Windows 10 VM fails to run and analyze submitted files

Technical Articles ID: KB89978
Last Modified: 5/7/2020

Environment

McAfee Advanced Threat Defense (ATD) 4.x

Problem

You successfully create, activate, and validate a Windows 10 VM. But, when you send a file to the VM for scanning and observe it in XMODE the VM starts, a file does not run.

Solution

Confirm that the VM profile uses the correct user name, for example, administrator. Correct the user name if needed, using VM Profile:

Log on to the ATD manager as the administrator user.
Click Policy, VM Profile.
Select the Windows 10 VM that has the issue.
Click Edit.
In the VM logon field, confirm that the user name is administrator. If not, update the user name.

NOTE: If the operating system is a non-English language, the VM logon account must reflect that language. For example, if the operating system is in Spanish, you must name the VM logon administrador, not administrator.

Solution

If you are using the correct account, confirm that the installingmsi.exe process is running correctly:

Make sure the installingmsi.exe process runs at startup and is running:
1. Log on to the ATD manager using the administrator user.
2. Click Policy, VM Profile.
3. Select the Windows 10 VM that has the issue.
4. Click Edit, Activate.
5. In the Activation browser window, click Start, Run.
6. Type taskmgr.exe and click OK to open the Task Manager window.
7. Click the Processes tab, and then confirm whether the installingmsi.exe process is running:
  - If the installingmsi.exe process is not running, run the vmdk preparation tool.
    NOTE: See the ATD product guide for your release for steps on how to run the vmdk preparation tool.
  - If the installingmsi.exe process is running, gracefully shut down the Windows operating system in the activation browser window.
8. After Windows shuts down, close the activation browser window.
9. Click Save to start the VM creation.
Create the key and value:
1. Boot the VM using the Activate option located under the VM Profile, and then click New.
2. Click Start, Run, type regedit.exe, and then click OK.
3. Navigate to HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System.
4. Locate the key FilterAdministratorToken and set its value to 0 (zero) if it is not yet set.
5. Exit the registry.
6. Shut down the VM.
Send a file to the VM and confirm it is scanned.
If the file is not scanned, open a Service Request with McAfee, and provide this article number in the Problem Description field.

Related Information

To contact Technical Support, log on to the ServicePortal and go to the Create a Service Request page at https://support.mcafee.com/ServicePortal/faces/serviceRequests/createSR:

If you are a registered user, type your User Id and Password, and then click Log In.
If you are not a registered user, click Register and complete the required fields. Your password and logon instructions will be emailed to you.

Affected Products

Advanced Threat Defense 4.8.x
Advanced Threat Defense 4.6.x
Advanced Threat Defense 4.4.x
Advanced Threat Defense 4.2.x
Advanced Threat Defense 4.0.x
Known Issue/Product Defect
Troubleshooting

Languages:

This article is available in the following languages:

English United States
Spanish Spain
French
Italian
Portuguese Brasileiro

Glossary of Technical Terms

Highlight Glossary Terms

Please take a moment to browse our Glossary of Technical Terms.

Windows 10 VM fails to run and analyze submitted files

Environment

Problem

Solution

Solution

Related Information

Affected Products

Languages:

Glossary of Technical Terms

Title

Title

Featured Solutions:Draft for New Nav

Explore Our Portfolio

Security Outcomes

Industries

Products

Featured Solutions

Explore Our Portfolio

MVISION Products

Services & Training

Threat Research

Our Researchers

Threat Landscape Dashboard

Tools

Contact Us

Resources

Downloads

Product Help

Connect with Us

Explore

Our Company

Our Efforts

Other Resources

Careers

Partnerships

Windows 10 VM fails to run and analyze submitted files

Environment

Problem

Solution

Solution

Related Information

Affected Products

Languages:

Glossary of Technical Terms

Choose your region

Title

Title