Access Protection events for
masvc.exe are generated on the client after you install VSE 8.8 Patch 4 or earlier.
The issue only occurs when VSE 8.8.0 Patch 4 or earlier is deployed to the client in the following sequence:
- Install or upgrade to McAfee Agent 5.0.5.
- Deploy VirusScan Enterprise 8.8.0 Patch 4 or earlier.
You see the following MA symptoms:
- Unable to collect and send properties
- Fails to receive new policies or tasks from ePolicy Orchestrator (ePO)
- Unable to upload events
Examples of Access Protection events:
Blocked by Access Protection rule NT AUTHORITY\SYSTEM C:\Program Files\McAfee\Agent\masvc.exe \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Network Associates\TVD\Shared Components\Framework Common Standard Protection:Prevent modification of McAfee Common Management Agent files and settings Action blocked : Write
Blocked by Access Protection rule NT AUTHORITY\SYSTEM C:\Program Files\McAfee\Agent\masvc.exe \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Network Associates\TVD\Shared Components\Framework\AgPlcyEnableEventTrigger Common Standard Protection:Prevent modification of McAfee Common Management Agent files and settings Action blocked : Create
Blocked by Access Protection rule NT AUTHORITY\SYSTEM C:\Program Files\McAfee\Agent\masvc.exe \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Network Associates\TVD\Shared Components\Framework\AgPlcyEventTriggerThreshold Common Standard Protection:Prevent modification of McAfee Common Management Agent files and settings Action blocked : Create
Blocked by Access Protection rule NT AUTHORITY\SYSTEM C:\Program Files\McAfee\Agent\masvc.exe \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Network Associates\TVD\Shared Components\Framework Common Standard Protection:Prevent modification of McAfee Common Management Agent files and settings Action blocked : Write
Blocked by Access Protection rule NT AUTHORITY\SYSTEM C:\Program Files\McAfee\Agent\masvc.exe \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Network Associates\TVD\Shared Components\Framework Common Standard Protection:Prevent modification of McAfee Common Management Agent files and settings Action blocked : Write
Blocked by Access Protection rule NT AUTHORITY\SYSTEM C:\Program Files\McAfee\Agent\masvc.exe \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Network Associates\TVD\Shared Components\Framework\IPAddress Common Standard Protection:Prevent modification of McAfee Common Management Agent files and settings Action blocked : Create
Blocked by Access Protection rule NT AUTHORITY\SYSTEM C:\Program Files\McAfee\Agent\masvc.exe \REGISTRY\MACHINE\Software\Wow6432Node\Network Associates\TVD\Shared Components\Framework Common Standard Protection:Prevent modification of McAfee Common Management Agent files and settings Action blocked : Write
Blocked by Access Protection rule NT AUTHORITY\SYSTEM C:\Program Files\McAfee\Agent\masvc.exe \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Network Associates\TVD\Shared Components\Framework\ePOServerList Common Standard Protection:Prevent modification of McAfee Common Management Agent files and settings Action blocked : Create
