Windows 10 VM fails to run and analyze submitted files

Technical Articles ID: KB89978
Last Modified: 12/21/2017

Environment

McAfee Advanced Threat Defense (ATD) 4.x

Problem

You create a Windows 10 VM and Activation and Validation are successful.
But, when you send a file to the VM for scanning and observe it in XMODE, the VM starts but no file is run.

Solution

Check that the VM profile is using the correct user name, for example, administrator. Correct the user name if needed, using VM Profile.

Log on to the ATD manager using the admin user.
Click Policy, VM Profile.
Select the VM in question, in this case Windows 10 VM that has the issue.
Click Edit.
In the VM logon field, check that the user name is administrator. Correct if not.

NOTE: If the Operating System is a non-English language, the VM logon account must reflect this fact.
For example, if the Operating System is in Spanish, the VM logon must be administrador, not administrator.

Solution

If you are using the correct account, check the installingmsi.exe process is running correctly:

Make sure the installingmsi.exe process runs at startup and is running:
1. Log on to the ATD manager using the admin user.
2. Click Policy, VM Profile.
3. Select the VM in question, in this case the Windows 10 VM experiencing the issue.
4. Click Edit, Activate.
5. In the Activation browser window, click Start, and then click Run.
6. Type taskmgr.exe and click OK to open the Task Manager window.
7. Click the Processes tab, then check whether the installingmsi.exe process is running.
  - If installingmsi.exe process is not running, run the vmdk preparation tool.
    NOTE: See the ATD Product Guide for your release for steps on how to run the vmdk preparation tool.
  - If the installingmsi.exe process is running, gracefully shut down the Windows OS in the activation browser window.
8. After Windows shuts down, close the activation browser window.
9. Click Save to start the VM creation.
Create the key and required value manually:
1. Boot the VM using the Activate option located under the VM Profile, and then click New.
2. Click Start, Run, type regedit.exe, and then click OK.
3. Navigate to HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System.
4. Locate the key FilterAdministratorToken and set its value to 0 (zero) if it is not yet set.
5. Exit the registry.
6. Shut down the VM.
Send a file to the VM and check it is scanned.
If the file is not scanned, open a support case with McAfee quoting this article number.

Related Information

To contact Technical Support, log on to the ServicePortal and go to the Create a Service Request page at https://support.mcafee.com/ServicePortal/faces/serviceRequests/createSR:

If you are a registered user, type your User Id and Password, and then click Log In.
If you are not a registered user, click Register and complete the required fields. Your password and logon instructions will be emailed to you.

Affected Products

Advanced Threat Defense 4.2.x
Advanced Threat Defense 4.0.x
Known Issue/Product Defect
Troubleshooting

Glossary of Technical Terms

Highlight Glossary Terms

Please take a moment to browse our Glossary of Technical Terms.

Windows 10 VM fails to run and analyze submitted files

Environment

Problem

Solution

Solution

Related Information

Affected Products

Glossary of Technical Terms

Title

Title

Featured Solutions

Explore Our Portfolio

Security Outcomes

Industries

Products

Featured Solutions

Explore Our Portfolio

MVISION Products

Services & Training

Threat Research

Our Researchers

Threat Landscape Dashboard

Tools

Contact Us

Resources

Downloads

Product Help

Connect with Us

Explore

Our Company

Our Efforts

Other Resources

Careers

Partnerships

Windows 10 VM fails to run and analyze submitted files

Environment

Problem

Solution

Solution

Related Information

Affected Products

Glossary of Technical Terms

Choose your region

Title

Title