Security Audit Failure / Code Integrity messages for amcfg.exe, fwwindowsfirewallhandler.exe, and mfeamsiprovider.dll

Technical Articles ID: KB92489
Last Modified: 6/15/2022

Environment

Endpoint Security (ENS) 10.x

Problem

The Windows Event Viewer shows Security Audit Failure messages for amcfg.exe, fwwindowsfirewallhandler.dll, or mfeamsiprovider.dll. There's no functional impact to ENS or the operating system. All referenced modules are signed and the messages are benign.

Log example:

Code Integrity determined that a process (\Device\HarddiskVolume3\Program Files\Windows Defender\MpCmdRun.exe) attempted to load \Device\HarddiskVolume3\Program Files\McAfee\Endpoint Security\Threat Prevention\MfeAmsiProvider.dll that did not meet the Microsoft signing level requirements.

Windows Event Viewer Security Audit Failure message for amcfg.exe

Windows Event Viewer Security Audit Failure message for amcfg.exe

Solution

The ENS 10.7.0 February 2020 Update lowers the frequency of the messages being seen. We're investigating how to eliminate the events.

To receive email notification when this article is updated, click Subscribe on the right side of the page. You must be logged on to subscribe.

Related Information

To enable the Code Integrity verbose view:

Start Windows Event Viewer, and navigate to Applications and Services Logs, Microsoft, Windows, CodeIntegrity.
Click the CodeIntegrity node to give it focus.
Right-click Code Integrity and select the View item from the shortcut menu.
Select Show Analytic and Debug Logs, which creates a subtree with two more nodes: Operational and Verbose.
Right-click the Verbose node and select Properties from the shortcut menu.
On the General tab, click Enable Logging to enable the verbose logging mode.
Reboot the system to reload all kernel-mode binaries.
After rebooting, open the MMC Computer Management snap-in and view the Code Integrity verbose event log.

Affected Products

Endpoint Security Threat Prevention 10.7.x
Endpoint Security Threat Prevention 10.6.x
Known Issue/Product Defect

Languages:

This article is available in the following languages:

English United States
Spanish Spain
French
Italian
Japanese
Portuguese Brasileiro
Chinese Simplified

Knowledge Center

Security Audit Failure / Code Integrity messages for amcfg.exe, fwwindowsfirewallhandler.exe, and mfeamsiprovider.dll

Environment

Problem

Solution

Related Information

Affected Products

Languages:

Title

Title

Knowledge Center

Security Audit Failure / Code Integrity messages for amcfg.exe, fwwindowsfirewallhandler.exe, and mfeamsiprovider.dll

Environment

Problem

Solution

Related Information

Affected Products

Languages:

Choose your region

Title

Title