Loading...

Knowledge Center


Application Control causes a Windows error event to occur when a new USB disk is connected to a solidified client
Technical Articles ID:   KB88091
Last Modified:  8/14/2019

Environment

McAfee Application Control (MACC) 8.x.x, 7.x.x, 6.x.x

Problem

The following Windows error event occurs when a new USB disk is connected to a solidified client:
 
McAfee Solidifier prevented an attempt to modify file C:\windows\system32\drivers\USBSTOR.SYS

Cause

This error is generated and logged when an attempt is made to modify a non-Updater process. The behavior is considered normal and occurs by design.

Solution

The drvinst.exe process must be added to the Updaters list. Perform the following steps:

For standalone installations of MACC
  1. Start the Solidifier CLI.
  2. Type the following command:

    sadmin updaters add -t DrvInst1 -p svchost.exe drvinst.exe

For ePolicy Orchestrator-managed installations of MACC
Create a Solidcore Rule Group following these steps:
  1. Click Menu, Configuration, Solidcore Rules.
  2. Click Add Rule Group.
  3. Provide a new rule group name and set the Type as Application Control and the Platform as Windows.
  4. Click Save.
  5. Search for the rule group that you created in the previous step.
  6. Click Edit to edit the rule group.
  7. Select the Updater Processes tab.
  8. Click Add.
  9. In the Add Updater dialog box, set Binary as drvinst.exe and Updater Label as DrvInst1.
  10. Select Parent under Condition.
  11. Type svchost.exe for Parent.
  12. Click OK.
  13. Save the rule group.
Apply the Solidcore Rule Group following these steps:
  1. Click Menu, Policy Catalog.
  2. Set Product to Solidcore 7.x.x: Application Control and Category to Application Control Rules (Windows).
  3. Edit an existing assigned policy for Solidcore. For example, the Windows Update rule group that includes drvinst.exe as an updater.
  4. Click Add.
  5. Search for and select the rule group that you created in the previous step.
  6. Click OK.
  7. Save the policy.
  8. Perform a wake up to the agents and push the new rule to clients.

Rate this document

Beta Translate with

Select a desired language below to translate this page.

Languages:

This article is available in the following languages:

English United States
Japanese

Glossary of Technical Terms


 Highlight Glossary Terms

Please take a moment to browse our Glossary of Technical Terms.