Script As Updater injection into all processes results in degraded performance and system crashes

Technical Articles ID: KB89466
Last Modified: 12/17/2019

Environment

McAfee Application and Change Control (MACC) 8.0.0 - 8.0.0.817, 7.0.1.413 and earlier

Problem

MACC injects Script as Updater into all application and operating system processes. Injection of Script as Updater results in performance issues and system crashes.

Cause

DLL injection by MACC into all processes causes conflicts with applications, logon scripts, and the operating system.

Solution

This issue is resolved in MACC 7.0.1 HF5 (released August 29, 2017) and MACC 8.0.0 HF3 (released October 25, 2017). Technical Support recommends upgrading to the appropriate build. If upgrading is not possible, follow the steps provided in the workaround below.

Workaround

To work around this issue without disabling Script As Updater (manually on client):

Start the Solidcore command line interface (CLI).
Unlock the CLI.
Type the command sadmin recover and press Enter.
Run one of the following commands:

Windows 8 and later:
sadmin config set DisableDeviceGuardCompat=1

Windows 7 and earlier:
sadmin features disable sau

NOTE: This command config set is another way to inject the Script As Updater DLL into certain processes. There is no security concern with running this command.

Restart the system.

To work around this issue without disabling Script As Updater (from the ePO server):

Start the ePO console.
Navigate to the Client Task Catalog.
Create a Client Task, SC: Run Command.
Type the appropriate command in Run Commands:

Windows 8 and later:
config set DisableDeviceGuardCompat=1

Windows 7 and earlier:
features disable sau

NOTE: This command config set is another way to inject the Script As Updater DLL into certain processes. There is no security concern with running this command.

Verify that you can successfully run the following command locally on the client:

Sadmin config show -d | findstr DisableDeviceGuardCompat

Related Information

Script as Updater is needed if a script file has to modify a solidified system. It requires patching of the ntdll.dll that is loaded in an Interpreter process. The patching is needed to make sure that MACC is notified when a script is being run and a check the updater rule is configured for it. The patching of ntdll.dll makes it vulnerable to issues. As of now, a Script as Updater bypass does not exist.

Script as Updater is to be injected only into script interpreters' processes, not all processes. When applying an Application Control key while MP is disabled, scinject.dll is injected only in script interpreters. The same logic exists for the Execution Control feature, which needs to hook the same functions as Script as Updater is hooking.

Affected Products

Application and Change Control 8.0.x
Application and Change Control 7.0.x (EOL)
Known Issue/Product Defect

Languages:

This article is available in the following languages:

German
English United States
Spanish Spain
French
Italian
Japanese
Portuguese Brasileiro
Chinese Simplified

Knowledge Center

Script As Updater injection into all processes results in degraded performance and system crashes

Environment

Problem

Cause

Solution

Workaround

Related Information

Affected Products

Languages:

Title

Title

Knowledge Center

Script As Updater injection into all processes results in degraded performance and system crashes

Environment

Problem

Cause

Solution

Workaround

Related Information

Affected Products

Languages:

Choose your region

Title

Title