Windows 10 VM fails to run and analyze submitted files

Technical Articles ID: KB89978
Last Modified: 5/7/2020

Environment

McAfee Advanced Threat Defense (ATD) 4.x

Problem

You successfully create, activate, and validate a Windows 10 VM. But, when you send a file to the VM for scanning and observe it in XMODE the VM starts, a file does not run.

Solution 1

Confirm that the VM profile uses the correct user name, for example, administrator. Correct the user name if needed, using VM Profile:

Log on to the ATD manager as the administrator user.
Click Policy, VM Profile.
Select the Windows 10 VM that has the issue.
Click Edit.
In the VM logon field, confirm that the user name is administrator. If not, update the user name.

NOTE: If the operating system is a non-English language, the VM logon account must reflect that language. For example, if the operating system is in Spanish, you must name the VM logon administrador, not administrator.

Solution 2

If you are using the correct account, confirm that the installingmsi.exe process is running correctly:

Make sure the installingmsi.exe process runs at startup and is running:
1. Log on to the ATD manager using the administrator user.
2. Click Policy, VM Profile.
3. Select the Windows 10 VM that has the issue.
4. Click Edit, Activate.
5. In the Activation browser window, click Start, Run.
6. Type taskmgr.exe and click OK to open the Task Manager window.
7. Click the Processes tab, and then confirm whether the installingmsi.exe process is running:
  - If the installingmsi.exe process is not running, run the vmdk preparation tool.
    NOTE: See the ATD product guide for your release for steps on how to run the vmdk preparation tool.
  - If the installingmsi.exe process is running, gracefully shut down the Windows operating system in the activation browser window.
8. After Windows shuts down, close the activation browser window.
9. Click Save to start the VM creation.
Create the key and value:
1. Boot the VM using the Activate option located under the VM Profile, and then click New.
2. Click Start, Run, type regedit.exe, and then click OK.
3. Navigate to HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System.
4. Locate the key FilterAdministratorToken and set its value to 0 (zero) if it is not yet set.
5. Exit the registry.
6. Shut down the VM.
Send a file to the VM and confirm it is scanned.
If the file is not scanned, open a Service Request with McAfee, and provide this article number in the Problem Description field.

Related Information

To contact Technical Support, go to the Create a Service Request page and log on to the ServicePortal.

If you are a registered user, type your User ID and Password, and then click Log In.
If you are not a registered user, click Register and complete the fields to have your password and instructions emailed to you.

Affected Products

Advanced Threat Defense 4.8.x
Advanced Threat Defense 4.6.x (EOL)
Advanced Threat Defense 4.4.x (EOL)
Advanced Threat Defense 4.2.x
Advanced Threat Defense 4.0.x (EOL)
Known Issue/Product Defect
Troubleshooting

Languages:

This article is available in the following languages:

English United States
Spanish Spain
French
Italian
Portuguese Brasileiro

Knowledge Center

Windows 10 VM fails to run and analyze submitted files

Environment

Problem

Solution 1

Solution 2

Related Information

Affected Products

Languages:

Title

Title

Knowledge Center

Windows 10 VM fails to run and analyze submitted files

Environment

Problem

Solution 1

Solution 2

Related Information

Affected Products

Languages:

Choose your region

Title

Title