Event ID 20845

[User43712381]

I'm currently seeing a couple of events that I don't see in the mcafee_application_and_change_control_8.3.x_-_windows_product_guide. The event is as follows: Event Category: Application Blocked Event ID: 20845 Threat Severity: Error Threat Name: VTP_TRUSTED. I searched the product guide for event ID 20845 and nothing comes up.

[BenEllis]

Are you asking about vtp trusted? 

In solidcore it works the same as ENS.

https://docs.mcafee.com/bundle/endpoint-security-10.6.0-common-client-product-guide-windows/page/GUI...

VTP trusted means that the binary was signed by microsoft or mcafee and we allowed it. 

VTP

VTP fallback is a good  option to avoid EXECUTION DENIED events on non-critical binaries such as Cortana’s DLL, Defender, etc.

8.2.1 update 5 and above includes a new mechanism to allow the execution of trusted binaries (MSFT & MFE signed) to avoid execution denies of non-solidified files.

 Additionally this logic will NOT allow non-solidified binaries to be launched in boot time prior VTP service starts

[User43712381]

So your stating that the reason Im getting the Application Blocked is due to the application launching at boot time and the VTP service has not started?

[BenEllis]

No i dont know the full extent of the error you are seeing and when you are seeing it.

I am stating VTP_Trusted event is due to the VTP feature.

[BenEllis]

VTP_Trusted is usually allowed not blocked. Even though it says error. Can you show us one of the events fully? 

[User43712381]

This is the event.

[BenEllis · Accepted solution]

So the error is misleading. VTP_Trusted means its allowed. 

Yes its confusing and i have been trying to get this fixed and documented in our guides but its still not updated. 

You can submit a ticket with support to help prioritize that fix and update if you would like but bottom line 

when you see VTP_Trusted this means it allowed and didnt block. its poor event notification on our part. 

[User43712381]

Benjamin Ellis,

           Thanks for your help. This answered my question. I think I will exclude these events from reporting up.