTS)
1243461		8.2.1	8.2.1.435 Update 5 Repost	Issue: SCCM default rule group is now updated with changes. NOTE: Previously resolved with 8.2.1 Update 4 (RTS)
1263607		8.2.1	8.2.1.435 Update 5 Repost	Issue: MACC extension no longer uses high memory/CPU consumption. NOTE: Previously resolved with 8.2.1 Update 4 (RTS)
1269350		8.2.1	8.2.1.435 Update 5 Repost	Issue: MACC now triggers an Automatic Response when you use "Solidcore events" as "Event Group". NOTE: Previously resolved with 8.2.1 Update 4 (RTS)
1268960		8.2.1	8.2.1.435 Update 5 Repost	Issue: The event of "Content Change Tracking" is no longer indicated as garbled characters. NOTE: Previously resolved with 8.2.1 Update 4 (RTS)
1261903		8.2.1	8.2.1.435 Update 5 Repost	Issue: Performance improvement in loading Policy discovery events. NOTE: Previously resolved with 8.2.1 Update 4 (RTS)
1262809 1262887 1269610		8.2.1	8.2.1.435 Update 5 Repost	Issue: The “Unexpected Error” message no longer displays when clicked “Solidcore rules”, after you remove the owned group user. NOTE: Previously resolved with 8.2.1 Update 4 (RTS)
1269631		8.2.1.121	8.2.1.435 Update 5 Repost	Issue: You can now use wildcard in write protection exclusion for Application Control and Change Control. NOTE: Previously resolved with 8.2.1 Update 4 (RTS)
1247470 1270782 1270891		8.2.1	8.2.1.435 Update 5 Repost	Issue: Send Policy and Inventory Feedback to McAfee GTI Server now runs as expected. NOTE: Previously resolved with 8.2.1 Update 4 (RTS)
1263571		8.2.1	8.2.1.435 Update 5 Repost	Issue: MACC extension reflects SHA-256 correctly. NOTE: Previously resolved with 8.2.1 Update 4 (RTS)
1250845		8.1.1.104	8.2.1.143 Update 4	Issue: Non-English Character no longer crashes Event Parser. NOTE: Previously resolved with 8.2.1 Update 4 (RTS).
1262809		8.2.1	8.2.1.435 Update 5 Repost	Issue: Policy discovery events are now displayed correctly in Queries and Reports. NOTE: Previously resolved with 8.2.1 Update 4 (RTS).
1269768 1269752 1270154		8.2.1	8.2.1.435 Update 5 Repost	Issue: The GTI feature is now supported on McAfee ePO 5.10. NOTE: Previously resolved with 8.2.1 Update 4 (RTS).
1268501		8.2.1	8.2.1.435 Update 5 Repost	Issue: Improved performance on the Policy discovery page now fixes total items count when a filter is added. NOTE: Previously resolved with 8.2.1 Update 4 (RTS)
1257561		8.0.0	8.2.1.143 Update 3	Issue: When you try to import a group of rules on the Solidcore Rules page, the task fails and shows the message: Data with same key already exists in Database
1259241		8.2.2.144	8.2.1.143 Update 3	Issue: High memory use of Tomcat after you upgrade Solidcore extension to 8.2.1.114. NOTE: Previously resolved with 8.2.121 Hotfix 1.
1268054	KB91257	8.2.1	8.2.1.143 Update 3	Issue: Out-dated default rules might cause Windows updates installation failure. Workaround: See the related article for details.
1240399 1240411 1239874 1257561	KB90596	8.0	8.2.1.143 Update 3	Issue: Rule groups are removed if installer checks fail and generate Rule Group Sanity Check errors. NOTE: Previously resolved with 8.2.121 Hotfix 1.
-	KB84651	8.0	8.2.1.143 Update 3	Issue: Upgrading the extension for Application Control 6.2.0 and later takes a long time to complete. NOTE: Previously resolved with 8.2.121 Hotfix 1.
1173493	KB88261	8.0 7.0	8.1.1.103	Issue: You see the message: You are not authorized for this operation. This issue occurs when you click the helpdesk notification link of the Request Approval URL in Application and Change Control. See the Related Article for more information.
1203024		8.0	8.1.1.103	Issue: Skiplist exclusion filters with asterisk in the path can't be saved.
1220637 1210786 1236799	KB90092	8.0	8.1.1.103	Issue: Performance issues occur after installation of the Application and Change Control extension.
1224811	KB90254	8.0	8.0.0.950 Hotfix 5	Issue: GTI communication error occurs between server and client, with Application and Change Control installed.
1212789	KB89386	8.0	8.0.1.223	Issue: Application and Change Control 8.x consumes a greater number of resources than the previously released versions, which result in performance issues. NOTE: Previously resolved with MACC 8.0.0.855 Hotfix 3
1266204 1271125 1271183	KB91462	8.2.1.121	n/a	Issue: Unexpected error occurs when you create an SC Enable task in ePolicy Orchestrator. Resolution: Fix is attached to the related article. Back to Contents
Solidcore Extension - Won’t Fix
Reference	Related Article	Found In	Fixed In	Description
1249255	KB90787	8.0	n/a	Issue: Duplicate users appear in client policy when Trusted Users group is synchronized with Active Directory.
1228409	KB90374	8.1.0.118	n/a	Issue: Endpoint Security Web Control Extension is disabled after you install Web Control on a system with Application and Change Control 8.1.0.118.1 present. Back to Contents

Related Information

To contact Technical Support, go to the Create a Service Request page and log on to the ServicePortal.

If you are a registered user, type your User ID and Password, and then click Log In.
If you are not a registered user, click Register and complete the fields to have your password and instructions emailed to you.

Affected Products

Application and Change Control 8.3.x
Application and Change Control 8.2.x
Application and Change Control 8.1.x
Application and Change Control 8.0.x
Getting Started
Known Issue/Product Defect
Upgrade/Migrate

Languages:

This article is available in the following languages:

German
English United States
Spanish Spain
French
Italian
Japanese
Portuguese Brasileiro
Chinese Simplified

Glossary of Technical Terms

Highlight Glossary Terms

Please take a moment to browse our Glossary of Technical Terms.

Knowledge Center

Application Control 8.x Known Issues (Windows)

Environment

Summary

Related Information

Affected Products

Languages:

Glossary of Technical Terms

Title

Title

Knowledge Center

Application Control 8.x Known Issues (Windows)

Environment

Summary

Related Information

Affected Products

Languages:

Glossary of Technical Terms

Choose your region

Title

Title