Execution Control feature causes CMD or other processes to crash after upgrading to Application and Change Control 8.2.1-407 (Update 5)

Technical Articles ID: KB91933
Last Modified: 5/15/2020

Environment

McAfee Application and Change Control (MACC) 8.2.1-407 (Update 5)
Microsoft Windows

Problem

The CMD.exe and other processes fail to start after you upgrade to MACC 8.2.1-407 (Update 5) from any version. You see the following error in the Solidcore log file:

(Rule String: Execution-Control failed due to an internal error. Blocking by default)

NOTES:

This issue affects systems that are not using the Mcafee Default "Execution Control" rule group or have modified it.
Standalone installations of MACC are not affected.
The system log file shows SCSRVC.exe crashing many times.

Cause

In normal processing, we validate that the HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SWIN\Parameters\RuleEngine key matches the process list in HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SWIN\Parameters\CandidateProcesses.

When a new Execution Control rule is created, our code adds that process to the candidate process registry. If all processes from the Execution Control rule group are removed, the process is then removed from this table.

This conflict occurs after upgrading. Our installer repopulates the candidate process registry table with default processes. If the default rule group is removed or modified, it creates a mismatch between the rule engine table and compatibility table. This mismatch blocks the process.

Solution

This issue has been corrected in MACC 8.2.1-435 (Repost). Upgrade to MACC 8.2.1-435 (Repost) if you experience the issue described in this article.

McAfee product software, upgrades, maintenance releases, and documentation are available from the Product Downloads site.

NOTE: You need a valid Grant Number for access. See KB56057 - How to download Enterprise product updates and documentation for more information about the Product Downloads site, and alternate locations for some products.

Workaround

Before you upgrade to MACC 8.2.1-407 (Update 5), disable the Execution Control feature through the Policy in ePolicy Orchestrator (ePO):

Navigate to Application Control Options, Features.
Deselect Execution-Control.

Workaround

Disable the feature from the CLI by running the following command:

sadmin features disable Execution-Control

Workaround

Disable the feature by executing an SC: Run command client task from ePO:

"features disable Execution-Control"

Workaround

Make sure the McAfee "Execution Control" Rule group is assigned to the systems in your policy before you upgrade.

Affected Products

Application and Change Control 8.2.x
Known Issue/Product Defect

Languages:

This article is available in the following languages:

English United States
Spanish Spain
French
Italian
Portuguese Brasileiro

Glossary of Technical Terms

Highlight Glossary Terms

Please take a moment to browse our Glossary of Technical Terms.

Knowledge Center

Execution Control feature causes CMD or other processes to crash after upgrading to Application and Change Control 8.2.1-407 (Update 5)

Environment

Problem

Cause

Solution

Workaround

Workaround

Workaround

Workaround

Affected Products

Languages:

Glossary of Technical Terms

Title

Title

Knowledge Center

Execution Control feature causes CMD or other processes to crash after upgrading to Application and Change Control 8.2.1-407 (Update 5)

Environment

Problem

Cause

Solution

Workaround

Workaround

Workaround

Workaround

Affected Products

Languages:

Glossary of Technical Terms

Choose your region

Title

Title