Script As Updater injection into all processes results in degraded performance and system crashes

Technische Artikel ID: KB89466
Zuletzt geändert am: 12/17/2019

Umgebung

McAfee Application and Change Control (MACC) 8.0.0 - 8.0.0.817, 7.0.1.413 and earlier

Problem

MACC injects Script as Updater into all application and operating system processes. Injection of Script as Updater results in performance issues and system crashes.

Ursache

DLL injection by MACC into all processes causes conflicts with applications, logon scripts, and the operating system.

Lösung

This issue is resolved in MACC 7.0.1 HF5 (released August 29, 2017) and MACC 8.0.0 HF3 (released October 25, 2017). Technical Support recommends upgrading to the appropriate build. If upgrading is not possible, follow the steps provided in the workaround below.

Behelfslösung

To work around this issue without disabling Script As Updater (manually on client):

Start the Solidcore command line interface (CLI).
Unlock the CLI.
Type the command sadmin recover and press Enter.
Run one of the following commands:

Windows 8 and later:
sadmin config set DisableDeviceGuardCompat=1

Windows 7 and earlier:
sadmin features disable sau

NOTE: This command config set is another way to inject the Script As Updater DLL into certain processes. There is no security concern with running this command.

Restart the system.

To work around this issue without disabling Script As Updater (from the ePO server):

Start the ePO console.
Navigate to the Client Task Catalog.
Create a Client Task, SC: Run Command.
Type the appropriate command in Run Commands:

Windows 8 and later:
config set DisableDeviceGuardCompat=1

Windows 7 and earlier:
features disable sau

NOTE: This command config set is another way to inject the Script As Updater DLL into certain processes. There is no security concern with running this command.

Verify that you can successfully run the following command locally on the client:

Sadmin config show -d | findstr DisableDeviceGuardCompat

Themenbezogene Informationen

Script as Updater is needed if a script file has to modify a solidified system. It requires patching of the ntdll.dll that is loaded in an Interpreter process. The patching is needed to make sure that MACC is notified when a script is being run and a check the updater rule is configured for it. The patching of ntdll.dll makes it vulnerable to issues. As of now, a Script as Updater bypass does not exist.

Script as Updater is to be injected only into script interpreters' processes, not all processes. When applying an Application Control key while MP is disabled, scinject.dll is injected only in script interpreters. The same logic exists for the Execution Control feature, which needs to hook the same functions as Script as Updater is hooking.

Betroffene Produkte

Application and Change Control 8.0.x
Application and Change Control 7.0.x
Known Issue/Product Defect

Sprachen:

Dieser Artikel ist in folgenden Sprachen verfügbar:

German
English United States
Spanish Spain
French
Italian
Japanese
Portuguese Brasileiro
Chinese Simplified

Technisches Glossar

Glossarbegriffe hervorheben

Im technischen Glossar werden Fachbegriffe erklärt.

Knowledge Center

Script As Updater injection into all processes results in degraded performance and system crashes

Umgebung

Problem

Ursache

Lösung

Behelfslösung

Themenbezogene Informationen

Betroffene Produkte

Sprachen:

Technisches Glossar

Title

Title

Knowledge Center

Script As Updater injection into all processes results in degraded performance and system crashes

Umgebung

Problem

Ursache

Lösung

Behelfslösung

Themenbezogene Informationen

Betroffene Produkte

Sprachen:

Technisches Glossar

Wählen Sie Ihre Region

Title

Title